CJEU, 14 Jul 2026, C-474/24 (NADA Austria and Others), ECLI:EU:C:2026:579.

Provisional text

JUDGMENT OF THE COURT (Grand Chamber)

14 July 2026 (*)

( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2 – Material scope – Articles 5 and 6 – Principles relating to processing and the lawfulness of processing – Article 9 – Concept of ‘data concerning health’ – Article 10 – Concept of ‘personal data relating to criminal convictions and offences’ – Combating doping in sport – Online publication of the name of a person who has infringed anti-doping rules, the length of time for which that person is banned from participating in sporting events and the reasons for that ban – Balancing of interests – Proportionality – Article 77 – Right to lodge a complaint with a supervisory authority where such publication is imminent )

In Case C-474/24,

REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesverwaltungsgericht (Federal Administrative Court, Austria), made by decision of 28 June 2024, received at the Court on 4 July 2024, in the proceedings

AR,

YT,

DI,

RN

intervening parties:

Österreichische Datenschutzbehörde,

Nationale Anti-Doping Agentur Austria GmbH (NADA Austria),

Österreichische Anti-Doping Rechtskommission (ÖADR),

THE COURT (Grand Chamber),

composed of K. Lenaerts, President, T. von Danwitz, Vice-President, C. Lycourgos, I. Jarukaitis, M.L. Arastey Sahún, J. Passer (Rapporteur), M. Condinanzi and F. Schalin, Presidents of Chambers, E. Regan, N. Piçarra, A. Kumin, N. Jääskinen, B. Smulders, S. Gervasoni and N. Fenger, Judges,

Advocate General: D. Spielmann,

Registrar: R. Șereș, Administrator,

having regard to the written procedure and further to the hearing on 13 May 2025,

after considering the observations submitted on behalf of:

–        AR, YT, DI and RN, by J. Öhlböck, Rechtsanwalt,

–        the Österreichische Datenschutzbehörde, by M. Schmidl and E. Wagner, acting as Agents,

–        Nationale Anti-Doping Agentur Austria GmbH (NADA Austria), by T. Grünvaldska and A. Schütz, Rechtsanwälte, and by K. Van Quathem, advocaat,

–        the Austrian Government, by J. Schmoll and C. Gabauer, acting as Agents,

–        the Latvian Government, by J. Davidoviča, K. Pommere and S. Zellis, acting as Agents,

–        the Netherlands Government, by M.K. Bulterman and H.S. Gijzen, acting as Agents,

–        the Polish Government, by B. Majczyna, acting as Agent,

–        the Finnish Government, by M. Pere, acting as Agent,

–        the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 25 September 2025,

gives the following

Judgment

1        This request for a preliminary ruling concerns the interpretation of the first sentence of Article 16(2) TFEU, and of Article 5(1)(a) and (c), the second subparagraph of Article 6(3), and Articles 9, 10, 17 and 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2; ‘the GDPR’).

2        The request has been made in proceedings between the athletes AR, YT, DI and RN, on the one hand, and Nationale Anti-Doping Agentur Austria GmbH (NADA Austria) and the Österreichische Anti-Doping Rechtskommission (ÖADR) (Austrian Anti-Doping Legal Committee; ‘the ÖADR’), on the other, concerning the publication on the internet of several items of information regarding them, relating to infringements of the Austrian anti-doping legislation committed by those athletes.

 Legal context

 The Code

3        The World Anti-Doping Code, in the version in force in 2021 (‘the Code’), drawn up by the World Anti-Doping Agency, is the foundational text on the worldwide fight against doping in sport, as is clear from the Copenhagen Declaration of 5 March 2003 on Anti-Doping in Sport. That code is a private instrument which the States signatories to the United Nations International Convention against Doping in Sport, which was signed on 19 October 2005 in Paris and entered into force on 1 February 2007, have undertaken to respect. Both that declaration and that convention were signed by all Member States of the European Union.

4        Article 2 of the Code lists, in paragraphs 1 to 11 thereof, the categories of anti-doping rule violations.

5        Article 2.6 of the Code, which refers to possession of a prohibited substance or a prohibited method by an athlete or athlete support person, read in conjunction with Article 4.4 thereof, authorises the use of certain substances for therapeutic purposes.

6        Article 14.3.2 of the Code requires the anti-doping organisations concerned to disclose publicly ‘the disposition of the anti-doping matter, including the sport, the anti-doping rule violated, the name of the Athlete or other Person committing the violation, the Prohibited Substance or Prohibited Method involved (if any) and the Consequences imposed’.

 European Union law

 The FEU Treaty

7        Article 16 TFEU provides:

‘1.      Everyone has the right to the protection of personal data concerning them.

2.      The European Parliament and the Council [of the European Union], acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.

…’

8        Article 165 TFEU provides:

‘…

2.      Union action shall be aimed at:

…

–        developing the European dimension in sport, by promoting fairness and openness in sporting competitions and cooperation between bodies responsible for sports, and by protecting the physical and moral integrity of sportsmen and sportswomen, especially the youngest sportsmen and sportswomen.

…

4.      In order to contribute to the achievement of the objectives referred to in this Article:

…

–        the Council, on a proposal from the [European] Commission, shall adopt recommendations.’

 The GDPR

9        Recitals 10 to 12, 16, 35, 39, 51 and 112 of the GDPR state:

‘(10)      In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation. In conjunction with the general and horizontal law on data protection implementing Directive 95/46/EC [of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)], Member States have several sector-specific laws in areas that need more specific provisions. This Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the processing of special categories of personal data (“sensitive data”). To that extent, this Regulation does not exclude Member State law that sets out the circumstances for specific processing situations, including determining more precisely the conditions under which the processing of personal data is lawful.

(11)      Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.

(12)      Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules relating to the free movement of personal data.

…

(16)      This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. This Regulation does not apply to the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union.

…

(35)      Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for, or the provision of, health care services as referred to in Directive 2011/24/EU of the European Parliament and of the Council [of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ 2011 L 88, p. 45)] to that natural person; a number, symbol or particular assigned to a natural person to uniquely identify the natural person for health purposes; information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device or an in vitro diagnostic test.

…

(39)      Any processing of personal data should be lawful and fair. … The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. …

…

(51)      Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … Such personal data should not be processed, unless processing is allowed in specific cases set out in this Regulation, taking into account that Member States law may lay down specific provisions on data protection in order to adapt the application of the rules of this Regulation for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.

…

(112)      Those derogations should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange between competition authorities, tax or customs administrations, between financial supervisory authorities, between services competent for social security matters, or for public health, for example in the case of contact tracing for contagious diseases or in order to reduce and/or eliminate doping in sport. …’

10      Article 2 of the GDPR, entitled ‘Material scope’, provides:

‘1.      This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

2.      This Regulation does not apply to the processing of personal data:

(a)      in the course of an activity which falls outside the scope of Union law;

…’

11      Article 4 of the GDPR, entitled ‘Definitions’, provides:

‘For the purposes of this Regulation:

(1)      “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2)      “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

…

(15)      “data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

…’

12      Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, is worded as follows:

‘1.      Personal data shall be:

(a)      processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

…

(c)      adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

…’

13      Article 6 of the GDPR, entitled ‘Lawfulness of processing’, states:

‘1.      Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(c)      processing is necessary for compliance with a legal obligation to which the controller is subject;

…

(e)      processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

…

3.      The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a)      Union law; or

(b)      Member State law to which the controller is subject.

