Clean Sport, Clouded Rights?

The Opinion of Advocate General (“AG”) Dean Spielmann in NADA Austria (C-474/24) has sent some shockwaves in the sporting industry. It is the result of a clash between the World Anti-Doping Code (“WADC”), which is the central instrument of the World Anti-Doping Agency (“WADA”), and the General Data Protection Regulation (“GDPR”), the bedrock of the European Union’s (“EU”) data-rights framework. At issue is the legality of Article 14.3 of the WADC, which requires all anti-doping organisations to publish, within twenty days of a final decision, the name of any athlete found to have committed a doping violation, as well as the sport concerned, the substance or method involved, and the sanction imposed. The rule is intended to deter future violations and promote integrity through transparency. Yet, when implemented by national bodies operating within the EU, this requirement engages the privacy and data-protection guarantees of Articles 7 and 8 of the Charter of Fundamental Rights of the EU.

In Austria, Article 14.3 WADC is transposed through the Anti-Doping-Bundesgesetz 2021 (“ADBG”). Articles 5(6)(4), 21(3), and 23(14) oblige the Nationale Anti-Doping Agentur Austria GmbH (“NADA Austria”) and the Österreichische Anti-Doping Rechtskommission (“ÖADR”) to publish the details of sanctions online, subject only to narrow exceptions for minors, recreational athletes, and whistle-blowers. This obligation has been justified on deterrence and transparency grounds.

In (C-474/24), four athletes challenged the provision, claiming that the automatic publication of their details violated the GDPR by disclosing sensitive information without individualised assessment, time limits, or effective remedies. The Austrian Data Protection Authority dismissed their complaint, finding that publication was lawful under Article 6(1)(c) GDPR as processing “necessary for compliance with a legal obligation.” On appeal, the Bundesverwaltungsgericht referred seven questions to the Court of Justice concerning the compatibility of such publication with the GDPR’s principles of lawfulness, minimisation, and proportionality.

AG Spielmann’s Opinion, delivered on 25 September 2025, considered whether blanket, indefinite publication of athletes’ data, as mandated by the ADBG and derived from Article 14.3 WADC, complies with the principles of necessity and proportionality under Articles 5 and 6 GDPR, and whether such publication can ever be justified without a case-by-case balancing of interests. His analysis thus situates anti-doping transparency within the constitutional grammar of EU fundamental rights, questioning whether global regulatory uniformity can survive the EU’s rights-based legal order.

This post analyses that Opinion. To this extent, it outlines the seven preliminary questions and the AG’s reasoning in response to them. It then attempts to evaluate the correctness of that reasoning, testing its doctrinal coherence against the structure of EU law and the nature of the WADA system. Next, it considers its feasibility and implications for the operation of anti-doping regimes within the EU. It concludes by assessing whether the AG’s approach offers a viable model for reconciling the GDPR’s rights-sensitive proportionality with the WADC’s demand for transparency and deterrence.

The Reference and the AG’s Reasoning

The NADA Austria reference invited the Court of Justice to clarify how far the GDPR constrains the operation of the WADC when implemented through national law. The national court sought guidance on whether this regime complies with the GDPR’s rules on lawful and proportionate data processing.

The first question concerned the scope of EU law. The referring court asked whether the GDPR applies where national bodies implement obligations arising from an international regulatory code (paras 32-33). The AG concluded that it does. Although the WADC is an international instrument, NADA Austria and the ÖADR are statutory entities exercising public powers within a Member State. Their processing of personal data therefore falls within Article 2(1) GDPR and must comply with its substantive guarantees. The AG further stressed that a Member State cannot avoid EU fundamental-rights obligations by attributing regulatory action to an international framework once that framework has been internalised into domestic law (paras 42-60).

The second and fifth questions dealt with the classification of the data disclosed. The AG considered that publication of an athlete’s name alongside the prohibited substance or method used amounts to processing of “special categories of personal data” under Article 9(1), as such information reveals health-related or physiological characteristics (paras 72-80). He further observed that disclosure of a rule violation and suspension has a punitive dimension akin to a criminal record, bringing Article 10 GDPR (data relating to criminal convictions and offences) into play (paras 86-124).

The next questions concerned lawfulness and proportionality. The ADBG obliges the relevant authorities to publish the information automatically and without temporal limitation. The AG accepted that the objectives of deterrence and transparency are legitimate, but questioned whether automatic, indefinite online publication was necessary to achieve them (paras 149-160). Disclosure of personal data to the general public requires a specific justification that takes account of the individual circumstances. In his view, the Austrian legislation and, by extension, Article 14.3 WADC failed to incorporate such a safeguard. Less intrusive methods could achieve the stated aims with less impact on privacy.

