Finnish DPA examines anti-doping organization's GDPR compliance over public suspension

Decision of the Deputy Data Protection Commissioner Joined Cases Background of the Case The Data Subject’s Claims and Supporting Arguments The Data Controller’s Statement, November 18, 2024 Response from the data subject on January 31, 2025 Response from the data controller on March 11, 2025 Response from the data subject on May 5, 2025 Additional statement by the data controller on July 15, 2025 Statement by the data controller on February 2, 2026 Response by the data subject on March 20, 2026 Applicable Legislation Legal Issue Decision and Rationale of the Deputy Data Protection Ombudsman Rationale Appeal Notification Further Information on the Decision Publication of Personal Data in Anti-Doping Activities Keywords Legal basis for processing personal data, Anti-doping activities Year of the case 2026 Date of issuance August 4, 2026 Reference number TSV/179/2021 Legal basis Decision pursuant to the EU General Data Protection Regulation Decision of the Deputy Data Protection Ombudsman Subject Legal Basis for the Processing of Personal Data and the Requirement of Proportionality in Anti-Doping Activities Data Controller Finnish Center for Sports Ethics SUEK ry (hereinafter “SUEK ry” or “the data controller”) Joined cases The Office of the Data Protection Ombudsman has received two complaints regarding the processing of personal data on the anti-doping sanctions list maintained by the data controller. The first general report of a concern was received on December 10, 2020 (TSV/103/2020). Case TSV/103/2020 does not concern the rights, interests, or obligations of the person who initiated the case. The petitioner in case TSV/103/2020 therefore does not have the status of a party to the proceedings pursuant to Section 11 of the Administrative Procedure Act (434/2003). Case TSV/179/2021 was initiated on May 17, 2021. The case concerns the publication of an individual’s data on a public list of persons subject to a ban on participation in sports. The cases will be decided jointly in accordance with Section 25 of the Administrative Procedure Act. Background of the Case According to the complaint, the Anti-Doping Disciplinary Committee operating under SUEK ry (hereinafter “the Disciplinary Committee”) issued a decision on January 29, 2021, finding the registered individual guilty of a doping violation. According to the Disciplinary Committee’s decision, a prohibited substance was found in a sample taken from the registered athlete on August 5, 2020. In its decision, the Disciplinary Committee found that the registered athlete had demonstrated a probable cause that the prohibited substance had entered the athlete’s system unintentionally through a contaminated dietary supplement. The Disciplinary Committee assessed the registered athlete’s conduct as slightly negligent. The registered athlete was under a voluntary suspension from October 13, 2020, to January 29, 2021. The Disciplinary Board considered that the voluntary suspension of operations during that period was a sufficient sanction for the violation in question. The suspension ended on the date the decision was issued (January 29, 2021). The Disciplinary Committee disqualified the registered athlete from the competitions held on the test date (August 5, 2020). The Disciplinary Committee found that the concentration of the prohibited substance had been so low that the prohibited substance was unlikely to have contributed to the registered athlete’s performance during the period (August 5, 2020) and the start of the voluntary suspension (October 13, 2020), and therefore the competition results from that period were not disqualified. The registered athlete submitted a statement on the matter to the Disciplinary Committee, in which the registered athlete requested that information regarding the suspension not be published on the suspension list. The Disciplinary Committee’s decision states that publishing the decision is not part of its assigned duties, and it has no authority to issue directives regarding how SUEK ry must publish its decisions. SUEK ry published information regarding the data subject’s suspension on the suspension list on its website for a period of one month, beginning on January 29, 2021. SUEK ry also published a press release regarding the suspension on its website, which was sent to the media for information. Following the Disciplinary Committee’s decision, SUEK ry launched an investigation into whether the registrant had violated the voluntary suspension. SUEK ry published information about the ongoing investigation on its website on March 2, 2021. In its ruling issued on June 3, 2021, the Disciplinary Committee found that the registered individual had violated the suspension by participating in training sessions during the suspension period in the fall of 2020, during which one of the individuals acting as a coach was employed by the Tampere Sports Academy. The Disciplinary Committee found that the registered athlete’s violation of the suspension was of minor severity, as it resulted from ambiguity in the instructions given to him and in the wording of the Finnish Anti-Doping Code. The minor nature of the original doping violation was also taken into account in this case. The case concerns the publication of personal data related to the registered person’s suspension on a public suspension list maintained by the data controller, as well as the publication of personal data related to an ongoing investigation concerning the data subject on the data controller’s website. The data subject’s claims and their justifications The complainant contacted the Office of the Data Protection Ombudsman on May 18, 2021, on behalf of the data subject regarding the processing of the data subject’s personal data by SUEK ry. The complainant submitted to the Office of the Data Protection Ombudsman on December 13, 2021, a power of attorney prepared by the data subject on December 9, 2021. In a statement submitted to the Disciplinary Committee on January 8, 2021, the data subject requested that the decision in question not be published as required by WADA’s World Anti-Doping Code (hereinafter “WADC” or “World Anti-Doping Code”). The registered person has argued, among other things, that the publication of a minor substance finding—which was beyond his control—would result in unreasonable consequences for him due to both media exposure and loss of income, as well as to the fact that he had not participated in major international competitions at the senior level nor received an athlete grant from the Olympic Committee. According to the data subject, there was therefore no need to publish the decision from the perspective of the public interest. In a complaint sent to the Office of the Data Protection Ombudsman, the data subject also argued that the sanction (temporary suspension) had already expired, which is why the data subject considered its subsequent publication to be a violation of his right to privacy. The data subject has argued that the publication of the information would result in disproportionate consequences for him relative to the severity of the doping violation. According to the data subject, the data controller did not take his request or the grounds he presented into account when assessing the publication of the decision. The data subject also stated that he had objected to the publication of information regarding the investigation into the violation of the ban both during and after the investigation. Statement by the Data Controller on November 18, 2024 On November 18, 2024, the data controller submitted statements regarding cases TSV/103/2020 and TSV/179/2021. The data controller’s statement provides background information on anti-doping activities and the relevant regulations. According to the data controller, its activities are governed by the UNESCO Anti-Doping Convention and the Council of Europe Anti-Doping Convention, both of which have been ratified by the Finnish Parliament. The report states that, through the UNESCO Convention, the Finnish government has committed to the World Anti-Doping Agency (WADA) and to ensuring that Finland complies with the World Anti-Doping Code adopted by WADA. Based on the explanation provided by the data controller, the data controller processes athletes’ personal data in the context of anti-doping activities in the public interestpursuant to Article 6(1)(e) of the General Data Protection Regulation. Based on the explanation provided by the data controller, SUEK ry has been tasked with implementing the requirements of international anti-doping agreements, to which the Finnish government has committed itself by ratifying these agreements. According to the data controller, SUEK ry could be considered, by analogy, to be a public authority, as this is also the case, for example, under procurement legislation. According to the controller’s report, athletes’ personal data is processed not only in the public interest but also based on the athlete’s consent and a contractual or membership relationship. In this regard, the data controller has pointed out that every athlete subject to the World Anti-Doping Code has committed to the World Anti-Doping Code in its entirety, either through consent or a contract. According to the data controller, in this case, the World Anti-Doping Code required that the suspension be published for one month, even though it had already expired. According to Article 14.3.5 of the World Anti-Doping Code “public disclosure shall be carried out by, at a minimum, publishing the required information on the SUEK website and keeping the information available for one month or for the duration of any sports suspension, whichever whichever of these periods is longer.” According to the data controller, they do not publish suspensions of minors, protected persons, or recreational athletes on the public suspension list, as this is not mandatory under Article 14.3.7 of the World Anti-Doping Code. According to the registry administrator’s explanation, prior to publication, a check is performed to ensure that