Anti-Doping Regulations Need to Be Amended

In correspondence with the Ministry of Foreign Affairs, Mirosław Wróblewski, President of the Personal Data Protection Office, has pointed out that implementing the judgment of the Court of Justice of the European Union (CJEU) on anti-doping regulations requires amendments to Polish law.

The President of the Personal Data Protection Office sent these comments to the Ministry of Foreign Affairs, which coordinates the implementation of CJEU judgments, addressed to Ignacy Niemczycki, Secretary of State at the Ministry. As the judgment concerns athletes, the President of the Personal Data Protection Office also forwarded his position for information to Jakub Rutnicki, Minister of Sport and Tourism.

This is another intervention by the President of the Personal Data Protection Office concerning the implications of CJEU case law for the protection of privacy under Polish law. In this case, the matter concerns the Court of Justice of the European Union's judgment of 14 July 2026 in Case C-474/24, NADA Austria and Others.

In its judgment, the Court held that:

• The processing of personal data under national anti-doping legislation falls within the scope of the General Data Protection Regulation (GDPR) where that legislation provides for the publication of the names of athletes who have been sanctioned, information about the sport they practise, the anti-doping rule violation committed and the sanction imposed.
• Information that a person has committed an anti-doping rule violation does not fall within the definition of 'data concerning health' within the meaning of Article 9 GDPR, but only where it does not mention the name or category of the doping substance or method involved. When combined with other information relating to that person, such details may indicate, even indirectly, the person's past, present or future state of health. As the CJEU explained, 'this applies in particular where that person takes a substance or uses a prohibited method to treat a specific medical condition but has not applied for a therapeutic use exemption in accordance with the procedure laid down in the relevant rules'.
• The GDPR (Article 5(1)(a) and (c) and the second subparagraph of Article 6(3)) does not preclude national legislation from permitting the publication online of personal data concerning athletes sanctioned for anti-doping rule violations, with the exception of recreational athletes, protected persons and 'whistleblowers', provided that the relevant rules allow data controllers to balance the interests at stake on a case-by-case basis before publication.

As the judgment makes clear, combating doping serves a public interest objective. Publishing information about anti-doping rule violations has a deterrent effect and helps prevent such violations, and may therefore contribute to achieving that objective. However, since such publication also interferes with the right to privacy, assessing the seriousness of that interference requires consideration of, among other factors, the nature of the personal data and, in particular, whether it may constitute specially protected data, as well as the nature and specific circumstances of the processing, including the number of people who have access to the data and the conditions governing that access.

In Poland, the rules governing the fight against doping in sport are laid down in the Act on Combating Doping in Sport (Journal of Laws of 2022, item 1258). Unlike Austrian law, which was examined by the CJEU in the aforementioned judgment, the Polish Act does not regulate in detail the disclosure of athletes' personal data where disciplinary sanctions have been imposed for anti-doping rule violations.

The Act merely provides that a disciplinary panel may order its decision to be made public in a specified manner, in accordance with the World Anti-Doping Code, if it considers this appropriate in view of the circumstances of the case.

The provisions of the World Anti-Doping Code, together with POLADA's anti-doping rules, to which the Act refers, specify, among other things:

• The scope of the data to be published: the sport concerned, the anti-doping rule violated, the identity of the athlete or other person responsible for the anti-doping rule violation, the prohibited substance or, where applicable, the prohibited method, and the consequences imposed.
• The duration of publication: the longer of the following periods: one month or the period of ineligibility.
• Exemptions from publication for certain categories of individuals: minors, protected persons and recreational athletes.

The GDPR, however, makes it clear that the legal basis for processing personal data must be clear and precise and must be established by law. It should specify the purpose of the processing and include specific provisions adapting the application of the GDPR.

The President of the Personal Data Protection Office therefore emphasises that Polish legislation needs to be amended and clarified.

At the same time, in the view of the President of the Personal Data Protection Office, the Court's judgment in Case C-474/24, NADA Austria and Others, has implications for current practices concerning the publication of athletes' personal data under anti-doping rules. Information about prohibited substances or methods is currently being published which, when combined with information identifying an athlete and other available data about them, may reveal information about the athlete's state of health (Article 9 of Regulation (EU) 2016/679).