On that basis, the AG proposed a case-by-case proportionality requirement. Before publishing disciplinary decisions, bodies such as NADA Austria should evaluate whether publication is strictly necessary in each instance, considering the seriousness of the violation, the substance involved, and the deterrent value of disclosure. He treated this assessment as a procedural obligation inherent in Articles 5 and 6 GDPR, rather than as a matter left entirely to national legislatures (paras 170-180).

The AG also addressed the procedural guarantees surrounding such processing. Under Austrian law, decisions of the Independent Arbitration Committee (Unabhängige Schiedskommission) are not reviewable by ordinary courts. He considered that this lack of judicial oversight conflicts with Articles 47 of the Charter and 79 GDPR, which guarantee an effective remedy against unlawful processing. Finally, he interpreted Article 77 GDPR as allowing preventive complaints: individuals may contest an intended publication before it occurs, provided that the interference with their data rights is imminent and not hypothetical (paras 181-189, 206-210).

Evaluating the Correctness of the Opinion

The AG’s Opinion extends the proportionality framework of EU data protection law into a regulatory domain – international sport – that depends on collective enforcement and uniform publicity. The core question is whether this transposition remains faithful to the internal logic of EU law or overextends the Regulation into an area where administrative pragmatism and international harmonisation demand a different balance.

First, the interpretation of proportionality arguably exceeds what the GDPR requires. Articles 6(1)(c) and 6(3) provide that processing necessary for compliance with a legal obligation must be proportionate and accompanied by safeguards, but these provisions do not envisage a bespoke balancing exercise for every instance of processing. This would effectively convert a legislative proportionality assessment, normally undertaken by the Member State when enacting the legal obligation, into a continuous administrative duty at controller level. In turn, it would transform the principle of proportionality from a systemic standard into an operational audit, requiring each national anti-doping organisation (“NADO”) to perform its own balancing of deterrence and privacy. The result would be legal uncertainty and potential fragmentation across Member States, undermining the uniformity that the WADC’s global enforcement architecture is designed to achieve. A rule-based system whose legitimacy depends on even-handed application cannot function through discretionary micro-assessment.

Secondly, in what regards the publication of sanctions, Volker und Markus Schecke GbR (C-92/09) offers interesting insight. Volker concerned fiscal transparency in the administration of agricultural subsidies, which is a classic instance of discretionary state action affecting private individuals. By contrast, anti-doping regulation is not a welfare measure but a rule-based integrity regime founded on standardisation. The uniform publication of sanctions is intrinsic to its operation. It allows sponsors, teams, and federations to verify eligibility without jurisdictional ambiguity. Requiring case-specific balancing before publication risks diluting deterrence and disrupting the shared information infrastructure on which international sport depends. Thus, in this setting, general publication is not an excess of discretion; it is the mechanism of enforcement itself.

Thirdly, the classification of doping data as “data relating to criminal offences” under Article 10 GDPR stretches the concept beyond its textual and contextual limits. While the stigma associated with a doping sanction is significant, such sanctions remain disciplinary and contractual in nature. Athletes voluntarily submit to anti-doping jurisdiction as a condition of participation; the process is administrative, not penal. Equating it with criminal conviction risks blurring the line between public law enforcement and private regulation. Article 10 is meant to govern the handling of criminal records and law-enforcement data; extending it to disciplinary outcomes would unsettle professional regulatory systems more broadly, from medicine to financial services, that rely on transparency to preserve public confidence.

I believe a further difficulty lies in the balance between individual and collective interests. The AG’s analysis privileges data protection as an almost absolute right, with limited room for legitimate public objectives. Yet Article 52(1) of the Charter expressly permits limitations on rights when these are necessary and genuinely meet objectives of general interest recognised by the EU. The prevention of doping and the maintenance of integrity in sport have long been accepted as such objectives, most notably in Meca-Medina (C-519/04 P) and in the Council of Europe’s Anti-Doping Convention. The AG acknowledges these aims but accords them secondary weight, applying a rights-maximising model that offers little scope for collective regulation. A more balanced reading of the Charter would treat data protection and transparency as co-equal principles subject to structured reconciliation, not a zero-sum hierarchy.

Finally, there is a question of institutional competence and comity. The WADC is an international instrument, not an act of EU law, and the EU’s competence in sport under Article 165 TFEU is limited to coordination and support. By requiring granular, individualised proportionality for the implementation of a globally uniform code, the AG risks exporting the GDPR’s internal regulatory logic into a sphere of governance that the EU does not control. While EU law undoubtedly applies when Member States act within its scope, its interpretation must remain sensitive to the boundaries of that jurisdiction. A proportionality standard that operates as a de facto veto on the operation of international instruments risks creating normative friction rather than coherence between EU law and global sport.