the individual does not belong to any of the categories of persons specified in Article 14.3.7 of the World Anti-Doping Code. According to the data controller, decision-making regarding the publication of suspensions primarily takes into account the athlete’s level, the severity of the sanction, and the level of disclosure, as well as any prior publicity on a case-by-case basis. Athletes are classified into three different levels, which also determine the practices for publishing and communicating the decision regarding the suspension. The data subject was classified at the highest level, Level 1, on the basis of which information regarding the suspension was published on the data controller’s website in the list of suspensions and in a press release that was also sent directly to the media. The data controller has noted that the data subject was an international-level athlete at the time. According to the report, the publication of information regarding an ongoing investigation was highly exceptional. According to the data controller, the decision to publish the information was based on an assessment of the circumstances, as there was significant media attention surrounding the issue, and the data subject would also benefit from the publication of the information. In the data controller’s view, the mere fact of a suspension and the presence of a prohibited substance does not constitute sensitive personal data. The data controller has stated that, pursuant to Section 6 of the Data Protection Act, Article 9(1) of the General Data ProtectionRegulation does not apply to the processing of health and genetic data in anti-doping work and in the context of para sports to the extent that the processing of such data is necessary to enable anti-doping work or sports for people with disabilities and those with chronic illnesses. In the data controller’s view, the General Data Protection Regulation should not apply to its activities. Response from the Data Subject on January 31, 2025 The data subject submitted a response on January 31, 2025. In their response, the data subject emphasized that at the time of the disciplinary proceedings in question, they were not an international-level athlete according to SUEK ry’s classification. In the data subject’s view, information regarding the suspension and the prohibited substance detected constitutes data describing the individual’s state of health. According to the data subject, the substance detected in his case can cause heart problems. The data subject has also stated that the logic behind the anti-doping system is based on the premise that prohibited substances affect an athlete’s performance—and, consequently, the athlete’s health. In his response, the registered individual has emphasized that his violation involved a minor penalty and a situation in which the prohibited substance had entered his system due to impurities in a dietary supplement, without the registered person having any control over the matter. In the data subject’s view, the need for publication should be assessed on a case-by-case basis. According to the data subject, the publication of the information had unreasonable consequences for him. The data subject argued that SUEK ry could not be considered a public authority solely on the basis of an analogical interpretation of procurement legislation. The data subject has emphasized that the controller should be able to demonstrate the legal basis for processing personal data in each specific situation. In their response, the data subject requested that the comment submitted by the author of the TSV/103/2020 report—which was submitted to the Office of the Data Protection Ombudsman on December 17, 2024—be taken into account. The comment states that SUEK ry should not be interpreted as a public authority. The comment emphasized that SUEK ry’s own website also characterizes the organization as a private-law, non-profit association. The comment emphasized that the exercise of public authority should be based on legislation enacted by Parliament. According to the comment, international agreements related to anti-doping activities are intergovernmental agreements that are not laws enacted by Parliament and therefore not in force as laws in Finland. The comment states that data protection legislation should apply in this matter. The comment points out that the World Anti-Doping Code (WADC) includes a note stating that the publication of a sanction is not mandatory if it conflicts with the EU Data ProtectionRegulation or other nationally applicable data protection legislation

Data Controller’s Response, March 11, 2025 The data controller responded to the data subject’s reply on March 11, 2025. In its response, the data controller reiterated its view that data protection regulations do not apply to anti-doping activities. The data controller emphasized that the Finnish government has tasked SUEK ry with implementing international treaties related to anti-doping. In the data controller’s view, the list of suspended athletes does not disclose athletes’ health information. The data controller states that personal data is processed on the basis of public interest, citing the requirements of international anti-doping agreements. The data controller has stated that personal data is processed secondarily on the basis of the agreement, since athletes commit to the World Anti-Doping Code in its entirety by obtaining a sports license, which also sets forth their obligations and rights. In addition, athletes commit to the World Anti-Doping Code through their club membership. The data controller has stated that, in its view, the list of athletes subject to suspension does not disclose athletes’ health information. The data controller has stated that an error was noted in the data controller’s report in the petitioner’s response — the data controller agrees with the complainant’s view regarding the determination of the complainant’s status as a national athlete at the time of the disciplinary proceedings. According to the data controller, however, this has no impact on the publication of information on the ineligibility list. According to the data controller, in accordance with the World Anti-Doping Code, only minors, protected persons, and recreational athletes are excluded from disclosure. In its supplementary statement, the data controller has provided additional information on its principles for publishing the list of suspended athletes and its communication practices. According to the data controller’s internal guidelines, when deciding whether to publish information, the athlete’s level, the severity of the sanction, and the case’s prior media coverage are taken into account. According to the controller’s explanation, communications follow a three-tier classification system for athletes, which is used to determine the scope of publication. In the data controller’s view, at the time of the disciplinary proceedings, the data subject fell under Level 1, where he was classified as a high-profile athlete. According to the data controller, even if the data subject had been classified as Level 2, the outcome of the disclosure would have been the same. The data controller has submitted, as an attachment to its response, copies of the email correspondence with the data subject, in which the timing of the publication of the suspension was discussed. The messages show that the data controller requested the data subject’s consent to publish information about the suspension before a final decision was made, whereas, in accordance with the World Anti-Doping Code, publication could only take place once the decision was final. The data subject replied to the message and consented to the premature publication of the decision. Data Subject’s Response, May 5, 2025 The Petitioner supplemented their previously submitted response on May 5, 2025. In the supplemental response, the petitioner emphasized that the attachments provided in the data controller’s response demonstrate that the data subject’s alleged consent was not freely given, but was related solely to the timing of the publication. In the petitioner’s view, the consent did not meet the requirements of the General Data Protection Regulation. Additional Statement by the Data Controller, July 15, 2025 The request for clarification asked the controller to specify the basis for processing, as the controller had cited three different legal bases for the processing of personal data on the ineligibility list. The data controller has stated that in Finland, the basic principle is that athletes are bound by the World Anti-Doping Code primarily through a licensing system, in which an athlete gains the right to participate in organized athletic activities by obtaining a license, through which the athlete commits to the anti-doping rules. According to the data controller’s interpretation, this constitutes consent. The registry administrator states that, as the governing body, it has sought to emphasize the registered athletes’ informed commitment to the Code; for this reason, the criteria issued by the registry administrator to sports federations require that athletes’ contracts must demonstrate their commitment to the World Anti-Doping Code. According to the data controller, the public interest may serve as a basis for processing, for example, when an athlete, for some reason, does not have a license or a contract. The data controller has referred to the section of the Finnish Anti-Doping Code regarding the scope of the Code. According to the Finnish Anti-Doping Code: “Each of the aforementioned persons is deemed, as a condition of their participation in sports organized in Finland, to have accepted these Anti-Doping Rules and to have committed to complying with them, as well as to have accepted SUEK’s authority to enforce these (Finnish) Anti-Doping Rules, including the sanctions prescribed for violations thereof, and the authority of the disciplinary committees specified in Articles 8 and 13 to hear the parties involved in cases and appeals falling under the scope of these Anti-Doping Rules and to render the necessary decisions.”