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

…’

14      Article 9 of the GDPR, entitled ‘Processing of special categories of personal data’, provides:

‘1.      Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2.      Paragraph 1 shall not apply if one of the following applies:

(a)      the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

…

(g)      processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

…

(i)      processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

…’

15      Article 10 of the GDPR, entitled ‘Processing of personal data relating to criminal convictions and offences’, provides:

‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’

16      Article 17 of the GDPR, entitled ‘Right to erasure (“right to be forgotten”)’, provides:

‘1.      The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

…

3.      Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

…

(b)      for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

…’

17      Chapter V of the GDPR, entitled ‘Transfers of personal data to third countries or international organisations’, contains Articles 44 to 50 of that regulation.

18      Article 57 of the GDPR, entitled ‘Tasks’, provides, in paragraph 1 thereof:

‘Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

…

(f)      handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;

…’

19      Article 58 of the GDPR, entitled ‘Powers’, lists, in paragraph 1 thereof, the investigative powers that each supervisory authority has, and paragraph 2 thereof provides:

‘Each supervisory authority shall have all of the following corrective powers:

(a)      to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

…’

20      Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’, provides:

‘1.      Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2.      The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’

21      Article 78 of the GDPR, entitled ‘Right to an effective judicial remedy against a supervisory authority’, provides, in paragraph 1 thereof:

‘Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’

 Austrian law

22      Paragraph 1 of the Anti-Doping-Bundesgesetz 2021 (2021 Federal Law on Anti-Doping) of 23 December 2020 (BGBl. I, 152/2020; ‘the ADBG’), entitled ‘Objectives and infringement of anti-doping rules’, provides, in subparagraph 1 thereof, that, ‘by influencing athletic performance, doping is contrary to the principle of fairness in sporting competitions and to the genuine and intrinsic value of sport (sportsmanship), and can also be harmful to health’.

23      Paragraph 5 of the ADBG, entitled ‘Unabhängige Dopingkontrolleinrichtung [(Independent Anti-Doping Agency, Austria)]’, provides, in subparagraph 1 thereof, that the tasks of that agency include, inter alia, submitting requests for examination, in accordance with Paragraph 18 of the ADBG, to the ÖADR, where it considers that the ADBG has been infringed, and acting as a party to the procedures before the ÖADR and the Unabhängige Schiedskommission (Independent Arbitration Committee, Austria; ‘the USK’), in accordance with Paragraph 20(2) and Paragraph 23(2) of the ADBG.

24      Paragraph 5 of the ADBG provides, in subparagraphs 5 and 6 thereof:

‘(5)      In order to perform the tasks of the Independent Anti-Doping Agency, a non-profit-making limited liability company bearing the name “Nationale Anti-Doping Agentur Austria GmbH”, with the short designation “NADA Austria” [(“NADA”)], shall be set up … … In its capacity as controller pursuant to Article 4(7) of the GDPR, [NADA] shall process personal data.

(6)      The Independent Anti-Doping Agency must inform the Österreichische Bundes-Sportorganisation (BSO) [(Austrian Federal Sports Organization (BSO), Austria)], sports organisations, athletes, other individuals, and organisers of competitions of the following information, in addition to Paragraph 3, as well as make that information available to the general public free of charge:

1.      the bodies that are empowered to order doping tests;

2.      the criteria for inclusion in the national test pool (Paragraph 9);

3.      the reimbursement of the costs of the doping control procedure;

4.      without prejudice to the provisions of Paragraph 21(3) and Paragraph 23(14), the security measures (for example, suspensions) and bans that have been imposed on athletes and other persons, which have been brought to the attention of the Independent Anti-Doping Agency, and their lifting, indicating the names of the data subjects, the duration of the ban and the reasons for it, without allowing conclusions to be drawn regarding special categories of personal data of the data subjects, in particular data concerning health. That information may be omitted in the case of particularly vulnerable persons and recreational athletes. In the case of recreational athletes, the information must be disclosed for public health reasons where an anti-doping infringement pursuant to Paragraph 1(2)(3) or Paragraph 1(2)(9) to (11) has been established.

5.      which data, in particular which personal data and special categories of personal data, are processed, and the purpose for which they are processed in the context of anti-doping action or a doping control procedure.’

25      Paragraph 6 of the ADBG, entitled ‘Provisions pertaining to data protection law’, provides:

‘(1)      The Independent Anti-Doping Agency is empowered, in its capacity as controller pursuant to Article 4(7) of the GDPR, in so far as it is necessary for the performance of its tasks under [the ADBG] and for the implementation of [the ADBG], in particular in the context of the tasks of [the ÖADR] and [the USK], to process personal data. …

(2)      The Independent Anti-Doping Agency shall ensure the security of personal data and special categories of personal data, in accordance with Articles 32 to 34 of the GDPR. The necessity of data processing arises from the effective implementation of the anti-doping rules of [the Code] and the provisions of this Federal Law, in so far as the data subjects have contractually undertaken to comply with [the Code], and from fulfilment of the duties to provide information. Special categories of personal data, in particular data concerning health, may only be processed in so far as is strictly necessary under the anti-doping provisions of this Federal Law or of [the Code].

…’

26      Paragraph 7 of the ADBG, entitled ‘[The ÖADR]’, provides, in subparagraph 1 thereof:

‘[The ÖADR] is a committee independent of State bodies, private individuals and the Independent Anti-Doping Agency. Members of the ÖADR must not have been involved either in the investigation into an athlete or another person, in the decision whether to submit a request for examination in respect of an athlete or another person, or in the review of the decision of the ÖADR by [the USK] in accordance with Paragraph 8. The ÖADR must conduct disciplinary proceedings for the competent federal sports federation pursuant to the anti-doping rules in force of the competent international sports federation (anti-doping procedures).’

27      Paragraph 8 of the ADBG, entitled ‘[The USK]’, provides, in subparagraph 1 thereof:

‘The [USK] is a committee independent of State bodies, private individuals and the Independent Anti-Doping Agency. Members of the USK must not have been involved either in the investigation into an athlete or another person, in the decision whether to submit a request for examination in respect of an athlete or another person, or in the decision, subject to their review, of the ÖADR itself. Without prejudice to Paragraph 23(10)(1) and (2), [the USK] shall be established at the Independent Anti-Doping Agency in order to review the decisions of the ÖADR in anti-doping procedures.’

28      Paragraph 12 of the ADBG, entitled ‘Medical exemptions’, governs the procedure for issuing authorisations for the use of prohibited substances for therapeutic purposes.

29      Paragraph 20 of the ADBG, entitled ‘Procedures before [the ÖADR]’, provides, in essence, that the ÖADR is competent to conduct anti-doping procedures following requests for examination submitted by the Independent Anti-Doping Agency and to adopt decisions at first instance in the event of an infringement of the anti-doping rules of the competent international sports federation.

