[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuEQzYnHD3BTsWKKHsgmJIrYfYDJDwM3LfKomT6oJ0bQ":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":32},"c2897e6f-38f3-4eb7-b92d-29dc35ea38fe","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F179\u002F2021","tietosuojavaltuutetun-toimisto-finland-tsv-179-2021-d98475","← Older revision Revision as of 08:51, 25 August 2026 Line 114: Line 114: The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of [[Article 4 GDPR|Article 4(15) GDPR]] had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of [[Article 4 GDPR|Article 4(15) GDPR]] had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. === Holding === === Holding === The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case C-474\u002F24 NADA Austria and Others, where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case [[CJEU - C‑474\u002F24 - NADA Austria and Others|C-474\u002F24 - ''NADA Austria and Others'']], where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR. CJEU in C-474\u002F24 – ''NADA Austria and Others'', paragraph 54. Second, the DPA held that information about the suspension and the banned substance found in the athlete’s system did not constitute health data within the meaning of Article 4(15): it was not possible to draw conclusions about the data subject’s health status based on the published information alone. Second, the DPA held that information about the suspension and the banned substance found in the athlete’s system did not constitute health data within the meaning of [[Article 4 GDPR|Article 4(15) GDPR]]: it was not possible to draw conclusions about the data subject’s health status based on the published information alone. Third, the DPA held that the controller could not base the processing on Article 6(1)(a) or [[Article 6 GDPR|Article 6(1)(e) GDPR]]. According to the controller, the data subject gives their consent to the processing when they commit to complying with the Finnish Anti-Doping Code in connection with their membership in a sports federation. However, the DPA concluded that there was a clear imbalance between the data subject and the controller, as the refusal to consent to doping testing and related disciplinary proceedings could result in negative professional, financial, and social consequences for the data subject. The consent could not be considered freely given and was therefore invalid. Third, the DPA held that the controller could not base the processing on [[Article 6 GDPR|Article 6(1)(a)]] or [[Article 6 GDPR|Article 6(1)(e) GDPR]]. According to the controller, the data subject gives their consent to the processing when they commit to complying with the Finnish Anti-Doping Code in connection with their membership in a sports federation. However, the DPA concluded that there was a clear imbalance between the data subject and the controller, as the refusal to consent to doping testing and related disciplinary proceedings could result in negative professional, financial, and social consequences for the data subject. The consent could not be considered freely given and was therefore invalid. Furthermore, the controller could not rely on public interest under [[Article 6 GDPR|Article 6(1)(e) GDPR]] since the basis for the processing was not provided for in national legislation as required by [[Article 6 GDPR|Article 6(3)(b) GDPR]]. The DPA pointed out that obligations laid down in international anti-doping treaties are only binding on the Finnish government, not the controller. Furthermore, the controller could not rely on public interest under [[Article 6 GDPR|Article 6(1)(e) GDPR]] since the basis for the processing was not provided for in national legislation as required by [[Article 6 GDPR|Article 6(3)(b) GDPR]]. The DPA pointed out that obligations laid down in international anti-doping treaties are only binding on the Finnish government, not the controller. Line 129: Line 127: The DPA also came to the conclusion that the controller could rely on a contract within the meaning of [[Article 6 GDPR|Article 6(1)(b) GDPR]] as a legal basis for publishing personal information on a public list of suspended athletes. However, the controller had no legal basis for publishing personal data related to the ongoing investigation against the data subject. The DPA also came to the conclusion that the controller could rely on a contract within the meaning of [[Article 6 GDPR|Article 6(1)(b) GDPR]] as a legal basis for publishing personal information on a public list of suspended athletes. However, the controller had no legal basis for publishing personal data related to the ongoing investigation against the data subject. Finally, the DPA held that the controller had infringed Articles 5(1)(a) and (c) GDPR. The DPA referred to the case C-474\u002F24 and pointed out that the principles of lawfulness, fairness, transparency and data minimisation are an expression of the principle of proportionality according to the CJEU. The DPA weighed the infringement on the data subject’s right to privacy resulting from the publication of personal data that had a legal basis under Article 6(1)(b) against the importance of the objective pursued by the publication. As the information had been published after the athlete’s voluntary suspension had ended and the substance had entered their system due to a contaminated supplement, the DPA held that the processing had been a disproportionately severe measure. Finally, the DPA held that the controller had infringed [[Article 5 GDPR|Articles 5(1)(a) and (c) GDPR]]. The DPA referred to the case [[CJEU - C‑474\u002F24 - NADA Austria and Others|C-474\u002F24]] and pointed out that the principles of lawfulness, fairness, transparency and data minimisation are an expression of the principle of proportionality according to the CJEU. CJEU in C-474\u002F24 – ''NADA Austria and Others'', paragraph 77. The DPA weighed the infringement on the data subject’s right to privacy resulting from the publication of personal data that had a legal basis under [[Article 6 GDPR|Article 6(1)(b) GDPR]] against the importance of the objective pursued by the publication. As the information had been published after the athlete’s voluntary suspension had ended and the substance had entered their system due to a contaminated supplement, the DPA held that the processing had been a disproportionately severe measure. == Comment == == Comment ==","Finland's Data Protection Authority (DPA) issued a reprimand to a controller for GDPR violations related to publishing a list of suspended athletes. The DPA found that the controller improperly processed personal data, lacked a valid legal basis for publication, and violated principles of lawfulness, fairness, transparency, and data minimization. The decision referenced a CJEU ruling confirming GDPR applicability to anti-doping infringements.","Finland's DPA reprimands a controller for GDPR violations regarding athlete suspension