The data controller has submitted, as an attachment to the report, a copy of the license, which commits athletes, among other things, to comply with the anti-doping code in its entirety, as well as the agreement between the data subject and the Finnish Sports Federation. Also attached are email messages from the data subject’s representative and the data subject regarding the publication of personal data, as well as copies of the 2015 Finnish Anti-Doping Code and the 2021 Model Rules of National Anti-Doping Organizations. According to the data controller’s explanation, information regarding the investigation into a possible violation of the suspension was published because the matter was widely covered in the media. The data controller sought to put an end to media coverage through the publication. The World Anti-Doping Code does not regulate the data controller’s publication regarding the investigation. Statement from the data controller, February 2, 2026 The data controller has been asked on what basis its jurisdiction is founded and how it is defined. According to the information provided by the data controller, no information regarding the definition of its authority as the body responsible for enforcing the World Anti-Doping Code is available from the data controller itself or from the Ministry of Education and Culture. According to the information provided by the data controller, the decision granting the annual government subsidy to the data controller states: “The association carries out a function based on anti-doping conventions binding on Finland; therefore, the state subsidy granted may cover 100 percent of the association’s eligible costs.” The Finnish government is represented as a member of the association by the Ministry of Education and Culture. The data controller has stated that it is clear that no public administrative task has been assigned to the data controller under the law. The data controller has stated that, although the Finnish state has committed to international anti-doping cooperation through the Convention, the World Anti-Doping Code (WADC) has not been given the status of law in Finland. The data controller has stated that this makes its activities constitutionally exceptional: it carries out a function that bears the characteristics of the exercise of public authority, but without an explicit statutory basis for its authority. Data Subject’s Response, March 20, 2026 The data subject was given the opportunity to submit a consolidated response to all statements and additional information provided in cases TSV/179//2021 and TSV/103/2020. The data subject submitted their response on March 20, 2026. In their response, the data subject referred to their previous statements. In the data subject’s view, the processing of personal data would be permissible underRegulation, only when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, and that such a task must be based on law. The data subject has argued that the association’s bylaws are not a law or legal norm on which such processing could be based. The data subject has argued that, based on the investigation, the controller’s legal status is highly unclear, which should not be to the detriment of the data subject. Applicable Law According to Article 2(1) of the General Data Protection Regulation, the Regulation applies to the processing of personal data, whether wholly or partly by automated means, as well as to the processing of personal data in a non-automated form that forms part of a file or is intended to form part of a file. According to paragraph 2(a) of that article, the Regulation does not apply to the processing of personal data carried out in the course of an activity that falls outside the scope of Union law. According to Article 4(15) of the General Data Protection Regulation, “health data” means personal data relating to the physical or mental health of a natural person, including information on the provision of health services that indicates the data subject’s health status. Article 5 of the General Data Protection Regulation sets out the principles governing the processing of personal data. According to Article 5(1)(a) of the General Data Protection Regulation, personal data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, proportionality, and transparency”). According to Article 5(1)(c) of the General Data Protection Regulation, personal data must be adequate, relevant, and limited to is necessary in relation to the purposes for which they are processed (“data minimization”). According to Article 6(1) of the General Data Protection Regulation, processing is lawful only if and to the extent that at least one of the conditions listed in that paragraph is met. According to subparagraph (a), processing is lawful if the data subject has given consent to the processing of their personal data for one or more specific purposes. According to subparagraph (b), processing is lawful if it is necessary for the performance of a contract to which the data subject is a party, or for the implementation of measures taken at the data subject’s request prior to entering into a contract. According to subparagraph (e), processing is lawful if it is necessary for the performance of a task carried out in the public interest or for the exercise of official authority vested in the controller. Pursuant to Article 6(3) of the General Data Protection Regulation, the legal basis for processing referred to in subparagraphs (c) and (e) of paragraph 1 above must be provided for either (a) in Union law; or (b) in the law of the Member State to which the controller is subject. The purpose of the processing shall be specified in the legal basis for that processing or, in the case of processing referred to in paragraph 1(e), it must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis for the processing may include specific provisions that adapt the application of the rules of this Regulation, including, among other things: general conditions regarding the lawfulness of data processing by the controller; the types of data to be processed; the data subjects concerned, the entities to which, and the purposes for which, personal data may be disclosed; purpose limitation; retention periods; and processing operations and procedures, including measures intended to ensure lawful and appropriate data processing, such as measures for other specific data processing situations set forth in Chapter IX. Union law or the law of a Member State must pursue an objective of public interest and be proportionate to the legitimate aim pursued. According to Recital— According to Recital 45, where processing is carried out in compliance with a legal obligation to which the controller is subject, or where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the processing should have a legal basis in Union law or the law of a Member State. The General Data Protection Regulation does not require that a specific law exist for every individual data processing situation. A single law serving as the basis for multiple processing operations may be sufficient where the processing is based on a legal obligation to which the controller is subject or where the processing is necessary for the performance of a task carried out in the public interest or for the exercise of official authority. The purpose of the processing should also be defined in Union law or in the legislation of a Member State. Such law or legislation could also specify the general conditions set forth in this Regulation regarding the lawfulness of the processing of personal data, as well as the precise requirements that define the controller, the type of personal data to be processed, the data subjects concerned, the entities to which personal data may be disclosed, purpose limitations, retention periods, and other measures to ensure lawful and appropriate processing. Union law or the legislation of a Member State should also specify whether, for the performance of a task carried out in the public interest or in the exercise of official authority, the controller must be a public authority or another publicor private-law natural person or legal entity—such as a professional association—when justified by reasons of public interest, such as health-related reasons, for example, in the fields of public health and social protection and for the administration of health care services. Article 7 of the General Data Protection Regulation defines the conditions for consent. According to Article 7(1), if the processing of personal data is based on consent, the controller must be able to demonstrate that the data subject has given consent to the processing of their personal data. According to paragraph 2, if the data subject gives consent in a written communication that also concerns other matters, the request for consent must be presented clearly separately from other matters, in an easily understandable and accessible form, using clear and plain language. Any part of such a notice that violates this regulation is not binding. According to paragraph 3, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal. Before consent is given, the data subject must be informed of this. Withdrawing consent must be as easy as giving it. According to paragraph 4, when assessing the voluntary nature of consent, due consideration must be given, to the greatest