Today, 14 September 2023, Advocate General Ćapeta issued her opinion in Case C-115/22 (NADA and Others), pending before the Court of Justice of the European Union (CJEU).
Preliminary aspects: The applicability of the GDPR to the circumstances of the present case
- The AG confirms that the activities challenged by the applicant constitute processing of personal data wholly or partly carried out by automated means. Nonetheless, the GDPR applies only when the data processing activity in a Member State can be connected (even loosely) with an area covered by EU law. According to the AG, the processing of personal data for the purpose of implementing a Member State’s anti-doping legislation does not fulfil that requirement.
In substance, the AG considers that the CJUE shall follow the following conclusions:
- Regarding “data concerning health”
Starting from the definition in Article 4(15) of the GDPR, “data concerning health” must refer to two aspects: (i) the personal data must be related to the physical or mental health of a natural person, and (ii) it must reveal information about his/her health status. This means that that the data at issue must also allow inferences to be drawn from that information as to the data subject’s health status (thus implying a personalized aspect of the information concerned).
Conclusion: the information that a certain person has committed a specific doping violation, as a result of which that person has been banned from taking part in (national and international) competitions does not constitute ‘data concerning health’ within the meaning of Article 9 of the GDPR.
- Regarding “personal data relating to criminal convictions or offences”
The AG reiterates that in order to determine whether a penalty is criminal in nature, three criteria should be verified: (a) the legal classification of the offence under national law; (b) the intrinsic nature of the offence; and, (c) the degree of severity of the penalty that the person concerned is liable to incur, of which the last two hold greater weight.
Conclusion: the processing operation at issue concerns ‘personal data relating to criminal convictions or offences’ within the meaning of Article 10 of the GDPR and as a consequence (i) the interests of the data subject must be given more weight in a balancing exercise on disclosure, and (ii) it must occur either under the control of ‘official authority’ or under EU or national law providing for appropriate safeguards.
With reference to point (ii), the AG concludes that tasking a body with reviewing a decision finding a breach of an anti-doping rule does not automatically render that body an ‘official authority’ within the meaning of Article 10 of the GDPR, if national law makes another institution responsible for overseeing such data processing.
- Regarding the justification of the disclosure of personal data relating to a breach of anti-doping rules
The AG points out that:
-
- the GDPR does not require that a review of proportionality be conducted in each individual case of data processing by a controller, which must rely instead on the review of proportionality undertaken by the legislature;
- in assessing the proportionality of a justification for the disclosure of the data to the general public, you must ascertain whether:
-
- the disclosure to the general public is appropriate for achieving the stated goal;
- that measure is necessary (i.e., there is no other less intrusive measure available that would achieve the same goal);
- the intrusion into the private life of that person was so significant that it could not be justified by the benefit to be achieved by the proclaimed goal.
-
Conclusion: the mandatory publication of the breach of applicable anti-doping rules by a professional athlete on the publicly accessible website of an anti-doping authority is both adequate and necessary for achieving the preventive function of deterring present and future athletes from committing a similar breach of those rules as well as for preventing the circumvention of suspensions by athletes.
The press release is available here and the full opinion is available here.
Following this opinion, we now expect the Court’s decision.