30      Paragraph 21 of the ADBG, entitled ‘Other provisions governing the procedures’, provides, in subparagraph 3 thereof:

‘The ÖADR must, no later than 20 days after the decision has become final, inform the BSO, sports organisations, athletes, other persons and organisers of competitions, as well as the general public, of security measures imposed (for example, suspensions) and decisions taken in anti-doping procedures, indicating the name of the data subject, the duration of the ban and the reasons for it, without allowing conclusions to be drawn regarding the data subject’s data concerning health. That information may be omitted in the case of particularly vulnerable persons, recreational athletes and persons who have contributed significantly to the detection of potential anti-doping infringements by disclosing information or other indications. In the case of recreational athletes, the information must be disclosed for public health reasons where an infringement of the anti-doping rules pursuant to Paragraph 1(2)(3) or Paragraph 1(2)(9) to (11) has been established.’

31      Paragraph 23 of the ADBG, entitled ‘Procedure before [the USK]’, states, in subparagraph 14 thereof:

‘The USK must inform the BSO, sports organisations, athletes, other persons, organisers of competitions and the general public of its decisions, indicating the name of the data subject, the duration of the ban and the reasons for it, without allowing conclusions to be drawn regarding the data subject’s data concerning health. That information may be omitted in the case of particularly vulnerable persons, recreational athletes and persons who have contributed significantly to the detection of potential infringements of the anti-doping rules by disclosing information or other indications. In the case of recreational athletes, the information must be disclosed for public health reasons where an infringement of the anti-doping rules pursuant to Paragraph 1(2)(3) or Paragraph 1(2)(9) to (11) has been established.’

32      Paragraph 24 of the ADBG, entitled ‘Special obligations of sports organisations’, provides, in essence, in subparagraph 4 thereof, that sports organisations may not employ persons subject to a ban under the anti-doping rules.

 The dispute in the main proceedings and the questions referred for a preliminary ruling

33      AR, YT, DI and RN, four athletes, were the subjects of decisions banning them from participating in competitions either for a fixed period or for life, taken either by the ÖADR, following anti-doping procedures conducted by it, or by the USK, which has competence to review the decisions of the ÖADR.

34      Under the Austrian anti-doping legislation, the bans forming the subject matter of the decisions of the ÖADR or of the USK are to be published, in the form of a list, by NADA on its website. That list is to include the first name and surname of the athlete concerned, the sports discipline practised, the infringement of anti-doping rules committed, the sanction imposed, and the start and end dates of the sanction. The ÖADR is also to publish those data on its own website, under the section ‘Press releases’.

35      In October 2021, the applicants in the main proceedings requested the ÖADR and NADA to remove from those websites the references to their names and the sports concerned.

36      Since the ÖADR and NADA did not accede to the requests of the applicants in the main proceedings, those applicants lodged a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority) pursuant to Article 77(1) of the GDPR, seeking a declaration that there had been an infringement of the right to erasure, provided for in Article 17 of that regulation, as well as an order requiring the ÖADR and NADA to remove that information from those websites. They argued that the case involved a special category of personal data, within the meaning of Article 9 of that regulation, and processing of personal data relating to criminal convictions and offences, within the meaning of Article 10 of that regulation. They submitted that the undifferentiated publication system provided for in Austrian law is incompatible with Article 6(3) of the GDPR and is neither necessary nor proportionate.

37      By decision of 26 November 2021, the Austrian Data Protection Authority rejected the complaint of AR, DI and RN as unfounded. That authority took the view, inter alia, that the publication of the data in question was necessary in order to comply with a legal obligation laid down in the anti-doping legislation and that, accordingly, a right to erasure was precluded under Article 17(3)(b) of the GDPR. As regards YT’s complaint, that authority rejected it on the ground that that person did not have an interest in lodging a complaint, on the ground that her data had not yet been published.

38      The applicants in the main proceedings brought an action against that decision on the basis of Article 78(1) of the GDPR before the Bundesverwaltungsgericht (Federal Administrative Court, Austria), which is the referring court. In that action, they essentially reiterated the arguments which they had put forward during the administrative procedure. In addition, YT relied on the fact that the decision of the ÖADR had imposed on her a four-year ban, and that publication of her data was therefore imminent. NADA argued, in particular, that the publication of the personal data concerned on its website was lawful, since it was necessary ‘for compliance with a legal obligation’ to which it was subject and ‘for the performance of a task carried out in the public interest’, within the meaning of points (c) and (e) of the first subparagraph of Article 6(1) of the GDPR. Therefore, NADA states that, in accordance with Article 17(3)(b) of that regulation, it is not required to erase those data from its website.

39      The referring court stayed the main proceedings because the USK had made a request for a preliminary ruling in the case, leading to the judgment of 7 May 2024, NADA and Others (C-115/22, EU:C:2024:384). After that request was declared inadmissible, the national proceedings before the referring court resumed.

40      In those circumstances the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1)      Does the processing of personal data relating to individuals by the publication of their name, the sport they practise, the anti-doping rule violation they have committed, the penalty imposed on them and the start and end dates of that penalty, in the form of an entry in a table on the publicly accessible part of the website of [NADA], https://www.nada.at/de/recht/suspendierungen-sperren, and in publicly accessible press releases issued by [the ÖADR] at https://www.oeadr.at, fall within the scope of Union law within the meaning of the first sentence of Article 16(2) TFEU, with the result that [the GDPR] is applicable to the processing of personal data in this way?

If Question 1 is answered in the affirmative:

(2)      Does information that a certain person has committed a specific [anti-doping rule] violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute “data concerning health” within the meaning of Article 9 of the GDPR?

(3)      Does the GDPR – in particular in the light of the second subparagraph of Article 6(3) of the GDPR – preclude national legislation which provides for the name of the person affected by the decision of [the ÖADR] or [the USK], the duration of the ban and the reasons for it to be published, but not in such a way as to make it possible to infer data concerning the health of the person concerned? Is it of any significance in this regard that, under that national legislation, such information need not be disclosed to the general public only if the person concerned is a recreational athlete, a minor or a person who has made a significant contribution to the detection of potential anti-doping [rule] violations by sharing information or other indications?

(4)      Does the GDPR – in particular in the light of the principles in Article 5(1)(a) and (c) thereof – require that publication be preceded in every case by a balancing of interests between the personal interests of the data subject that will be affected by publication, on the one hand, and the interests of the general public in being informed of the anti-doping [rule] violation committed by an athlete, on the other?

(5)      Does information that a certain person has committed a specific [anti-doping rule] violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute the processing of personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR?

If Question 5 is answered in the affirmative:

(6)      Must the activities or decisions of an authority which has been given responsibility for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures, in accordance with Article 10 of the GDPR, be subject to judicial review?

(7)      Is a complaint under Article 77 of the GDPR concerning an alleged infringement under Article 17 of the GDPR, in the case where the personal data relating to the data subject had not yet been processed at the time when the complaint was lodged with the supervisory authority and the latter adopted its decision, but was processed in the course of the proceedings before the appeal court, permissible, or does it subsequently become permissible, provided that, at the time when the complaint [is] lodged, there [are] already specific indications that an operation involving the processing of personal data by the controller [is] imminent or [will] take place in the near future?’

 Consideration of the questions referred

 The first question

41      By its first question, the referring court asks, in essence, whether Article 2(2)(a) of the GDPR, read in conjunction with the first sentence of Article 16(2) TFEU, must be interpreted as meaning that processing of personal data consisting in the publication, pursuant to national anti-doping rules, of the names of athletes sanctioned for infringing those rules, the sports discipline practised by them, the infringement of those rules that has been committed, the sanction imposed on those athletes, and the start and end dates of that sanction, comes within the scope of EU law and, accordingly, within the scope of that regulation.