extent possible, to factors such as whether consent is a condition for the performance of a contract, including the provision of a service, is a condition for the processing of personal data that is not necessary for the performance of that contract. Pursuant to Article 21(1) of the General Data Protection Regulation, the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, based on Article 6(1)(e) or (f), such as profiling based on those provisions. The controller may no longer process the personal data unless the controller can demonstrate that there are compelling legitimate grounds for the processing that override the interests, rights, and freedoms, or if it is necessary for the establishment, exercise, or defense of legal claims. Pursuant to Article 58(2)(b) of the General Data Protection Regulation, the Office of the Data Protection Ombudsman may issue a warning to a data controller or processor if the processing activities have been in violation of theRegulation. Pursuant to Article 58(2)(d) of the General Data Protection Regulation, the Office of the Data Protection Ombudsman may order the controller or processor to bring the processing operations into compliance with the provisions of the General Data ProtectionRegulation, if necessary in a specific manner and within a specific time limit. According to Section 2 of the Data Protection Act (1050/2018), [t]his Act applies in accordance with the scope of application of Article 2 of the GDPR. This Act and the General Data Protection Regulation also apply, with the exception of Article 56 and Chapter VII of the Regulation, to the processing of personal data carried out in connection with the activities referred to in Article 2(2)(a) and (b) of the Regulation, unless otherwise provided by law. Pursuant to Section 6(1)(6) of the Data Protection Act, Article 9(1) of the (General) Data ProtectionRegulation, Article 9(1) does not apply to the processing of health and genetic data in the context of anti-doping work and sports for people with disabilities, to the extent that the processing of such data is necessary to enable anti-doping work orsports for people with disabilities and those with chronic illnesses. According to Article 4(1) of the International Convention against Doping in Sport (3/2007) , in order to implement the fight against doping at the national and international levels, the States Parties commit to the principles of the Code, which form the basis for the measures set forth in Article 5 of this Convention. Nothing in this Convention shall prevent States Parties from adopting measures that supplement the Code. According to paragraph 4(2) of this Article, the Code and the most recent versions of Annexes 2 and 3 are included for information only and do not form part of (this) Convention. The annexes do not in themselves create any binding obligations under international law for the Contracting States. According to Article 5, in fulfilling the obligations of this Convention, each State Party shall take the necessary measures. Such measures may include legislation, regulations, policies, or administrative practices. Under Article 14 of the Convention, the Contracting States undertake to support WADA’s important mission in the international fight against doping. According to Section 14.3.5 of WADA’s World Anti-Doping Code, “Publication shall be accomplished at a minimum by placing the required information on the Anti-Doping Organization’s website and leaving the information up for the longer of one (1) month or the duration of any period of ineligibility.”” According to Article 14.6 of the Code, “[a]nti-Doping Organizations may collect, store, process, or disclose personal information relating to Athletes and other Persons where necessary and appropriate to conduct their Anti-Doping Activities under the Code and International Standards (including specifically the International Standard for the Protection of Privacy and Personal Information), and in compliance with applicable law.” Legal Issue The General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) applies in this case. As a regulation, it constitutes law directly applicable in the Member States. The General Data Protection Regulation is supplemented by the National Data Protection Act (1050/2018). The following legal issues are under consideration in this case: Does the General Data Protectionto the processing of personal data at issue in this case, which involved the publication of the data subject’s personal data on a public list of suspended athletes in accordance with anti-doping regulations? Did the data controller have a legal basis for processing, in accordance with Article 6(1) of the General Data Protection Regulation, for the publication of the data subject’s personal data? Has the controller complied with the principles of lawfulness, fairness, and transparency under Article 5(1)(a) of the General Data Protection Regulation and the principle of data minimization under Article 5(1)(c), by publishing information concerning the data subject on a public list of persons subject to a ban on public office? Has the data controller published information describing the data subject’s health status, as referred to in Article 4(15) of the General Data Protection Regulation, on a public list of persons subject to activity restrictions? If the data controller’s conduct has not been in compliance with data protection regulations, the Deputy Data Protection Ombudsman must also assess whether the corrective powers under Article 58(2) of the General Data ProtectionArticle 58(2) of the General Data Protection Regulation. Decision and Rationale of the Deputy Data Protection Ombudsman The General Data Protection Regulation and the national Data Protection Act apply to this case in accordance with the scope of application defined in Article 2 of the General Data Protection Regulation and Section 2 of the Data Protection Act. The data controller could not rely on consent under Article 6(1)(a) or public interest under Article 6(1)(e) as grounds for processing. The data controller was able to rely on a contract under Article 6(1)(b) of the General Data Protection Regulation as a basis for processing the data subject’s personal data on the public list of persons subject to a ban on public activities. The controller did not have a legal basis for publishing the data subject’s personal data to the extent that the publication concerned personal data related to an ongoing investigation. The publication of the data subject’s personal data was not in accordance with the principles set forth in Article 5(1)(a) and (c) of the General Data Protection Regulation. The data subject’s personal data published by the data controller did not include information describing the data subject’s health status within the meaning of Article 4(15) of the General Data Protection Regulation. However, the Deputy Data Protection Ombudsman considers that in situations where the information published on the suspension list may, in an individual case, reveal information describing an athlete’s state of health, this must be taken into account as one factor in the proportionality assessment. The Deputy Data Protection Commissioner issues a warning to the data controller pursuant to Article 58(2)(b) of the General Data Protection Regulation regarding the publication of the data subject’s personal data in violation ofin violation of the requirement of proportionality under the principles set forth in Article 5(1)(a) and (c) of the General Data Protection Regulation, as well as for conduct contrary to Article 6(1) of the General Data Protection Regulation. The Deputy Data Protection Commissioner issues an order to the data controller pursuant to Article 58(2)(d) of the General Data Protection Regulation to bring its processing activities into compliance withRegulation regarding the publication practices of the public blacklist and the legal basis for the processing of personal data. Reasons Applicability of the General Data Protection Regulation In the statements submitted in this case, the controller has argued that, in its view, the General Data Protection Regulation should not apply to this matter. According to Article 2(2)(a) of the General Data Protection Regulation, the Regulation does not apply to the processing of personal data carried out in the course of an activity that falls outside the scope of Union law. Pursuant to Section 2(1) of the National Data Protection Act, the Data Protection Act and the General Data Protection Regulation also apply to the processing of personal data carried out in the context of activities referred to inRegulation. National regulations have extended the application of the General Data Protection Regulation to include situations where it would not otherwise apply based on the exception provided for in Article 2(2)(a). The Court of Justice of the European Union (CJEU) has held that the exception provided for in Article 2(2)(a) of the General Data Protection Regulation must be interpreted narrowly. The CJEU has also emphasized that the purpose of that exception is to exclude from the scope of the Regulation the processing of personal data carried out by public authorities in the course of activities intended to safeguard national security, or in the context of activities that can be considered to fall within the same category.

