NADA Austria and RRC Sports: Towards a GDPR Framework for Sports Governance
By Dr Estelle Ivanova, Attorney at Law, Paris, France
Within the space of two days, the Court of Justice of the European Union (CJEU) has delivered two judgments with significant implications for the application of the General Data Protection Regulation (GDPR) in the sports sector.
On 14 July 2026, the Grand Chamber delivered its judgment in NADA Austria and Others (C-474/24), addressing the compatibility of the publication of anti-doping sanctions with the GDPR. Two days later, on 16 July 2026, the Fifth Chamber ruled in RRC Sports (C-209/23), examining the FIFA processing and publication of personal data in the context of the FIFA Football Agent Regulations (FFAR). Although arising in different regulatory contexts, both judgments point towards a common approach to the exercise of governance powers in sport under the GDPR.
In NADA Austria and Others, the CJEU confirmed that EU law does not, in principle, prevent national anti-doping authorities from publishing the names of professional athletes who have breached anti-doping rules, together with the duration of and the reasons for their sanctions. Transparency serves legitimate public interest objectives, including protecting the integrity of sport, ensuring fair competition, safeguarding athletes' health and strengthening the deterrent effect of anti-doping sanctions.
However, the judgment makes clear that publication cannot be automatic.
The CJEU emphasised that the controller must conduct an individual balancing exercise before publication, assessing whether disclosure complies with the GDPR and, in particular, with the principle of proportionality. Importantly, the CJEU required that athletes have access to an effective preventive remedy before the competent data protection authority where publication is imminent.
The CJEU also clarified two important issues concerning the GDPR treatment of special categories of personal data. It held, first, that anti-doping infringements do not, in principle, constitute data concerning health, unless the published information is capable of indirectly revealing an athlete's physical or mental health status. Secondly, it found that personal data relating to anti-doping sanctions do not constitute data relating to criminal convictions and offences within the meaning of Article 10 GDPR but, instead, are akin to disciplinary measures applicable to a specific group of persons.
The significance of the NADA Austria judgment lies in the careful balance that it strikes between sporting transparency and the protection of fundamental rights. Whilst it recognises the legitimacy of public disclosure as an anti-doping tool, it rejects blanket publication regimes that fail to take account of individual circumstances.
For sports governing bodies, National Anti-Doping Organisations (NADOs) and international federations, the judgment underscores that publication policies must be designed in compliance with the GDPR, incorporating case-by-case proportionality assessments rather than relying on automatic disclosure. More broadly, the judgment reinforces the growing interaction between sports regulation and EU data protection law.
The CJEU adopted a similar approach in RRC Sports, this time in the context of the FFAR. As regards the GDPR, it first recalled that the FFAR govern only the processing of personal data relating to natural persons. It further observed that it is for the referring court to determine whether the processing of the personal data, that agents are required to communicate to FIFA, is necessary for the purposes of the legitimate interests pursued under Article 6(1)(f) GDPR and whether those interests are overridden by the rights and freedoms of the data subjects. The CJEU nevertheless held that Article 6(1)(f) GDPR precludes rules requiring FIFA to disclose and publish every sanction imposed on football agents or their clients, as well as detailed information relating to all transactions involving agents.
In reaching that conclusion, the CJEU considered that, although the publication of certain sanctions may satisfy the balancing exercise required by Article 6(1)(f) GDPR, a blanket publication regime covering every sanction, irrespective of its gravity, the impact of the underlying conduct on confidence in the markets concerned, the existence of prejudice suffered by third parties or the time elapsed since the infringement, does not.
Beyond their different factual settings, NADA Austria and RRC Sports send a common message to sports governing bodies.
Transparency and effective regulation remain legitimate objectives of sports governance, but they cannot be pursued at the expense of the safeguards enshrined in the GDPR. These judgments confirm that the exercise of regulatory powers in sport must increasingly be reconciled with EU data protection law, which requires publication regimes to be carefully designed, proportionate and responsive to the circumstances of each individual case.
Dr Estelle Ivanova may be contacted by e-mail at ‘