42      It is undisputed that that information concerning persons sanctioned for infringing the national anti-doping rules, since it relates to identified natural persons, is ‘personal data’ within the meaning of Article 4(1) of the GDPR, and that its publication on the websites of NADA and the ÖADR, which are responsible for establishing and penalising such infringements, constitutes ‘processing’ within the meaning of Article 4(2) of that regulation.

43      Such publication falls within the very broad definition, set out in Article 2(1), of the GDPR’s material scope (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 61).

44      The referring court is nevertheless uncertain whether, given that the processing of personal data at issue in the main proceedings forms part of the fight against doping, it is excluded from that scope pursuant to the exception provided for in Article 2(2)(a) of the GDPR, which states that that regulation does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of Union law’.

45      That exception constitutes an implementation of the first sentence of Article 16(2) TFEU, which is the legal basis for the GDPR and which mandates the Parliament and the Council to lay down not only the rules relating to the protection of individuals with regard to the processing of personal data carried out in particular ‘by the Member States when carrying out activities which fall within the scope of Union law’, but also the rules relating to the free movement of such data.

46      It is clear from the Court’s case-law that the exception to the material scope of the GDPR provided for in Article 2(2)(a) of that regulation must, like the other exceptions exhaustively listed in Article 2(2) thereof, be interpreted strictly (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 62 and the case-law cited, and of 16 January 2024, Österreichische Datenschutzbehörde, C-33/22, EU:C:2024:46, paragraph 37).

47      In that context, the Court has previously had occasion to state that Article 2(2)(a) of that regulation, read in the light of recital 16 thereof, is designed solely to exclude from the scope of that regulation the processing of personal data carried out by State authorities in the course of an activity which is intended to safeguard national security or of an activity which can be classified in the same category (judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 66, and of 16 January 2024, Österreichische Datenschutzbehörde, C-33/22, EU:C:2024:46, paragraph 37).

48      The publication of the personal data referred to in paragraph 41 above by NADA and the ÖADR on their websites in the context of their activity forming part of the fight against doping does not, however, constitute processing such as to fall within the scope of Article 2(2)(a) of the GDPR.

49      It must therefore be found, as the Advocate General observed in point 45 of his Opinion, that the exception to the scope of the GDPR provided for in Article 2(2)(a) of the GDPR is not applicable to processing of personal data such as that at issue in the main proceedings.

50      Furthermore, as the Advocate General noted in points 46 to 59 of his Opinion, that finding is not capable of being called into question by NADA’s arguments alleging, first, that anti-doping policy is an area which, under the division of competences provided for in EU law, is a matter for the Member States, notwithstanding the supporting competence provided for in the field of sport by Article 165 TFEU, and second, that sport is an activity that has no economic characteristics.

51      Thus, the fact that the processing of personal data is carried out in the course of an activity which falls within the competence of the Member States does not have the effect of excluding that processing from the scope of the GDPR pursuant to Article 2(2)(a) thereof, provided that that activity is not intended to safeguard national security and cannot be classified in the same category (see, to that effect, judgment of 30 April 2025, Inspektorat kam Visshia sadeben savet, C-313/23, C-316/23 and C-332/23, EU:C:2025:303, paragraph 104).

52      Similarly, the allegedly non-economic nature of sport does not in any way have the effect of allowing that activity to be placed in the same category as the safeguarding of national security, with the result that such a nature cannot bring the activity at issue in the main proceedings within the scope of the exception under that provision and thereby remove it from the scope of the GDPR.

53      That conclusion is, moreover, confirmed by recital 112 of the GDPR, which expressly refers to the possibility, pursuant to the provisions set out in Chapter V of that regulation, of ‘data transfers [to third countries or international organisations] required and necessary for important reasons of public interest, for example in cases of international data exchange … in order to reduce and/or eliminate doping in sport’.

54      In the light of the foregoing considerations, the answer to the first question is that Article 2(2)(a) of the GDPR, read in conjunction with the first sentence of Article 16(2) TFEU, must be interpreted as meaning that processing of personal data consisting in the publication, pursuant to national anti-doping rules, of the names of athletes sanctioned for infringing those rules, the sports discipline practised by them, the infringement of those rules that has been committed, the sanction imposed on those athletes, and the start and end dates of that sanction, comes within the scope of EU law and, accordingly, within the scope of that regulation.

 The second question

55      By its second question, the referring court asks, in essence, whether Article 9 of the GDPR must be interpreted as meaning that the information that a certain person has committed a specific infringement of the anti-doping rules and is banned from participating in national and international competitions on account of that infringement is covered by the concept of ‘data concerning health’ within the meaning of Article 9.

56      Article 9 of the GDPR, relating, as its title indicates, to the processing of ‘special categories’ of personal data, lays down the principle that such processing is prohibited. As expressly stated in recital 51 of that regulation, personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms.

57      Those special categories of personal data, listed in Article 9(1) of the GDPR, include ‘data concerning health’. Those data cover, in accordance with Article 4(15) of that regulation, read in conjunction with recital 35 of that regulation, all personal data which reveal information relating to the past, current or future physical or mental health status of a natural person, including data relating to the provision of healthcare services to that person (judgment of 4 October 2024, Lindenapotheke, C-21/23, EU:C:2024:846, paragraph 76).

58      In that regard, the Court has previously held that, having regard to the objective of the GDPR, which is to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular of their private life, with respect to the processing of personal data concerning them, the concept of ‘data concerning health’ referred to in Article 9(1) of that regulation must be interpreted broadly (judgment of 4 October 2024, Lindenapotheke, C-21/23, EU:C:2024:846, paragraph 81 and the case-law cited).

59      In particular, that provision cannot be interpreted as meaning that the processing of personal data that are liable indirectly to reveal sensitive information concerning a natural person is excluded from the strengthened protection regime prescribed by that provision, if the effectiveness of that regime and the protection of the fundamental rights and freedoms of natural persons that it is intended to ensure are not to be compromised (judgment of 4 October 2024, Lindenapotheke, C-21/23, EU:C:2024:846, paragraph 82 and the case-law cited).

60      Therefore, in order for personal data to be classified as ‘data concerning health’, within the meaning of Article 9(1) of the GDPR, it is sufficient that they are capable of revealing information about the health status of the data subject by means of an intellectual operation involving collation or deduction (judgment of 4 October 2024, Lindenapotheke, C-21/23, EU:C:2024:846, paragraph 83 and the case-law cited).

61      In the present case, Paragraph 5(6), Paragraph 21(3) and Paragraph 23(14) of the ADBG provide for the disclosure to the general public of the bans and suspensions that form the subject matter of the decisions of the ÖADR or the USK and of their lifting, indicating the names of the data subjects, the duration of the ban and the reasons for it, ‘without allowing conclusions to be drawn regarding the data subject’s data concerning health’.

62      That said, it is apparent from the request for a preliminary ruling that the ÖADR indicates in the press releases published on its website the name of the prohibited substance in question.

63      In that regard, the referring court asks whether, in particular where the publication of an infringement of the anti-doping legislation makes reference to the name of the substance that the data subject had in his or her possession or took with the aim of enhancing his or her performance, such data may be regarded as ‘data concerning health’ within the meaning of Article 9(1) of the GDPR.