In Case C-474/24, the CJEU expressly held that the processing of personal data contained in anti-doping sanction lists falls within the scope of the General Data Protection Regulation.

The processing of personal data at issue in the present case is subject to the provisions of the General Data Protection Regulation. Legal Basis for the Processing of Personal Data on the Prohibited Activities List General remarks on the legal basis for processing Based on the controller’s explanations, the controller has determined that it applies three legal bases for processing when publishing personal data on the ineligibility list. According to the report submitted by the data controller on November 18, 2024, the data controller processes the personal data of data subjects primarily to perform a task carried out in the public interest. In addition, the data controller has stated that it also processes personal data on the basis of consent and a contractual or membership relationship. The data controller has stated that, pursuant to Section 14.3.5 of the Finnish Anti-Doping Code, “public disclosure shall be carried out by, at a minimum, publishing the required information on the SUEK website and making the information available for public viewing for a period of one month or for the duration of any sports suspension, whichever whichever of these periods is longer.” The data controller has cited several parallel legal bases for processing in this matter. The Deputy Data Protection Ombudsman notes that the choice of legal basis for processing has significant implications, for example, for the rights of data subjects. It is the data controller’s responsibility to ensure that the legal basis for processing is clearly defined and that the rights of data subjects are safeguarded to the extent permitted by the applicable legal basis. The data controller must define the legal basis for processing before commencing processing activities. Public Interest On the legal basis of public interest Pursuant to Article 6(1)(e) of the General Data Protection Regulation, the processing of personal data may be lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. If the basis for processing is subparagraph (e), the legal basis for the processing must be provided for either (a) in Union law; or (b) in the law of the Member State to which the controller is subject. When processing is carried out in accordance with a legal obligation to which the controller is subject, or when it is necessary for the performance of a task carried out in the public interest or for the exercise of official authority vested in the controller, the processing should have a basis in Union law or the law of a Member State. --- The purpose of the processing should also be defined in Union law or the law of a Member State.

Union law or the law of a Member State should also specify whether, in order to perform a task carried out in the public interest or to exercise official authority, the controller must be a public authority or another publicor a natural or legal person governed by private law—such as a professional association—when justified by reasons of public interest, such as health-related reasons, for example, in the areas of public health and social protection and for the administration of health care services. When the General Data Protection Regulation refers to the legal basis for processing or a legislative measure, this does not necessarily require a legislative act adopted by the Parliament, without prejudice to the application of the requirements laid down by the constitutional order of the Member State concerned. However, the legal basis or legislative measure in question should be clear and precise, and its application should be foreseeable for individuals, in accordance with the case law of the Court of Justice of the European Union and the European Court of Human Rights.

It has been consistently held in the Constitutional Law Committee’s opinion practice that the grounds for the processing of personal data must be prescribed by a law enacted by Parliament, taking into account the conditions for restricting fundamental rights.

International Anti-Doping Conventions and Their National Implementation The Finnish Parliament has ratified the Council of Europe Anti-Doping Convention (SoPS 23/1990) on April 26, 1990, and the UNESCO International Convention against Doping in Sport (1243/2006) on December 22, 2006. These international conventions have not been implemented nationally through separate legislation. No national provisions have been enacted specifying which body is responsible for carrying out the monitoring tasks required by these international conventions at the national level. In the government proposal HE 191/2006 concerning the ratification of the UNESCO Convention, it was determined that the Convention does not require legislative amendments.