lists.","Help Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F179\u002F2021: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 08:43, 25 August 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators143 edits Tag: Decisions [1.0] Latest revision as of 08:51, 25 August 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators143 editsTag: Visual edit Line 114: Line 114: The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of [[Article 4 GDPR|Article 4(15) GDPR]] had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation.The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of [[Article 4 GDPR|Article 4(15) GDPR]] had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. === Holding ====== Holding === The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data.The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case C-474\u002F24 NADA Austria and Others, where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR.First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case [[CJEU - C‑474\u002F24 - NADA Austria and Others|C-474\u002F24 - ''NADA Austria and Others'']], where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR.\u003Cref>CJEU in C-474\u002F24 – ''NADA Austria and Others'', paragraph 54.\u003C\u002Fref> Second, the DPA held that information about the suspension and the banned substance found in the athlete’s system did not constitute health data within the meaning of Article 4(15): it was not possible to draw conclusions about the data subject’s health status based on the published information alone.Second, the DPA held that information about the suspension and the banned substance found in the athlete’s system did not constitute health data within the meaning of [[Article 4 GDPR|Article 4(15) GDPR]]: it was not possible to draw conclusions about the data subject’s health status based on the published information alone. Third, the DPA held that the controller could not base the processing on Article 6(1)(a) or [[Article 6 GDPR|Article 6(1)(e) GDPR]]. According to the controller, the data subject gives their consent to the processing when they commit to complying with the Finnish Anti-Doping Code in connection with their membership in a sports federation. However, the DPA concluded that there was a clear imbalance between the data subject and the controller, as the refusal to consent to doping testing and related disciplinary proceedings could result in negative professional, financial, and social consequences for the data subject. The consent could not be considered freely given and was therefore invalid.Third, the DPA held that the controller could not base the processing on [[Article 6 GDPR|Article 6(1)(a)]] or [[Article 6 GDPR|Article 6(1)(e) GDPR]]. According to the controller, the data subject gives their consent to the processing when they commit to complying with the Finnish Anti-Doping Code in connection with their membership in a sports federation. However, the DPA concluded that there was a clear imbalance between the data subject and the controller, as the refusal to consent to doping testing and related disciplinary proceedings could result in negative professional, financial, and social consequences for the data subject. The consent could not be considered freely given and was therefore invalid. Furthermore, the controller could not rely on public interest under [[Article 6 GDPR|Article 6(1)(e) GDPR]] since the basis for the processing was not provided for in national legislation as required by [[Article 6 GDPR|Article 6(3)(b) GDPR]]. The DPA pointed out that obligations laid down in international anti-doping treaties are only binding on the Finnish government, not the controller.Furthermore, the controller could not rely on public interest under [[Article 6 GDPR|Article 6(1)(e) GDPR]] since the basis for the processing was not provided for in national legislation as required by [[Article 6 GDPR|Article 6(3)(b) GDPR]]. The DPA pointed out that obligations laid down in international anti-doping treaties are only binding on the Finnish government, not the controller. Line 129: Line 127: The DPA also came to the conclusion that the controller could rely on a contract within the meaning of [[Article 6 GDPR|Article 6(1)(b) GDPR]] as a legal basis for publishing personal information on a public list of suspended athletes. However, the controller had no legal basis for publishing personal data related to the ongoing investigation against the data subject.The DPA also came to the conclusion that the controller could rely on a contract within the meaning of [[Article 6 GDPR|Article 6(1)(b) GDPR]] as a legal basis for publishing personal information on a public list of suspended athletes. However, the controller had no legal basis for publishing personal data related to the ongoing investigation against the data subject. Finally, the DPA held that the controller had infringed Articles 5(1)(a) and (c) GDPR. The DPA referred to the case C-474\u002F24 and pointed out that the principles of lawfulness, fairness, transparency and data minimisation are an expression of the principle of proportionality according to the CJEU. The DPA weighed the infringement on the data subject’s right to privacy resulting from the publication of personal data that had a legal basis under Article 6(1)(b) against the importance of the objective pursued by the publication. As the information had been published after the athlete’s voluntary suspension had ended and the substance had entered their system due to a contaminated supplement, the DPA held that the processing had been a disproportionately severe measure.Finally, the DPA held that the controller had infringed [[Article 5 GDPR|Articles 5(1)(a) and (c) GDPR]]. The DPA referred to the case [[CJEU - C‑474\u002F24 - NADA Austria and Others|C-474\u002F24]] and pointed out that the principles of lawfulness, fairness, transparency and data minimisation are an expression of the principle of proportionality according to the CJEU.\u003Cref>CJEU in C-474\u002F24 – ''NADA Austria and Others'', paragraph 77.\u003C\u002Fref> The DPA weighed the infringement on the data subject’s right to privacy resulting from the publication of personal data that had a legal basis under [[Article 6 GDPR|Article 6(1)(b) GDPR]] against the importance of the objective pur","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F179\u002F2021&diff=52770&oldid=52769","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-08-25T08:51:26+00:00","2026-08-25T10:00:08.892765+00:00",7,[18,21,24],{"name":19,"type":20},"Tietosuojavaltuutetun toimisto","vendor",{"name":22,"type":23},"GDPR","technology",{"name":25,"type":26},"Finnish Anti-Doping Code","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,37,42],{"category":34},{"id":35,"icon":29,"name":22,"slug":36},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":38},{"id":39,"icon":29,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":44,"icon":29,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]