The Opinion’s principal strength lies in its refusal to allow collective objectives to eclipse fundamental rights by default. It rightly reminds regulators that deterrence cannot justify permanent, indiscriminate publication of sensitive data. Yet its weakness is one of calibration: it treats privacy and transparency as competing absolutes rather than as principles that can coexist through temporal and procedural moderation. A more context-sensitive approach would recognise that the GDPR allows certain categorical disclosures where they are necessary to uphold regulatory integrity, provided that their scope and duration are defined by law and subject to periodic review. The AG’s reasoning does not exclude that possibility, but its trajectory points towards judicial micromanagement of global regulatory practice, an outcome that would strain both legal coherence and administrative reality. The Court may therefore find the AG’s conclusions instructive but too doctrinally expansive to adopt in full.

Feasibility Issues

Even if one accepts the internal coherence of the AG’s reasoning, its practical implications for the administration of global anti-doping control are far from straightforward. The proposed proportionality model requiring case-by-case balancing and demonstrable necessity for every instance of publication would impose administrative, structural, and legal burdens that the current system is ill-equipped to absorb.

At the operational level, NADOs are not designed to conduct continuous proportionality assessments. Their procedures are largely automated and standardised, reflecting the WADC’s commitment to uniformity and speed. Introducing an obligation to perform an individualised balancing test before each disclosure would require new decision-making layers, legal expertise in data protection, and documentation sufficient to withstand judicial review. Smaller NADOs, operating on limited budgets, could struggle to meet these requirements without diverting resources from testing, education, or investigation. In practice, the result could be inconsistent application and delayed publication, thereby weakening both deterrence and the coordination of eligibility information across borders.

A related problem concerns fragmentation of regulatory practice. The WADC’s effectiveness rests on horizontal trust: a suspension imposed in one jurisdiction must be recognised in all others. If each Member State were to apply a distinct proportionality analysis when deciding whether to publish or how long to retain disciplinary data, the transparency of the system would become uneven. Some NADOs might favour broad disclosure; others might restrict or anonymise. Such divergence would undermine mutual recognition and complicate the verification of athlete status at international competitions.

There are also of course legal feasibility issues. The AG’s proposed model presupposes that data controllers can reliably weigh privacy harms against deterrence benefits for which no established metrics exist. The GDPR’s proportionality test is inherently qualitative so translating it into operational guidance for anti-doping authorities would require detailed secondary legislation or interpretive guidelines, yet the EU lacks competence to legislate in the field of sport governance. Member States could attempt to codify balancing criteria domestically, but that would further entrench asymmetry across the EU and between EU and non-EU signatories of the WADC.

From a governance perspective, the AG’s approach could produce regulatory friction with WADA itself. The WADC relies on mandatory disclosure to ensure transparency and to facilitate sanction recognition worldwide. If EU NADOs were to condition publication on proportionality assessments or to limit online accessibility, WADA could deem them non-compliant with the WADC, exposing them to institutional sanctions. The EU’s insistence on data protection orthodoxy might thus isolate its Member States within the global anti-doping network, threatening their ability to host events or participate fully in mutual testing programmes. The principle of proportionality would, paradoxically, yield practical disproportionality: a well-intentioned protection of rights that destabilises the system meant to uphold integrity.

That said, the Opinion does open space for constructive reform. The insistence on procedural safeguards could be implemented through standardised impact assessments rather than ad hoc balancing. A uniform data protection impact assessment model developed jointly by the European Data Protection Board ‘(EDPB’) and WADA could ensure that publication policies are reviewed for proportionality at system level, not on a case-by-case basis. Similarly, tiered access (restricted databases for sporting stakeholders not just federations and summarised public notices without specific details not necessary) could meet the concerns without dismantling the WADC’s transparency regime. These measures would operationalise proportionality as design rather than discretion.

Conclusion

The Court will need to navigate between these poles. To accept the AG’s reasoning in full would risk overconstitutionalising sport governance, entangling NADOs in endless balancing exercises and fragmenting a system that depends on predictability. To reject it entirely would signal that international harmonisation can override fundamental rights within the EU’s jurisdiction. The more sustainable path involves a contextual proportionality that recognises the legitimacy of anti-doping objectives while requiring that disclosure be limited in duration, scope, and audience. The broader lesson may therefore extend beyond sport. It illustrates that the effectiveness of global regulatory systems increasingly depends on their capacity to internalise rights-sensitive design and thus achieving not a victory of privacy over transparency, but their principled coexistence within a shared legal order. The challenge for the Court, and for policymakers, is to craft an outcome that preserves both the integrity of sport and the integrity of rights.