Under the UNESCO Convention, the Finnish government has committed to supporting WADA’s activities (Article 14). However, according to Article 4 of the Convention, WADA’s Anti-Doping Code is not part of the Convention. The World Anti-Doping Code (WADC) is therefore not directly part of the Convention ratified by the Finnish Parliament. The World Anti-Doping Code is not based on the legislation of the Member State applicable to the controller, as required by Article 6(1)(3)(b) of the General Data Protection Regulation. The Finnish Anti-Doping Code is a Finnish translation of the WADC prepared by the data controller. Section 14.6 of the Anti-Doping Code refers to the right of anti-doping organizations 11 to process personal data 12 in the course of their duties. A corresponding provision can be found in Section 14.6 of the national Finnish Anti-Doping Code, which specifically refers to SUEK ry’s right to process personal data. 13 According to a report submitted by the data controller on July 15, 2025, WADA has approved these national regulations. The Finnish Anti-Doping Code directly refers to SUEK ry as the competent authority responsible for overseeing the implementation of the Anti-Doping Code. However, this reference exists solely in the Finnish Anti-Doping Code, which was drafted by the controller. The Finnish Anti-Doping Code is not based on the Member State’s legislation applicable to the data controller or on Union law, as required by Article 6(3) of the General Data Protection Regulation. According to the report submitted by the data controller on February 2,2026, the controller’s role in the monitoring of doping cases and the related processing of personal data is not defined in national legislation or Union law. According to the data controller, the association’s operations are based on government grants, the justifications for which refer to the fact that the association performs a function based on anti-doping conventions binding on Finland. In the present case, the data controller’s right or obligation to process personal data is not defined in national legislation. The Finnish state has committed to international anti-doping conventions by a decision of Parliament. However, the obligations under these conventions apply to the Finnish state, not to the data controller. The Deputy Data Protection Ombudsman finds that the data controller did not have the right to process the data subject’s personal data by publishing it on the list of suspended athletes on the grounds of public interest, since the legal basis of public interest has not been provided for in the national legislation applicable to the data controller as required by Article 6(3)(b) of the General Data Protection Regulation. Consent When personal data is processed on the basis of consent pursuant to Article 6(1)(a) of the General Data Protection Regulation, the consent must comply with the conditions set forth in Article 7 of the General Data Protection Regulation. For consent to be valid, it must be a specific, informed, freely given, and unambiguous expression of will. Specificity, Awareness, and Unambiguity Based on the information provided by the data controller, the data subject’s consent to the processing of personal data is requested in situations where an athlete (the data subject) commits, in connection with membership in a sports federation, to complying with the Finnish Anti-Doping Code. According to Recital 32 of the General Data Protection Regulation, consent should be given by a clear affirmative act, such as a written statement—including an electronic one— or an oral statement that indicates the data subject’s voluntary, specific, informed, and unambiguous expression of will, by which he or she consents to the processing of his or her personal data. Consent should cover all processing operations carried out for the same purpose or purposes. According to Recital 42, the controller should be able to demonstrate that the data subject has given consent to the processing operations when the processing is based on the data subject’s consent. In particular, if consent is given in the context of a written communication regarding another matter, safeguards should ensure that the data subject is aware of the consent they are giving and the scope of that consent. Voluntariness and Nature of the Activity According to Recital 42 of the General Data Protection Regulation, consent cannot be considered to have been freely given if the data subject does not have a genuine choice and cannot subsequently refuse to give consent or withdraw it without suffering any disadvantage. According to43 of the preamble, consent should not be a valid legal basis for the processing of personal data in a specific situation where there is a clear imbalance of power between the data subject and the controller. This decision assesses the processing of personal data on a public sanctions list. The publication of data on the sanctions list constitutes the disclosure of information related to the controller’s enforcement activities. The Deputy Data Protection Ombudsman considers that such sanction-based activities involve the kind of structural imbalance between the data subject and the data controller described in recital 43 of the preamble—as described in Recital 43—such that the granting of consent cannot be considered voluntary. The parallel grounds for processing defined by the data controller also mean that withdrawing consent has, in practice, no legal effect. Failure to give consent or withdrawal of consent would also result in negative consequences for the data subject —refusal to undergo doping testing and related disciplinary proceedings could, in practice, often result in negative consequences for data subjects professionally, financially, and socially. The Deputy Data Protection Commissioner considers that, in the context of the processing operations in question, the data subject has not had a genuine opportunity to validly withdraw consent. The Deputy Data Protection Ombudsman considers that a general reference in the contract document to the athlete’s commitment to comply with anti-doping regulations does not meet the requirements of Article 7 of the General Data ProtectionRegulation regarding the specificity and clarity of consent, particularly given that such consent is an essential part of the contract. The data controller could not rely on the data subject’s consent as a basis for processing when publishing the data subject’s personal data on the prohibited list. Contract In its response dated March 11, 2025, the data controller stated that the contract is a secondary legal basis for processing in the matter at hand. The data controller has pointed out that athletes commit to the anti-doping code in its entirety by obtaining a sports license, which sets forth their obligations and rights. Furthermore, the data controller has stated that athletes commit to the anti-doping code through their club membership, since all clubs have committed to it through their respective sports federations and, in doing so, have bound their own members to it as well. The data controller has submitted, as an attachment to the report dated July 15, 2025, a copy of the agreement concluded between the data subject and the Finnish Athletics Federation. Section 4.1 of the agreement states that the parties undertake to comply with the rules and regulations of the Finnish Athletics Federation and the IAAF, 14 including anti-doping regulations, competition rules, and advertising rules. The section also states that “the athlete specifically accepts that disciplinary measures may be imposed on him or her in accordance with the rules of the Finnish Athletics Federation and the international rules of track and field.” Section 5.1 of the agreement further specifies that the athlete undertakes to comply with the referenced anti-doping regulations. Based on the second paragraph of Section 5.1 of the agreement, the athlete is obligated to be familiar with the anti-doping regulations in effect at any given time, as well as the prohibited substances and methods for the athlete’s sport. Pursuant to the third paragraph of Section 5.1, doping violations and the sanctions imposed on the athlete for such violations are set forth in the aforementioned anti-doping rules. 15 Paragraph 4 of Section 5.1 states that the athlete consents to the public disclosure of the outcome of his or her doping violation in accordance with the anti-doping rules. In this case, the registered athlete has entered into an agreement with the Finnish Athletics Federation. The agreement states that the parties to the agreement are obligated to comply with the anti-doping regulations. The agreement specifically includes a provision stating that the registered person commits to disciplinary procedures in accordance with these rules, as well as to the publication of doping violations in accordance with anti-doping rules. The registered party can be considered to have committed in the agreement to complying with the anti-doping code. The agreement document specifically highlights the publication of information regarding doping violations in accordance with the anti-doping code. The Deputy Data Protection Ombudsman considers that the commitment to the anti-doping regulations has been an essential part of the agreement between the data subject and the Finnish Athletics Federation. The Deputy Data Protection Ombudsman considers that the data controller was entitled to process the data subject’s personal data on the basis of Article 6(1)(b) of the General Data Protection Regulation. Publication of Information Regarding an Ongoing Investigation Based on the report submitted by the data controller, information regarding the investigation initiated due to the data