[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdBkPRxs0n00W_qhELsrAPSgLphvdE2CuKDoxZNbXQqM":3},{"article":4,"iocs":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"f6880e1d-6a65-4683-86f6-288b9b14fece","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F179\u002F2021","tietosuojavaltuutetun-toimisto-finland-tsv-179-2021-204284","Created page with \"{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland) |Case_Number_Name=TSV\u002F179\u002F2021 |ECLI= |Original_Source_Name_1=Finlex |Original_Source_Link_1=https:\u002F\u002Fwww.finlex.fi\u002Ffi\u002Fviranomaiset\u002Ftietosuojavaltuutettu\u002F2026\u002F23 |Original_Source_Language_1=Finnish |Original_Source_Language__Code_1=FI |Original_Source_Name_2= |Original_Source_Link_2= |Ori...\" Show changes","Finland's Data Protection Authority (Tietosuojavaltuutetun toimisto) reprimanded the national anti-doping organization (SUEK ry) for publishing an athlete's anti-doping infringement details without a legal basis. The DPA found the publication disproportionately severe and a violation of the athlete's privacy rights, ordering SUEK ry to comply with GDPR regarding its public suspension lists and data processing.","Finland's DPA reprimands anti-doping org for publishing athlete's infringement details.","Help Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F179\u002F2021: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 08:43, 25 August 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators143 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 08:43, 25 August 2026 Tietosuojavaltuutetun toimisto - TSV\u002F179\u002F2021 Authority: Tietosuojavaltuutetun toimisto (Finland) Jurisdiction: Finland Relevant Law: Article 2(2)(a) GDPR Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1)(a) GDPR Article 6(1)(b) GDPR Article 6(1)(e) GDPR Type: Complaint Outcome: Partly Upheld Started: 18.05.2021 Decided: 04.08.2026 Published: 18.08.2026 Fine: n\u002Fa Parties: Suomen urheilun eettinen keskus SUEK ry National Case Number\u002FName: TSV\u002F179\u002F2021 European Case Law Identifier: n\u002Fa Appeal: Unknown Original Language(s): Finnish Original Source: Finlex (in FI) Initial Contributor: av The DPA reprimanded an anti-doping organisation for publishing information on an athlete’s anti-doping infringement without a legal basis and held that the publication was a disproportionately severe measure with respect to the data subject’s right to privacy. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts An athlete (the data subject) gave a doping sample containing a low concentration of a banned substance in August 2020. The national anti-doping organisation (the controller) issued a decision confirming that the athlete had committed an anti-doping rule violation in January 2021. Following this, the athlete took a voluntary suspension from their sport. The data subject contested the GDPR compliance of two separate processing operations. On the one hand, the controller published information about the data subject’s suspension and the banned substance found in their system on a public suspension list maintained on its website for one month in January 2021. In addition, it also published information about an ongoing investigation into whether the data subject had violated the voluntary suspension by participating in certain training sessions during it. The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of Article 4(15) GDPR had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. Holding The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case C-474\u002F24 NADA Austria and Others, where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR. Second, the DPA held that information about the suspension and the banned substance found in the athlete’s system did not constitute health data within the meaning of Article 4(15): it was not possible to draw conclusions about the data subject’s health status based on the published information alone. Third, the DPA held that the controller could not base the processing on Article 6(1)(a) or Article 6(1)(e) GDPR. According to the controller, the data subject gives their consent to the processing when they commit to complying with the Finnish Anti-Doping Code in connection with their membership in a sports federation. However, the DPA concluded that there was a clear imbalance between the data subject and the controller, as the refusal to consent to doping testing and related disciplinary proceedings could result in negative professional, financial, and social consequences for the data subject. The consent could not be considered freely given and was therefore invalid. Furthermore, the controller could not rely on public interest under Article 6(1)(e) GDPR since the basis for the processing was not provided for in national legislation as required by Article 6(3)(b) GDPR. The DPA pointed out that obligations laid down in international anti-doping treaties are only binding on the Finnish government, not the controller. The DPA also came to the conclusion that the controller could rely on a contract within the meaning of Article 6(1)(b) GDPR as a legal basis for publishing personal information on a public list of suspended athletes. However, the controller had no legal basis for publishing personal data related to the ongoing investigation against the data subject. Finally, the DPA held that the controller had infringed Articles 5(1)(a) and (c) GDPR. The DPA referred to the case C-474\u002F24 and pointed out that the principles of lawfulness, fairness, transparency and data minimisation are an expression of the principle of proportionality according to the CJEU. The DPA weighed the infringement on the data subject’s right to privacy resulting from the publication of personal data that had a legal basis under Article 6(1)(b) against the importance of the objective pursued by the publication. As the information had been published after the athlete’s voluntary suspension had ended and the substance had entered their system due to a contaminated supplement, the DPA held that the processing had been a disproportionately severe measure. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. Decision of the Deputy Data Protection Commissioner Joined Cases Background of the Case The Data Subject’s Claims and Supporting Arguments The Data Controller’s Statement, November 18, 2024 Response from the data subject on January 31, 2025 Response from the data controller on March 11, 2025 Response from the data subject on May 5, 2025 Additional statement by the data controller on July 15, 2025 Statement by the data controller on February 2, 2026 Response by the data subject on March 20, 2026 Applicable Legislation Legal Issue Decision and Rationale of the Deputy Data Protection Ombudsman Rationale Appeal Notification Further Information on the Decision Publication of Personal Data in Anti-Doping Activities Keywords Legal basis for processing personal data, Anti-doping activities Year of the case 2026 Date of issuance August 4, 2026 Reference number TSV\u002F179\u002F2021 Legal basis Decision pursuant to the EU General Data Protection Regulation Decision of the Deputy Data Protection Ombudsman Subject Legal Basis for the Processing of Personal Data and the Requirement of Proportionality in Anti-Doping Activities Data Controller Finnish Center for Sports Ethics SUEK ry (hereinafter “SUEK ry” or “the data controller”) Joined cases The Office of the Data Protection Ombudsman has received two complaints regarding the processing of personal data on the anti-doping sanctions list maintained by the data controller. The first general report of a concern was received on December 10, 2020 (TSV\u002F103\u002F2020). Case TSV\u002F103\u002F2020 does not concern the rights, interests, or obligations of the person who initiated the case. The petitioner in case TSV\u002F103\u002F2020 therefore does not have the status of a party to the proceedings pursuant to Section 11 of the Administrative Procedure Act (434\u002F2003). Case TSV\u002F179\u002F2021 was initiated on May 17, 2021. The case concerns the publicatio","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F179\u002F2021&diff=52769&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-08-25T08:43:54+00:00","2026-08-25T10:00:08.892765+00:00",7,[18,21,24],{"name":19,"type":20},"Tietosuojavaltuutetun toimisto","vendor",{"name":22,"type":23},"GDPR","product",{"name":25,"type":23},"Finnish Anti-Doping Code","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":26,"icon":28,"name":29,"slug":30},null,"Policy","policy",[32,36,41],{"category":33},{"id":34,"icon":28,"name":22,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":37},{"id":38,"icon":28,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":28,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]