On 14 September 2023 Advocate General Ćapeta delivered an opinion on whether disclosing personal information of a professional athlete on an anti-doping body’s website complies with GDPR. The opinion of an advocate general is not binding on the CJEU, which will deliver its judgment later, but an opinion is persuasive to the CJEU in reaching its ultimate judgment. The case was taken by an Austrian professional middle-distance runner who was found guilty of acting in breach of Austrian anti-doping rules. The Austrian Anti-Doping Legal Committee (ÖADR) banned her from participating in sporting competitions of any kind for a period of four years. That decision was confirmed by the ÖADR and by Austria’s independent arbitration committee, the USK. The athlete has challenged, on the basis of the GDPR, a processing operation, by which her name, together with, inter alia, her actions in breach of the anti-doping rule and her resulting suspension, has been placed on the publicly accessible part of the NADA’s (Nationale Anti-Doping Agentur Austria) website, in the form of an entry in a table of persons breaching the anti-doping rules.

The opinion is noteworthy in a few respects as it evaluates the following:

1. the scope of GDPR;
2. the proportionality of such a disclosure;
3. the nature of health data; 
4. whether a doping offence is criminal in nature; and
5. whether a sports tribunal constitutes a court or tribunal under EU law.

Does GDPR apply to the publication of personal information in respect of doping offences?

AG Ćapeta opined: “To my mind, if a data processing activity in a Member State cannot be connected (even loosely) with an area covered by EU law, the GDPR does not apply.” The processing of personal data for the purpose of implementing a Member State’s anti-doping legislation is not, according to AG Ćapeta, an activity that, as EU law currently stands, brings that processing activity within the scope of such law. AG Ćapeta outlined that the European Union “does not have competence to regulate sport” but that the CJEU has considered that EU law applies to sport when it is understood as an economic activity. “In such a situation, I find it difficult to establish the necessary link with EU law in order to consider the circumstances of the present case as a Member State activity which falls within the scope of EU law. I am, therefore, of the view that the GDPR does not apply to the present case.” AG Ćapeta did, however, leave the door open for a contrary ruling by the CJEU and so, turned to the issue of proportionality and deterrence in respect of the disclosure, if EU law is considered to apply to the present facts.

Proportionality

The Austrian Federal Law on anti-doping (“ADBG”) outlines that the USK (or the ÖADR) must inform the general public of its decisions, stating the name of the persons concerned, as well as the duration of the ban and the reasons for the ban. That obligation concerns primarily, professional athletes, and, in certain instances, recreational athletes. In addition, the ADBG allows for an additional review of proportionality when decisions are made as to whether to publish breaches of anti-doping rules by recreational athletes and vulnerable persons. AG Ćapeta held that provided, however, it contains accurate information, “this type of interference with the data subject’s right to data protection is not overly harsh (even if one may question whether suspension for life is excessive, but that is a different issue), whereas the benefit of deterring young athletes by making them aware of such a possibility cannot be understated.”

AG Ćapeta held, therefore, that the measure requiring personalised disclosure to the general public of the anti-doping offences committed by professional athletes is adequate and necessary for deterring current and future athletes from committing such offences. Discussing the medium of dissemination (which was contested by the athlete) if the obligation to make information which includes personal data available to the general public is found to be justified, the only way for that obligation to be fulfilled in modern society is by publication on the internet. “Just as no one would ask a person to go from door to door announcing news items after the invention of the printing press by Gutenberg, with the advent of the internet, print publication (such as, for instance, a newsletter) is no longer an adequate means of making information available to the general public.”

The scope of “data concerning health”

As defined in Article 4(15) of the GDPR, ‘“data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.’ AG Ćapeta noted the finding that the applicant consumed or was in the possession of certain prohibited substances “says nothing about her physical or mental health status” and proposed that the Court rule that the information that a professional athlete has committed a breach of an anti-doping rule linked to the use or attempted use or possession of a prohibited substance or method does not, in itself, constitute “data concerning health”, within the meaning of Article 9 of the GDPR. This is significant as Article 9 requires enhanced lawful bases for processing such as the data subject’s explicit consent. 

On a related topic, in many sporting federations athletes can avail of a Therapeutic Use Exemption (“TUE”) through which an athlete can obtain approval to use a prescribed prohibited substance or method for the treatment of a legitimate medical condition. Based on AG Ćapeta’s assessment, it would seem likely that disclosure of details underlying a TUE would indeed say something about the athlete’s physical or mental health status and therefore come under the protection of Article 9 of the GDPR. 

Although the UK is no longer in the EU, it’s worth noting that in the UK the issue has been addressed head on. Schedule 1 to the UK’s Data Protection Act 2018 provides a list of conditions which, if one is met, permit the processing of the special categories of personal data and criminal conviction data. Section 27 of Part 2 to Schedule 1 relates to processing for the purposes of anti-doping. 

             (1) This condition is met if the processing is necessary— 

(a) for the purposes of measures designed to eliminate doping which are undertaken by or under the responsibility of a body or association that is responsible for eliminating doping in a sport, at a sporting event or in sport generally, or 

(b) for the purposes of providing information about doping, or suspected doping, to such a body or association. 

(2) The reference in sub-paragraph (1)(a) to measures designed to eliminate doping includes measures designed to identify or prevent doping. 

(3) If the processing consists of the disclosure of personal data to a body or association described in sub-paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place.

This does not, however, expressly permit disclosure of athlete personal data relating to doping to the public.

Criminal nature of the penalty

AG Ćapeta noted that the penalty imposed for the breach of the anti-doping rules at issue is of a criminal nature within the meaning of Article 10 of the GDPR; “I do not think that it would be useful, in general, to regard breaches of anti-doping rules, such as those at issue in the present case, as mere breaches of the (private) rules of individual sporting clubs or organisations.” By virtue of the wording of that provision, that processing must occur either under the control of ‘official authority’ or under EU or national law providing for appropriate safeguards of the rights and freedoms of the data subject concerned. “I propose that the Court rule that Article 10 of the GDPR must be interpreted as applying to the processing of personal data relating to the possession and partial use by a professional athlete, in connection with a sporting activity, of substances listed on the WADA Prohibited List.” A finding that a processing operation falls within the scope of Article 10 of the GDPR requires that the interests of the data subject be given more weight in a balancing exercise on disclosure.

Admissibility

While the opinion is of great interest to those in the fields of sports law and privacy (and particularly their intersection), the opinion also deals with EU procedural rules and admissibility of the USK’s reference to the CJEU and whether the USK constitutes a ‘court or tribunal’ within the meaning of Article 267 TFEU. This is relevant as Article 267 TFEU allows only ‘courts or tribunals’ to seek an interpretation of EU law from the CJEU and the USK is not one of the bodies that prima facie belongs to the judiciary in Austria. AG Ćapeta noted that “In principle, when a request for a preliminary ruling is received from a national court that is considered to be part of the judicial branch of the government in the respective Member State, the Court will consider the reference to be admissible. However, when such a request is made by a body that does not belong to the judiciary in the classical sense of the word under Article 267 TFEU, the Court will not automatically reject the reference. Instead, it will check whether the referring body might nevertheless be regarded as a ‘court or tribunal’ within the meaning of that provision.” The CJEU has developed several criteria which it takes into consideration when determining whether it may admit a reference including whether the referring body is established by law; whether it is permanent; whether its jurisdiction is compulsory; whether its procedure is inter partes; whether it applies rules of law and whether it is independent (internally and externally). Having assessed the facts in the case such as the structure of the USK and the required qualifications of its members, AG Ćapeta determined that the USK does constitute a ‘court or tribunal’ within the meaning of Article 267 TFEU.