subject’s violation of the suspension was published on a case-by-case basis, as it would also be in the data subject’s best interest given the significant media attention the case has received. Based on the data controller’s report, the Anti-Doping Code does not require the disclosure of information regarding an ongoing investigation. Under the anti-doping rules, the data controller would have had neither the obligation nor the right to publish the information in question. The Deputy Data Protection Ombudsman notes that the data controller’s basis for processing is explicitly grounded in the data subject’s agreement to comply with the publication obligation under the anti-doping regulations. Since no such obligation exists with regard to the publication of information concerning ongoing investigations, the Deputy Data Protection Ombudsman concludes that the data controller had no legal basis to publish the data subject’s personal data regarding an ongoing investigation pursuant to Article 6(1)(b) of the General Data Protection Regulation. Publication of Data and the Requirement of Proportionality Although the Deputy Data Protection Commissioner concluded in paragraph 84 that the data controller was permitted to process the data subject’s personal data on the list of persons subject to a ban on activities pursuant to Article 6(1)(b) of the General Data Protectionin accordance with Article 6(1)(b) of the General Data Protection Regulation, the Deputy Data Protection Commissioner must assess whether the publication of the data subject’s personal data on the blacklist in the present case was, in accordance with the principle of lawfulness set forth in Article 5(1)(a) of the General Data Protectionin a fair balance with the consequences for the data subject’s right to privacy. The data subject objected to the publication of his or her personal data on the public list of persons barred from certain activities in a response letter sent to the Disciplinary Board on January 8, 2021. In the assessment presented in paragraphs 63–71 above, the Deputy Data Protection Ombudsman has concluded that the public interest could not be invoked as a legal basis for processing the data for publication on the list of persons subject to a ban on public activities. Consequently, the data subject cannot be deemed to have had the right to object to the processing of personal data under Article 21(1), since the right to object requires that the data subject’s data be processed on the basis of either Article 6(1)(e) or (f). However, the data controller has an obligation under the General Data Protectionto ensure that the processing of personal data complies with the principles set forth in Article 5(1) of the General Data Protection Regulation, regardless of the applicable legal basis for processing. Based on the report submitted by the data controller on March 11, 2025, the publication of the suspension follows a three-tier model for data publication. A key factor influencing this decision is the competitive level and public profile of the athlete subject to the suspension. In the present case, the data subject has been assessed as a high-profile athlete, which has led, in accordance with the data controller’s guidelines, to the publication of the suspension on the suspension list and in a notice on the data controller’s website, as well as to the dissemination of this notice to the media. On the Requirement of Proportionality in General In its judgment in Case C-474/24, the Court of Justice of the European Union assessed the compatibility of Austrian national legislation relating to anti-doping activities with the requirements of Article 6(3) of the General Data ProtectionRegulation, Article 6(3), and with the General Data Protection Regulation, Article 5(1)(a) and (c). In its ruling, the Court held that the General Data ProtectionRegulation, as well as the principle of minimization under subparagraph (c), are expressions of the principle of proportionality. 16 The severity of the interference with the data subject’s right to privacy resulting from the publication of their personal data on a list of prohibited activities must be weighed against the importance of the objective pursued by such publication. 17 The data controller is obligated to comply with the requirements of the General Data Protection Regulation. The WADC, or its Finnish-language equivalent, the Finnish Anti-Doping Code, is not based on a law enacted by the Finnish Parliament or an international agreement approved by the Finnish Parliament. 18 In accordance with the principle of the primacy of EU law, in the event of a conflict, the data controller must comply with the requirements of the General Data Protection Regulation, even if this conflicts with a provision of the WADC. Assessment of the Proportionality of the Publication of the Data Subject’s Personal Data The Deputy Data Protection Ombudsman considers that the data controller should have taken into account not only the data subject’s public profile 19 but also other factors related to the case in question, which should have influenced the decision to publish the information, taking into account, in particular, the seriousness of the violation in question and the impact of publication on the data subject’s right to privacy. During the investigation, the data subject was under a voluntary suspension. The Disciplinary Board has determined that the suspension, which the data subject was already serving at the time of the decision, constituted a sufficient penalty. The data subject’s suspension ended on the date the decision was issued (January 29, 2021). Nevertheless, information regarding the data subject’s suspension was published on the public suspension list after it had ended. In this regard, the data controller has cited the requirements of the World Anti-Doping Code regarding publication, which state that information on a suspension must be published for the duration of the suspension, or for at least one month, whichever of these periods is longer. 20 The Deputy Data Protection Ombudsman considers that the publication of personal data concerning a suspension after the suspension has ended also affects the benefits that can be achieved by publishing the suspension. After the suspension ends, the publication of such information has no bearing, for example, on participation in competitions. The Court of Justice of the European Union has held that publishing the name of an athlete subject to a suspension on an online list of suspended athletes for a period exceeding the duration of the sanctions in question is not proportionate to the importance of the objective pursued, given the impact of the publication on the athlete’s fundamental rights. 21 The Deputy Data Protection Ombudsman also notes that the Disciplinary Committee’s decision indicates that the prohibited substance found in the data subject’s system entered the data subject’s system due to an impurity in a dietary supplement, as well as the fact that the data subject investigated the impurities in the dietary supplement at his own expense. The Disciplinary Board’s decision states that the only thing the registered individual could have done differently would have been to refrain from using the dietary supplement. The Disciplinary Committee has determined that, based on the objective facts, the registered person’s negligence falls into the “category of minor negligence.” In this category, the duration of the suspension ranges from 0 to 8 months, with a typical level of negligence resulting in a four-month suspension. 22 The registered person has been imposed a three-month suspension from sports. The Deputy Data Protection Ombudsman acknowledges that some decisions regarding minor violations may also serve the public interest by raising awareness of anti-doping regulations. For example, it may be necessary to raise awareness about how prohibited substances may unintentionally enter an athlete’s system. However, the Deputy Data Protection Ombudsman considers that such an increase in public awareness does not necessarily require the publication of the athlete’s name on the list of suspended athletes in the specific case; but the guidelines established in the decision-making process can also be communicated in other ways. The Deputy Data Protection Ombudsman considers that, when evaluating the controller’s actions, it is necessary to take into account the fact that that the legal situation regarding the relationship between the information published on the suspension lists and the legislation on the protection of personal data has been unclear. The judgment of the Court of Justice of the European Union of July 15, 2026, in Case C-474/24, has helped to clarify the legal situation regarding this matter since the case was filed. The Deputy Data Protection Commissioner notes, however, that the retroactive effects of a preliminary ruling by the Court of Justice of the European Union are the general rule in case law, so a preliminary ruling generally has ex tunc effect, meaning that its effect begins upon the entry into force of the provision of European Union law at issue in the preliminary ruling, rather than upon the issuance of the preliminary ruling itself. A preliminary ruling by the Court of Justice of the European Union does not create new legislation but rather clarifies the content and interpretation of Union law. The General Data Protection Regulation (GDPR) was in effect at the time the case was initiated, and the data controller was obligated to assess the lawfulness of the processing of personal data in accordance with the GDPR. The Deputy Data Protection Ombudsman considers that the publication of information regarding the suspension on a public list of suspensions has been a disproportionately severe measure with respect to the data subject’s right to privacy, when weighing the effects of the publication on anti-doping efforts against the facts of the case outlined above and the consequences for the data subject’s right to privacy. The Concept of Health-Related Data In the statements submitted in this case, the data controller has maintained that it does not publish information regarding the health status of data subjects on the list of suspended athletes. In their responses to the case, the data subject has argued that the data controller has published data describing their health status on the list of prohibited activities. According to Article 4(15) of the General Data Protection Regulation, health data refers to personal data relating to the physical or mental health of a natural person that reveals their health status. Health-related personal data includes all information concerning the data subject’s health status and revealing details about the data subject’s past, present, or future physical or mental health. 