GDPR and anti-doping in Ireland: the legal risks of naming offenders

Disclosing the identity of athletes found guilty of doping sits at the intersection of integrity in sport and EU data protection laws. A recent Advocate General opinion from the Court of Justice of the European Union raises fresh questions about whether current anti-doping disclosure rules, including in Ireland, go too far.

While anti-doping organisations such as World Anti-Doping Agency (WADA) require the public identification of sanctioned athletes in order to uphold the overall integrity of sport, the Court of Justice of the European Union (CJEU) has considered whether disclosing names, health data and sanctions is necessary and proportionate to that purpose.

In this article, our sports law and dispute resolution experts break down the key legal issues and assess what the latest CJEU developments mean for anti-doping bodies navigating GDPR compliance.

Anti-doping disclosure rules in Ireland explained

Article 14.3 of the World Anti-Doping Code (WADC) requires all anti-doping organisations to publish, within 20 days of a final decision, the name of any athlete found to have committed a doping violation, together with the sport concerned, the substance or method involved and the sanction imposed.

Sport Ireland is the National Anti-Doping Organizations (NADO) in Ireland as reflected in section 42 of the Sport Ireland Act 2015. In applying Article 14.3 of the WADC, Article 15.4 of the Irish Anti-Doping Rules require Sport Ireland to publish information about the decision including:

·         the sport

·         the anti-doping rule violation

·         the name of the athlete who committed the violation

·         the prohibited substance or prohibited method involved

·         the sanction imposed

These provisions aim to deter future violations and promote integrity through transparency.

However, the Irish Anti-Doping Rules note that where public disclosure of the athlete's name, for example, would result in a breach of other applicable laws, Sport Ireland’s failure to make public disclosure will not result in a determination of non-compliance with WADC. This is where a conflict between the objectives of anti-doping organisations and privacy and personal data protection rights for EU citizens may arise.

The CJEU case: challenging mandatory publication of athlete data

In Case C 474/24, four athletes sanctioned for doping challenged Austrian legislation that mandates the online publication of their personal data , including names, sport, disciplinary information, length of suspension and reason for sanction. The athletes brought their case to the CJEU.

The Advocate General (AG) provided an opinion to the judges of the CJEU in advance of the CJEU hearing the matter and giving judgment. Although an AG's opinion is not binding, it is often followed by the CJEU.

In September 2023, Advocate General Ćapeta gave an opinion that suggested that the publication of anti-doping decisions fell outside GDPR altogether. Read our previous article here: Austrian anti-doping committee GDPR compliant for publishing decision

However, when the case reached the judges at the CJEU, it was found as a preliminary point that the Austrian Independent Arbitration tribunal (USK) was not an independent court or tribunal capable of making a referral under Article 267 Treaty of the Functioning of the European Union (TFEU). Therefore, the issue was not actually considered by the CJEU until Spring 2026 . See our previous article here: Austrian Anti-Doping Arbitration Committee lacks entitlement to refer questions to the ECJ

AG opinion: why mass publication may breach GDPR

Advocate General Spielmann stated that systematic publication of such data may contradict GDPR principles, particularly those of proportionality and data minimisation. The publication of personal data could infringe data protection rights as it may result in the publication of sensitive health data or data relating to criminal convictions. The AG suggested that transparency and deterrence objectives could be met through publication of "pseudonymised data" and targeted disclosures to relevant bodies only. The Austrian court must decide whether the national law aligns with GDPR standards.

Health data concerns in anti-doping enforcement

AG Spielmann highlighted the CJEU’s broad interpretation of health data (as established in Case C-184 / 20) and determined that it is sufficient that data can indirectly reveal information about a person’s health status, for example, through collation or deduction. Health data, according to the AG, includes:

      i.        data created in a medical context, including administrative data in medical records

     ii.        raw data from personal measurements, such as height and blood pressure, that allows inferences about health

    iii.        membership in health-related groups, including weight-loss or addiction support groups, referring to Article 29 Working Party’s guidelines

Therefore, the publication of data could constitute processing of health data under the GDPR, depending on whether a link exists to the health status of the athlete.

GDPR principles: legal basis and proportionality in focus

Any data processing must be based on an appropriate legal basis under Article 6 (1) GDPR.

The Austrian Anti-Doping Law requires NADA to provide certain institutions and athletes with information such as suspensions and bans, including the name of the athlete, duration and reasons, free of charge. This is done without inferences about special categories of personal data. The OADR is responsible for disciplinary proceedings under the WADC.

AG Spielmann considered the "necessity" of publishing this information. He said that publishing the substance or athlete’s name is not necessary for public deterrence and that publication of the name is only necessary to prevent circumvention of suspensions - where it should be limited in both scope and duration. Proportionality requires balancing interference with private life against the aims of anti-doping rules, with particular reference to scope and duration of publication.

Should these conditions not be satisfied, national anti-doping bodies may not publish athletes’ personal data, even if national law so requires.

Key takeaways

AG Spielmann’s opinion offers important guidance regarding the classification of athletes’ personal data as health or criminal data, the application of proportionality in data publication, and the limits of lawful data processing within the wider context of sport.

If the CJEU follows AG Spielmann and WADA, NADO's such as Sport Ireland will be forced to revisit their rules around disclosure of athlete names for anti-doping violations.  

How Ogier can help

Ogier in Ireland's sports law and dispute resolution specialists support clients across the sports sector on anti-doping compliance, athlete data protection and regulatory disputes. From advising on GDPR risks in disclosure practices to representing clients in contentious proceedings, our team offers practical, expert-led solutions. For tailored advice on anti-doping rules or data protection obligations, contact our team today.

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice