CJEU: online publication of athletes sanctioned for doping may be permissible under GDPR

The court also determined that articles 5 and 6 of the GDPR do not preclude publishing the names of professional athletes who have infringed anti-doping rules, the duration of the ban imposed on them and the reasons for that ban from being published on the internet. However, it added that the regulation does provide a carve-out for whistleblowers and particularly vulnerable people, provided the relevant bodies could carry out an “individual balancing exercise weighing up the interests involved” prior to publication.

The CJEU held that article 77 of the GDPR provides that data subjects have the right to lodge a complaint with a supervisory authority and there is no time limit imposed on when they can lodge a complaint. It therefore ruled that a complaint can be raised where “there are specific indications that that publication is imminent or will take place in the near future.”

The judgment does not provide a binding judicial opinion on this specific case, but it does provide clarity on how courts across EU member states should interpret these issues in relation to EU law. This case will now be referred back to the Austrian courts to decide whether to uphold the CJEU’s view or dismiss the athletes’ legal challenge.

Jonathan Kirsop, a data protection and technology specialist at Pinsent Masons, said the CJEU’s decision would help provide a level playing field across Europe for both national sporting bodies and anti-doping organisations (NADOs) to uphold the integrity of sport. “This judgment is a welcome departure from the more proscriptive advocate general opinion and provides support for the disclosure of athletes’ names for doping offences, even on a ‘naming and shaming’ basis,” he said. “With ever greater rewards in professional sport, it is important for sporting bodies to be able to promote fair competition in sport and deter athletes from taking performance-enhancing substances. By recognising that such disclosures can be necessary and proportionate to these ends and comply with GDPR if certain criteria are met, the court has provided an important boost to authorities tackling doping in their sport.”

The CJEU decision departs from the advocate general’s opinion published in September 2025, which favoured the publication of pseudonymised data. Kirsop said such an approach risked triggering speculation and associated anxiety for clean athletes “where their own characteristics or circumstances correspond to the pseudonymised indicators”, he said. “By recognising transparent and named information can be provided if necessary and proportionate, this is an important judgment for all clean athletes and those who follow sport.”

Kirsop said the judgment also provides an important clarification of the definition of ‘offence’ for the purposes of article 10 of the GDPR. “It found that anti-doping offences are not equivalent to criminal offences – regardless of status at national law – on the basis that those offences and those sanctions are directed only at a particular group of persons, namely athletes, with rules of conduct specific to that group.”

Commenting on the decision, Trevor Watkins, sports law specialist at Pinsent Masons, added: “It is fundamental to the integrity of sport to ensure that there is a clear record of any breach of the rules – it underpins the rule of law within sport."

Watkins added that the judgment would be significant for a variety of stakeholders across the sporting world. “Governing bodies and tournament organisers, both at national and international level, also need to be able to have data to understand if an athlete is entitled to compete or not. Sponsors will also want to ensure they are aware of such issues too. It is also a question of what rights are assumed to be a priority above others.”