64      According to the case-law recalled in paragraphs 57 to 60 above, data relating to persons who have been sanctioned for infringing the national anti-doping rules are liable to be classified as ‘data concerning health’ where they are capable of revealing, even indirectly, by means of an intellectual operation involving collation or deduction, information relating to the past, current or future physical or mental health status of a natural person.

65      However, that may be the case only where the publication concerned makes reference to the name or category of the prohibited substance or method at issue. Where no such reference is made, nothing in that publication allows, in principle, to link the finding that the national anti-doping rules have been infringed, on the one hand, to information relating to the health status of the data subject, on the other.

66      Furthermore, the mere reference to the name of the prohibited substance that is present in the body of an athlete, as practised by the ÖADR, is generally insufficient to reveal information relating to the health status, including the future health status, of that athlete.

67      By contrast, it cannot be ruled out that, where it is combined with other information, the reference to the name or category of the prohibited substance or method at issue may, at least indirectly, reveal, by means of an intellectual operation involving collation or deduction, information relating to the health status, and, as the case may be, the future health status, of the data subject.

68      That is the case in particular where that person takes a substance or uses a method which is prohibited on account of a specific health condition, but has not applied for authorisation to use it for therapeutic purposes in line with the procedure under Paragraph 12 of the ADBG.

69      It is for the referring court to verify, in the light of all the circumstances attending the publications at issue in the main proceedings, in particular the publications by the ÖADR, which make reference to the name of the prohibited substance at issue, whether the information published constitutes ‘data concerning health’ within the meaning of Article 4(15) and Article 9(1) of the GDPR, read in the light of recital 35 of that regulation.

70      In the event that, following that verification, the referring court were to reach the conclusion that the data at issue do in fact constitute ‘data concerning health’ within the meaning of Article 9(1) of the GDPR, their publication would, in principle, be prohibited, subject, however, to the derogations provided for in Article 9(2) of that regulation, which must be interpreted strictly (see, to that effect, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C-252/21, EU:C:2023:537, paragraphs 68 and 76).

71      Thus, even supposing that the information at issue in the main proceedings constituted ‘data concerning health’ within the meaning of Article 9(1) of the GDPR, such a finding would not preclude, as is clear in particular from recital 51 of that regulation, that information from being processed if one of the conditions set out in Article 9(2) of the regulation is satisfied.

72      In the absence of explicit consent by the applicants in the main proceedings, in accordance with Article 9(2)(a) of the GDPR, the publication of such data on the website of the ÖADR could, inter alia, be permissible on the basis of Article 9(2)(g) of that regulation, provided that it is necessary for reasons of substantial public interest, on the basis of EU or Austrian law which is to be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, which it is for the referring court to ascertain.

73      It follows from all the foregoing considerations that the answer to the second question is that Article 9 of the GDPR must be interpreted as meaning that the information that a certain person has committed a specific infringement of the anti-doping rules and is banned from participating in national and international competitions on account of that infringement is not covered, in principle, by the concept of ‘data concerning health’ within the meaning of Article 9. By contrast, the situation is different where such information makes reference to the name or category of the prohibited substance or method concerned by that infringement and where that reference, combined with other information concerning that person, is capable of revealing, even indirectly, by means of an intellectual operation involving collation or deduction, information relating to the past, current or future physical or mental health status of that person.

 The third and fourth questions

74      By its third and fourth questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR must be interpreted as precluding national legislation which imposes on national anti-doping bodies an obligation to publish personal data concerning athletes sanctioned for infringing anti-doping rules, such as the names of the athletes concerned, the duration of the ban imposed on them and the reasons for it, with the exception of recreational athletes, particularly vulnerable persons and whistleblowers.

75      The referring court asks, in that context, whether that regulation requires, prior to the publication of those data, that the controller balance, on a case-by-case basis, the interests involved in order to ascertain whether such publication is proportionate in the light of the individual circumstances, or whether it is sufficient in that regard for the national legislature to set out, in abstract terms, the situations in which publication may or must be omitted. In the latter case, the referring court is uncertain whether the exceptions under the ADBG as regards situations involving recreational athletes, particularly vulnerable persons or whistleblowers are such as to ensure that the publications provided for by that national legislation are proportionate.

76      In that regard, it must be borne in mind that all processing of personal data must comply, first, with the principles relating to processing of data set out in Article 5 of the GDPR and, second, with one of the principles relating to lawfulness of processing listed in Article 6(1) of that regulation (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 96).

77      As regards the principles relating to the processing of personal data, the referring court points specifically to the principle set out in Article 5(1)(a) of the GDPR, according to which personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject, and the principle of ‘data minimisation’, set out in Article 5(1)(c) of that regulation, according to which those data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, and which gives expression to the principle of proportionality (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 98).

78      So far as concerns the principles relating to lawfulness of processing, Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as lawful, processing must fall within one of the cases provided for in Article 6(1) (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 99 and the case-law cited).

79      In that regard, as the Advocate General stated in point 139 of his Opinion, the processing of the personal data at issue in the main proceedings, namely the publication on the internet by NADA and the ÖADR of the names of athletes sanctioned for infringing the anti-doping rules, the duration of the ban imposed on them and the reasons for it, follows from Paragraph 5(6)(4) and Paragraph 21(3) of the ADBG. Accordingly, it should be stated that that processing is liable to fall within the scope of point (c) of the first subparagraph of Article 6(1) of the GDPR, pursuant to which that processing is lawful if and to the extent that it is ‘necessary for compliance with a legal obligation to which the controller is subject’.

80      In addition, that processing is carried out with a view to combating doping and thus in the performance of a task carried out in the public interest, which, moreover, is consistent with the objectives pursued by EU action under the last indent of Article 165(2) TFEU, that is to say, in particular, to promote fairness in sporting competitions and to protect the physical and moral integrity of sportsmen and sportswomen. Accordingly, it may also be covered by the first situation referred to in point (e) of the first subparagraph of Article 6(1) of the GDPR, under which processing is lawful if and to the extent that it is ‘necessary for the performance of a task carried out in the public interest’.

81      As regards processing covered by the situations where processing is lawful as set out in points (c) and (e) of the first subparagraph of Article 6(1) of the GDPR, Article 6(3) of the GDPR provides, inter alia, that EU or Member State law on the basis of which such processing is carried out must meet an objective of public interest and be proportionate to the legitimate aim pursued. The Court noted that the requirements laid down in that provision constitute an expression of the requirements arising from Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’), with the result that they must be interpreted in the light, in particular, of that article (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601, paragraph 69).

82      In that regard, it must be borne in mind that the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question (judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601, paragraph 70 and the case-law cited).

83      It is in the light of all of those factors that the compatibility with the GDPR of national legislation such as that at issue in the main proceedings should be examined.

84      In particular, it is necessary to ascertain, first, whether the publication on the internet by NADA and the ÖADR of the names of athletes sanctioned for infringing the anti-doping rules, the duration of the ban imposed on them and the reasons for it, as provided for by Paragraph 5(6)(4) and Paragraph 21(3) of the ADBG, pursues an objective of general interest; second, whether that publication is appropriate for attaining the objective of general interest pursued; third, whether the interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter which results from such publication is limited to what is strictly necessary, in the sense that that objective could not reasonably be achieved in an equally effective manner by other means less prejudicial to those fundamental rights of the data subjects, and fourth, whether that interference is not disproportionate to that objective, which implies, in particular, a balancing of the importance of the objective and the seriousness of the interference (see, to that effect, judgment of 22 November 2022, Luxembourg Business Registers, C-37/20 and C-601/20, EU:C:2022:912, paragraph 66).

85      First, it must be noted that legislation intended to combat doping in order to safeguard the fairness, integrity and objectivity of the conduct of competitive sport, ensure equal opportunities for athletes, protect their health and uphold the ethical values in sport, pursues an objective of general interest (see, to that effect, judgment of 18 July 2006, Meca-Medina and Majcen v Commission, C-519/04 P, EU:C:2006:492, paragraphs 43 to 45). Furthermore, as has been pointed out in paragraph 80 above, that objective is among the objectives pursued by EU action under the last indent of Article 165(2) TFEU.

86      Second, that objective of general interest may be pursued, beyond the adoption of sanctions for infringing the anti-doping rules, by disclosure to the general public of personal data such as those at issue in the main proceedings. That disclosure is such as to deter athletes from infringing those rules and thus to prevent doping in sport, by making infringements that have been committed known to the public and by informing the persons liable to sponsor the athlete in question. Furthermore, that disclosure contributes to preventing the circumvention of those rules and thus to ensuring the effectiveness of the sanctions imposed by preventing, through the provision of information to organisers of competitions and potential employers of the athlete concerned, that athlete from participating in competitions from which he or she must be excluded.

87      Accordingly, the publication of data relating to infringements of the anti-doping rules is appropriate for contributing to the attainment of the objective of general interest pursued, by contributing to deterrence and prevention and to the effectiveness of the sanctions imposed.

88      Third, as regards whether the obligation to publish at issue is necessary, it must be noted that that obligation serves to strengthen the sanctions imposed, which are necessary to ensure enforcement of the doping ban (see, to that effect, judgment of 18 July 2006, Meca-Medina and Majcen v Commission, C-519/04 P, EU:C:2006:492, paragraph 44).

89      That said, as recital 39 of the GDPR states, that requirement of necessity is not met where the objective of general interest pursued can reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 110).

90      However, it does not appear that measures less restrictive of the right to respect for private life and the right to the protection of the personal data of the data subjects – such as anonymised publication of the infringements of the anti-doping rules established and of the sanctions imposed, or publication that is limited to the persons responsible for implementing those sanctions, such as organisers of competitions and sports associations – are such as to achieve the objective referred to in paragraph 85 above as effectively as the publication, including athletes’ names, of the information at issue in the main proceedings on the websites of NADA and the ÖADR.

91      A sanction imposed for infringing the anti-doping rules attains the objective of deterrence and prevention all the better when it is published, by encouraging other athletes to refrain from using a doping product and the sanctioned athlete him or herself to refrain from using that product again.

92      Furthermore, having regard to the specific features of doping in sport, in order to avoid circumvention of the anti-doping rules and to ensure the effectiveness of the sanctions imposed, it is necessary that those sanctions be published and that the identity of the athlete concerned be disclosed to a public which is not limited to the persons responsible for implementing those sanctions, such as organisers of competitions and sports associations. It is true that implementation of the ban on participating in sporting competitions imposed on the athlete concerned requires, in particular, that the organisers of those competitions be aware of it. Nevertheless, as regards professional athletes, the publication of the sanction in question beyond a limited circle of persons does not appear to exceed what is necessary in order to inform persons who are indirectly concerned by that sanction and whose interests are affected by it, such as current or potential employers and sponsors of the sanctioned athlete.

93      Fourth, it must be borne in mind that the objective of general interest at issue may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure at issue, by properly balancing the objective of general interest against those rights. Consequently, for the purpose of assessing the proportionality of the processing at issue in the main proceedings, it is necessary to measure the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data that that processing involves and to determine whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601, paragraph 98).

94      In order to assess the seriousness of that interference, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them (judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C-184/20, EU:C:2022:601, paragraph 99).

95      If the referring court were to find that the information at issue in the main proceedings published by the ÖADR makes reference to the name or category of the prohibited substance or method and constitutes ‘data concerning health’, in the circumstances referred to in paragraph 73 above, that court should not only take account thereof in its assessment whether the requirements of proportionality arising from Article 5(1)(c) and Article 6(3) of the GDPR have been met, but it should also ascertain, as has been noted in paragraphs 70 to 72 above, whether the publication of those data satisfies the conditions laid down, inter alia, in Article 9(2)(g) of that regulation.

96      As regards the processing at issue carried out, in particular, by NADA, which publishes on its website the identity of the athlete concerned without, however, making reference to the substance at issue, it must be stated that such publication nevertheless entails a serious interference with the fundamental rights to respect for private life and to the protection of personal data, since it is such as to provoke social disapproval and result in the stigmatisation of the data subject. Furthermore, it is inherent in that publication that the information concerned is then freely accessible to a potentially unlimited number of persons. Moreover, once published, that information can be reproduced on other websites and thus remain accessible even after it has been erased from the website on which it was initially published. Such circumstances are capable of aggravating the consequences for the fundamental rights of the data subjects.

97      The seriousness of that interference must therefore be balanced against the importance of the objective pursued by the publication in question.

98      In that regard, it must be borne in mind that the third and fourth questions relate to the publication of personal data concerning professional athletes, who are not covered by the exceptions provided for by the ADBG, which pertain to recreational athletes, particularly vulnerable persons and whistleblowers. According to that law, that publication does not entail any individual assessment based on the circumstances.

99      It is in that context that the referring court asks whether the GDPR requires, prior to the publication of those data, that the controller balance, on a case-by-case basis, the interests involved in order to ascertain whether such publication is proportionate in the light of the individual circumstances, or whether it is sufficient in that regard for the national legislature to set out, in abstract terms, the situations in which publication may or must be omitted.

100    As is apparent from Paragraphs 21 and 23 of the ADBG, the Austrian legislature has envisaged, irrespective of the circumstances of each individual case, predefined situations, specifying the items of information to be set out in the publication in question and laying down certain exceptions. It has thus already laid down a framework for that publication and engaged in an abstract balancing exercise weighing the interests of the athletes whose personal data are disclosed against the interests connected with combating doping.

101    Nevertheless, in view of the seriousness of the interference with the fundamental rights to respect for private life and to the protection of the personal data of the data subjects that results, as has been pointed out in paragraph 96 above, from the online publication of sanctions for anti-doping infringements, it cannot be ruled out that, outside those predefined situations, there are specific circumstances in the light of which publication of the data at issue may prove to be incompatible with the requirement that a proper balance be struck between the different interests involved such as to ensure, in particular, that the seriousness of the interference entailed by the publication in question is proportionate to the importance of the objectives pursued.

102    Accordingly, as regards the fight against doping in sport, although Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR do not require an individual balancing exercise to be carried out in all cases, they nevertheless require that, where the situations predefined by the national legislation do not in themselves make it possible to ensure observance of the principle of proportionality in each individual case, the controllers must take due account of the circumstances of the case and carry out such an individual balancing exercise on the basis of those circumstances before publishing the data at issue on the internet.

103    That balancing exercise should also take account of the seriousness of the infringement of the anti-doping rules and the status of the data subject and, in particular, whether that person is a high-profile athlete who enjoys national or international renown in his or her specific area of activity or beyond it. In fact, high-level athletes who are well-known have a special responsibility.

