This content has been translated from the original text.
In this article, the Court of Justice of the European Union (CJEU), with its "NADA Austria" decision dated 14 July 2026, struck a historic balance at the intersection of sports law and data protection (GDPR). Although the Court found the online disclosure of the names and violations of professional athletes who have received doping sanctions to be lawful in principle, it declared the indefinite retention of such publications beyond the duration of the sanction to be contrary to fundamental rights and disproportionate. By requiring anti-doping bodies to carry out a separate balancing of interests for each athlete instead of automatic disclosure, and to limit the duration of publication to the duration of the sanction, this decision also offers a critical point of reference for practices in Türkiye under the KVKK.
The global anti-doping regime, designed so that sport can be conducted at the international level in a fair, equal and ethical manner, by its very nature requires the processing of a great deal of personal data that falls within individuals' private sphere. The decision in C-474/24 NADA Austria and Others, delivered by the Court of Justice of the European Union (CJEU) on 14 July 2026, has redefined the delicate balance between this necessity and the protection of fundamental rights. At the heart of the decision lies the question whether the public disclosure online of the names, sanctions and prohibited substances of athletes who have been definitively found to have committed a doping violation is lawful under the European Union's General Data Protection Regulation (GDPR). It must be stressed that the present decision, which is the subject of this study, was handed down not by the European Court of Human Rights (ECtHR) but by the Court of Justice of the European Union (CJEU); these two bodies are based on entirely different legal regimes.
Deciding on the request for a preliminary ruling referred by the Austrian Federal Administrative Court, the Court of Justice confirmed that the fight against doping is an objective that serves the general public interest and whose legitimacy is beyond dispute. At the same time, having regard to individuals' right not to be stigmatised and to the confidentiality of private life, the Court pointed out that disclosure practices cannot be absolute and unlimited. This case law has the potential to directly transform not only the parties to the case but also the existing data processing and public information practices of all national anti-doping agencies that are subject to the World Anti-Doping Code (WADC).
At the root of the dispute lies the legal struggle of four athletes who were banned from competition, for a fixed period or for life, by the Austrian Anti-Doping Legal Committee (ÖADR) and the Austrian Independent Arbitration Commission (USK) on the ground that they had violated the anti-doping rules. Under Austrian national legislation, the publication of final ban decisions on the website of the Austrian Anti-Doping Agency (NADA Austria) is a legal obligation. The sanctioned professional athletes applied to NADA Austria and the ÖADR respectively in order to stop this disclosure and, when their requests were rejected, brought the dispute before the courts. The athletes' principal claim was that the information published on the websites constituted special categories of personal data under the GDPR and that the existing system pursued a blanket disclosure policy without carrying out an individualised analysis, which in turn violated the principle of proportionality. Examining the procedural history of the case, it can be seen that in May 2024 the Court had rejected a similar request for a preliminary ruling (C-115/22) made by the arbitral body USK, on the ground that the USK did not qualify as an independent and impartial court. This time, because the request was referred by the Federal Administrative Court, which is a judicial body, the Court of Justice was able to rule on the merits of the case.
In its examination of the request for a preliminary ruling, the Court of Justice of the European Union first held that the general sanction and identity information published on the website does not, as a rule, directly fall within the concept of "health data". However, the Court laid down an important exception: where the name of the specific prohibited substance is stated in the disclosure text, and where this information, when combined with other public data, contains a clue as to the physical or mental health condition of the athlete concerned, that data will be regarded as special-category health data and will be subject to the strict protective shield. Secondly, the Court of Justice decided that the disciplinary sanctions and bans imposed as a result of violations of the anti-doping rules do not constitute a technical "criminal conviction" within the meaning of the GDPR. According to the Court's reasoning, these sanctions are private disciplinary sanctions aimed at ensuring the internal functioning, ethical rules and intra-group discipline of the community of athletes.
In the third and weightiest finding, it was emphasised that the GDPR does not, in principle, preclude the online announcement of the names of professional athletes who violate the anti-doping rules, the duration of their bans and the main grounds of the decision. The CJEU declared that the protection of the fairness of competitive sport, the safeguarding of public health and the promotion of sporting ethics are all legitimate objectives. However, the most decisive legal outcome of the decision is the obligation of the competent authorities carrying out the disclosure to conduct, before publication, an individual balancing of interests that takes account of the particular features of each specific case. This balancing is manifested in particular on the point of the temporal proportionality of the disclosure. The Court of Justice expressly held that keeping the data online indefinitely or for the long term, without removing it, beyond the actual duration of the ban imposed on the athlete is a disproportionate interference with the individual's private life and right to the protection of personal data. Once the sanction has ended, the data must be removed from public access digitally.
In conclusion, the C-474/24 NADA Austria decision has placed the chronic tension between the WADA Code and European Union data protection law on a rational footing. Instead of a blanket ban on publication or an unsupervised freedom of disclosure, the decision has made mandatory a time-limited and individualised model in which each case is weighed on its own circumstances. While this ensures that deterrence is preserved through the punishment of doping, it prevents the person who has served his or her sanction and wishes to start with a clean slate from being socially stigmatised indefinitely. For bodies subject to the WADA Code, such as the Anti-Doping Commission of Türkiye (TDMK), and for those applying the Personal Data Protection Law No. 6698 (KVKK), the parameters of this proportionality test, the time limit and the right not to be stigmatised now constitute a universal and fundamental international point of reference.