23 The European Data Protection Board has held that health-related data can be derived from various sources. For example, information may become health data when viewed in conjunction with other data, and such data reveals a state of health or health risks. 24 The Court of Justice of the European Union (CJEU) has consistently held that the concept of health data must be interpreted broadly. 25 The CJEU has held that, for personal data to be classified as health dataRegulation, it is sufficient that, through intellectual combination or inference, information regarding the data subject’s health status can be derived from such data. 26 The CJEU has held in Case C-474/24, the CJEU held that, as a general rule, the mere mention of the name of a prohibited substance or method present in an athlete’s body is not sufficient to reveal information about that athlete’s current or future state of health. 27 On the other hand, it cannot be ruled out that, when a reference to the name or category of the prohibited substance or method in question is combined with other facts, it may, at least indirectly, reveal intellectual activity involving the combination of data or the drawing of conclusions regarding the data subject’s current state of health and, possibly, future state of health. 28 As an example of such a situation, the CJEU has cited cases in which a person subject to a ban has used a prohibited substance for health reasons, and has not applied for authorization for therapeutic use in accordance with the prescribed procedure. 29 In its decision 1198/161/2022 concerning measurement data from sports watches, the Data Protection Ombudsman has held that heart rate data processed by the data controller, when combined with other data processed by the data controller, reveals information about the data subject’s health. The Data Protection Ombudsman has emphasized that not all individual pieces of data should be considered health-related data; however, if the data controller can combine individual pieces of data with other data, and this combined data can be used to draw conclusions about a person’s current or future state of health, the processing of that individual piece of data may result in it being considered, pursuant toRegulation, and thus as data falling within the special categories of personal data referred to in Article 9. 30 The European Data Protection Board has held that health-related information may be derived from various sources; for example, data may become health information when viewed in conjunction with other data, and this data reveals a person’s health status or health risks. 31 The Data Protection Working Party has also held that a single data entry containing information on a person’s weight and heart rate allows conclusions to be drawn about the person’s current or future health status. If data on weight and heart rate were collected over a longer period of time, and this data could be combined with information regarding the person’s age or gender, the Data Protection Working Group believes that conclusions could be drawn about the data subject’s health. 32 The key factor is what can be inferred about the data subject’s state of health based on the data as a whole. The present case involves a situation in which a disciplinary sanction was based on an extremely small amount of a prohibited substance that entered the athlete’s system as a contaminant in a dietary supplement. In its decision, the Disciplinary Committee found, for example, that it was not necessary to disqualify the registered athlete’s competition results for the period between the time of sampling and the start of the provisional suspension, since, in the Disciplinary Committee’s assessment, the prohibited substance was not deemed to have affected the registered athlete’s performance during that period. Knowledge of a suspension does not necessarily mean that the athlete has used prohibited substances systematically, over a long period of time, or in large quantities. The information regarding the registered athlete’s suspension in the present case merely indicates that the substance was detected in the athlete’s system at the time the sample was collected. The Deputy Data Protection Ombudsman considers that the effects of prohibited substances can vary significantly, depending on the substance used, the amount and duration of use, and the athlete’s individual characteristics. The Deputy Data Protection Ombudsman considers that, in the present case, it was not possible to draw conclusions about the data subject’s state of health based solely on the personal data published on the list of suspended athletes. The Deputy Data Protection Ombudsman considers that the information in question therefore did not constitute data describing health status as defined in Article 4(1)(15) of the General Data Protection Regulation. The Deputy Data Protection Ombudsman considers that it is possible that, in certain situations, a decision by the Anti-Doping Disciplinary Committee and the information published regarding it may contain data relating to health status. Such situations may include, for example, cases where there is a medical justification for the use of a prohibited substance. 33 In these situations, however, it must be taken into account that, pursuant to Section 6(1)(6) of the Data Protection Act, Article 9(1) of the General Data Protectiondoes not apply to the processing of health and genetic data in anti-doping work and in the context of para sports, to the extent that the processing of such data is necessary to enable anti-doping work orsports for people with disabilities and those with chronic illnesses. The Deputy Data Protection Ombudsman, however, considers that if the information published on the ineligibility list could, in an individual case, reveal data describing the data subject’s state of health, this fact should be taken into account in the overall assessment of the proportionality of the publication of the information. Appeal Pursuant to Section 25 of the Data Protection Act (1050/2018), an appeal may be filed against this decision with the AdministrativeCourt in accordance with the provisions of the Act on Proceedings in Administrative Matters (808/2019). The appeal must be filed with the Helsinki Administrative Court. Service of the Decision The decision shall be served in accordance with Section 60 of the Administrative Procedure Act (434/2003) by mail against a certificate of receipt. The decision shall be served on the Ministry of Education and Culture. Further Information on the Decision The decision was issued by Deputy Data Protection Ombudsman Heljä-Tuulia Pihamaa. The matter was presented by Senior Inspector Saana Sydänmaanlakka. The decision is not legally binding. Footnotes: 1 WADA Anti-Doping Code 2021, footnote 91. 2 Finnish Anti-Doping Regulations, page 9. 3 C-474/24, NADA et al., decision of July 14, 2026. Paragraphs 46–47 of the decision and the decisions cited therein. 4 C-474/24, NADA et al., judgment of July 14, 2026. Paragraph 54 of the judgment. 5 Recital 45 of the General Data Protection Regulation. 6 Recital 45 of the General Data Protection Regulation. 7 Article 80(1) of the Constitution; PeVM 25/1994 vp on the General Conditions for Restrictions on Fundamental Rights. 8 For example, the Constitutional Law Committee has considered it a matter of legislative priority to remove from a bill the authorization to regulate the retention periods for personal data by decree; see, e.g., PeVL 8/1995 vp, 7/1997 vp, 11/1997 vp, and 25/1998 vp. 9 See, e.g., PeVL 6/2026 vp, para. 3; PeVL 33/2025 vp, para. 4; PeVL 8/2021 vp, p. 2; and PeVL 1/2018 vp, p. 3. 10 HE 191/2006 vp, p. 5.

In accordance with the wording of the Anti-Doping Code, “personal information” (free translation). It should be noted that the definition does not refer, for example, to the definition of personal data under Article 4(1) of the General Data Protection Regulation.

According to the data controller, decision-making regarding the publication of suspensions primarily takes into account the athlete’s level of competition as well as, on a case-by-case basis, potential prior publicity.

Guidelines 03/2020 on the processing of data concerning health for the purposes of scientific research in the context of the COVID-19 outbreak, p. 5 https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf.

Guidelines 03/2020 on the processing of data concerning health for the purposes of scientific research in the context of the COVID-19 outbreak, p. 5 https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf.

Article 29 Working Party (WP29), Advice paper on special categories of data (“sensitive data”) to the European Commission, Annex 10: Health data in apps and devices.