104    Furthermore, as regards the length of the publication period, the longer that period is, the greater the impact on the interests and private life of the data subject and the greater the requirements relating in particular to the proportionality of that publication (see, to that effect, judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C-26/22 and C-64/22, EU:C:2023:958, paragraph 95). That is the case, in particular, where the publication is accessible to a potentially unlimited number of addressees.

105    Publication, including athletes’ names, of the information at issue in the main proceedings on the websites of NADA and the ÖADR for a period exceeding that during which the sanctions in question apply would not, in the light of the seriousness of the interference entailed by such publication with the fundamental rights enshrined in Articles 7 and 8 of the Charter, be proportionate to the importance of the objective pursued.

106    As regards, more specifically, publication, including athletes’ names, of the information at issue in the main proceedings on the websites of NADA and the ÖADR for a period whose length corresponds to that of the period during which the sanctions in question apply, it should be noted that the sanctions may be imposed for a long period, for a very long period, or for life. Where the athlete concerned is to reach, in the course of the period during which the sanctions in question apply, an age at which he or she will no longer be able to pursue the sports activity in question, a publication period manifestly extending beyond that age would appear, in principle, also to be disproportionate. It is thus for the controller to ensure, in the light of all the circumstances of the case, that the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter entailed by the publication in question is proportionate to the importance of the objective pursued.

107    In the light of the foregoing, the answer to the third and fourth questions is that Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR must be interpreted as not precluding national legislation which imposes on national anti-doping bodies an obligation to publish on the internet personal data concerning all athletes sanctioned for infringing anti-doping rules, such as the names of the athletes concerned, the duration of the ban imposed on them and the reasons for it, with the exception of recreational athletes, particularly vulnerable persons and whistleblowers, provided that that legislation allows controllers, apart from those exceptions and prior to such publication, to carry out an individual balancing exercise weighing up the interests involved in order to ensure that that publication is made in a manner consistent with that regulation.

 The fifth question

108    By its fifth question, the referring court asks, in essence, whether Article 10 of the GDPR must be interpreted as applying to the processing of personal data relating to offences provided for by national anti-doping legislation and to the sanctions imposed for such offences.

109    The referring court explains, in that regard, that the sanctions at issue in the main proceedings include the revocation of titles and the forfeiture of prize money, and a suspension for a number of years or a lifetime ban from participating in any national or international competition. It further states that, pursuant to Paragraph 24(4) of the ADBG, sports organisations may not employ persons subject to a ban under the anti-doping legislation.

110    By that question, the referring court thus seeks to ascertain whether personal data relating to offences provided for by national anti-doping legislation and to the sanctions imposed for such offences constitute personal data ‘relating to criminal convictions and offences or related security measures’, within the meaning of Article 10 of the GDPR.

111    Pursuant to Article 10 of that regulation, processing of that category of data is to be carried out only under the control of official authority, unless it is authorised by EU or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.

112    In that regard, it is to be noted that Article 10 of the GDPR is intended to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data at issue, is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 74 and the case-law cited).

113    In order to determine whether such access amounts to processing of personal data relating to ‘offences’, within the meaning of Article 10 of the GDPR, it is important to point out, first, that that concept refers exclusively to criminal offences and that the enhanced protection provided for by that article is limited to the criminal field alone, as is apparent inter alia from the history of the GDPR, from which it is clear that the EU legislature deliberately did not include the adjective ‘administrative’ in Article 10 of the GDPR (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraphs 77 and 78).

114    Second, the concept of ‘criminal offence’, which is decisive for determining whether Article 10 of the GDPR is applicable to personal data such as those at issue in the main proceedings, requires an autonomous and uniform interpretation throughout the European Union, having regard to the objective pursued by that provision and the context of which it forms part; the classification given by the Member State concerned to the offences in question is not conclusive in that regard as the classification may vary from one Member State to another (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 85 and the case-law cited).

115    Third, it is important to state that anti-doping offences and sanctions are directed only at a particular group of persons, namely athletes, and that, in the same way as disciplinary sanctions, their purpose is to ensure that the members of that group comply with rules of conduct specific to that group.

116    In that regard, it follows from the case-law of the European Court of Human Rights that the fact that a rule penalising a specific offence is directed towards all citizens argues in favour of the criminal nature of the sanction concerned (see, to that effect, ECtHR, 21 February 1984, Öztürk v. Germany, CE:ECHR:1984:0221JUD000854479, § 53). By contrast, in the case of disciplinary procedures before professional bodies in which the right to carry on an occupation is at stake, that Court has previously found that there is no doubt as to the ‘civil’ nature of the rights in question (ECtHR, 2 October 2018, Mutu and Pechstein v. Switzerland, CE:ECHR:2018:1002JUD004057510, § 58).

117    Unlike the case which gave rise to the judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C-439/19, EU:C:2021:504), in which the giving of penalty points on account of the commission of road traffic offences was based on a generally applicable provision, the national legislation at issue in the main proceedings applies to a group of persons covered by a body of specific rules.

118    Furthermore, the purpose of the anti-doping offences and sanctions provided for by that legislation is not only to protect society and punish the relevant person, but also to preserve, inter alia, the integrity of sporting competitions and the reputation of the sports discipline concerned.

119    It follows from that that anti-doping offences such as those at issue in the main proceedings are not covered by the concept of ‘offences’ in Article 10 of the GDPR.

120    In the light of all the foregoing considerations, the answer to the fifth question is that Article 10 of the GDPR must be interpreted as not applying to the processing of personal data relating to offences provided for by national anti-doping legislation and to the sanctions imposed for such offences, since, irrespective of the classification of those offences under national law, those offences and those sanctions are directed only at a particular group of persons, namely athletes, in the same way as disciplinary sanctions whose purpose is to ensure that the members of a group comply with rules of conduct specific to that group.

 The sixth question

121    If the fifth question is answered in the affirmative, the referring court asks, in essence, whether Article 10 of the GDPR must be interpreted as meaning that the decisions of an authority which has been given responsibility for exercising control over the processing of personal data relating to criminal convictions and offences must be subject to judicial review.

122    Given that the fifth question has been answered in the negative, there is no need to answer the sixth question.

 The seventh question

123    By its seventh question, the referring court asks, in essence, whether a complaint lodged with a supervisory authority under Article 77 of the GDPR concerning an alleged infringement of the right to erasure provided for in Article 17 of that regulation is admissible where the processing of the personal data of the data subject has not yet taken place either on the date on which that complaint is lodged or on the date on which that authority gives a decision on that complaint, but there are already specific indications that processing of personal data by the controller is imminent or will take place in the near future. If the answer is in the negative, the referring court raises the question whether the complaint may be admissible subsequently where that processing takes place later in the course of the judicial proceedings.

124    As regards the first sub-question, it must be borne in mind that Article 77(1) of the GDPR provides that every data subject is to have the right to lodge a complaint with a supervisory authority ‘if the data subject considers that the processing of personal data relating to him or her infringes [that] Regulation’. Article 77(2) GDPR specifies the information to be provided by the supervisory authority to the complainant.

125    It is settled case-law of the Court that, in order to interpret a provision of EU law, it is necessary to consider not only its wording, by reference to its usual meaning in everyday language, but also the context in which it occurs and the objectives pursued by the rules of which it is part (judgments of 17 November 1983, Merck, 292/82, EU:C:1983:335, paragraph 12, and of 9 January 2025, Österreichische Datenschutzbehörde (Excessive requests), C-416/23, EU:C:2025:3, paragraph 24).

126    First, the wording of Article 77 of the GDPR does not impose a time limit for lodging a complaint concerning the processing of personal data that is alleged to infringe that regulation or envisage a situation in which the processing of personal data concerned has not yet taken place. As the Advocate General observed in point 186 of his Opinion, that article uses the verb ‘infringes’, which implies that the processing must already have taken place, without, however, excluding the possibility of future processing.

127    Second, as regards the context, reference should be made to the tasks and powers of the supervisory authorities. In particular, under Article 57(1)(f) of the GDPR, each supervisory authority is required on its territory to handle complaints which, in accordance with Article 77(1) of that regulation, any data subject is entitled to lodge where that data subject considers that the processing of his or her personal data infringes the regulation, and is required to examine the nature of that complaint as necessary. The supervisory authority must deal with such a complaint with all due diligence (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C-26/22 and C-64/22, EU:C:2023:958, paragraph 56 and the case-law cited).

128    Moreover, Article 58(1) of the GDPR confers extensive investigative powers on each supervisory authority in order to handle complaints lodged. Where, following its investigation, such an authority finds an infringement of the provisions of that regulation, it is required to react appropriately in order to remedy the shortcoming found. To that end, Article 58(2) of the GDPR lists the various corrective measures that the supervisory authority may adopt, which has a margin of discretion as to the choice of appropriate and necessary means (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C-26/22 and C-64/22, EU:C:2023:958, paragraphs 57 and 68).

129    As one of those corrective measures, the supervisory authority may, under Article 58(2)(a) of the GDPR, issue warnings to a controller that intended processing operations are likely to infringe provisions of the GDPR. That authority therefore has powers of a preventive nature.

130    Thus, the complaints procedure is designed as a mechanism capable of effectively safeguarding the rights and interests of data subjects (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C-26/22 and C-64/22, EU:C:2023:958, paragraph 58).

131    Furthermore, it must be borne in mind that, as regards Article 3(2) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89), the Court held that any data processing attempt may already constitute data processing (see, to that effect, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C-548/21, EU:C:2024:830, paragraphs 69 to 77).

132    It is clear from those factors that the GDPR does not preclude preventive involvement on the part of the supervisory authorities in the context of handling complaints.

133    Third, that interpretation is borne out by the objectives pursued by the GDPR. It is clear in particular from recital 10 thereof that that regulation seeks to ensure a high level of protection of natural persons with regard to the processing of personal data within the European Union. Recital 11 of that regulation states, moreover, that effective protection of such data throughout the European Union requires the strengthening of the rights of data subjects.

134    Restricting the obligation to handle complaints incumbent on supervisory authorities under Article 57(1)(f) of the GDPR, by interpreting Article 77(1) of the GDPR as precluding any possibility of a complaint being lodged with a supervisory authority where the controller is preparing to process data, would be contrary to the objectives pursued by that regulation, in particular the objective of ensuring a high level of protection of natural persons with regard to the processing of personal data within the European Union.

135    Accordingly, a complaint made under Article 77 of the GDPR may be regarded as admissible, despite the fact that the processing of personal data forming the subject matter of that complaint has not yet taken place on the date on which the data subject lodges that complaint with the supervisory authority, provided, however, that that processing is not purely hypothetical.

136    In the case in the main proceedings, the referring court has before it an action against a decision by which a complaint seeking the erasure of the data at issue was rejected for lack of interest in lodging a complaint on the ground that those data had not yet been published. The relevant applicant in the main proceedings, YT, relied in that regard on the fact that a four-year ban had been imposed on her by a decision of the ÖADR and that publication of those data was thus imminent.

137    However, a complaint seeking the erasure of personal data presupposes, in principle, that those data have been processed. It is impossible for the controller to act on such a complaint and erase data if they have not yet been disclosed.

138    Nevertheless, subject to verification by the referring court, it appears that the complaint lodged by YT on the basis of Article 77 of the GDPR was in fact intended to prevent the publication of the personal data in question, and not to have them erased. Thus, that complaint was admissible since, on the date on which it was lodged with the competent supervisory authority, there were already specific indications that the processing of those data was imminent or would take place in the near future. Such a conclusion is all the more compelling since that processing – namely, the publication online of YT’s name as a result of the fact that she was sanctioned for infringing the anti-doping rules as well as the duration of the ban imposed on her – entails, as has been found in paragraph 96 above, a serious interference with the data subject’s fundamental rights to respect for private life and to the protection of personal data.

139    In the light of all the foregoing considerations, the answer to the seventh question is that Article 77 of the GDPR must be interpreted as meaning that a complaint lodged on the basis of that article, seeking to prevent the publication on the internet of personal data relating to the infringement of anti-doping rules, is admissible where, on the date on which that complaint is lodged with the competent supervisory authority, there are specific indications that that publication is imminent or will take place in the near future.

 Costs

140    Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Grand Chamber) hereby rules:

1.      Article 2(2)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with the first sentence of Article 16(2) TFEU,

must be interpreted as meaning that processing of personal data consisting in the publication, pursuant to national anti-doping rules, of the names of athletes sanctioned for infringing those rules, the sports discipline practised by them, the infringement of those rules that has been committed, the sanction imposed on those athletes, and the start and end dates of that sanction, comes within the scope of EU law and, accordingly, within the scope of that regulation.

2.      Article 9 of Regulation 2016/679

must be interpreted as meaning that the information that a certain person has committed a specific infringement of the anti-doping rules and is banned from participating in national and international competitions on account of that infringement is not covered, in principle, by the concept of ‘data concerning health’ within the meaning of Article 9. By contrast, the situation is different where such information makes reference to the name or category of the prohibited substance or method concerned by that infringement and where that reference, combined with other information concerning that person, is capable of revealing, even indirectly, by means of an intellectual operation involving collation or deduction, information relating to the past, current or future physical or mental health status of that person.

3.      Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of Regulation 2016/679

must be interpreted as not precluding national legislation which imposes on national anti-doping bodies an obligation to publish on the internet personal data concerning all athletes sanctioned for infringing anti-doping rules, such as the names of the athletes concerned, the duration of the ban imposed on them and the reasons for it, with the exception of recreational athletes, particularly vulnerable persons and whistleblowers, provided that that legislation allows controllers, apart from those exceptions and prior to such publication, to carry out an individual balancing exercise weighing up the interests involved in order to ensure that that publication is made in a manner consistent with that regulation.

4.      Article 10 of Regulation 2016/679

must be interpreted as not applying to the processing of personal data relating to offences provided for by national anti-doping legislation and to the sanctions imposed for such offences, since, irrespective of the classification of those offences under national law, those offences and those sanctions are directed only at a particular group of persons, namely athletes, in the same way as disciplinary sanctions whose purpose is to ensure that the members of a group comply with rules of conduct specific to that group.

5.      Article 77 of Regulation 2016/679

must be interpreted as meaning that a complaint lodged on the basis of that article, seeking to prevent the publication on the internet of personal data relating to the infringement of anti-doping rules, is admissible where, on the date on which that complaint is lodged with the competent supervisory authority, there are specific indications that that publication is imminent or will take place in the near future.

[Signatures]

*      Language of the case: German.