Two judgments delivered by the Court of Justice of the European Union (“CJEU”) in July 2026 provide important guidance on the relationship between sports regulation and the General Data Protection Regulation (“GDPR”).
Although one case concerned anti-doping sanctions and the other FIFA’s regulation of football agents, both confirm that sporting integrity, transparency and effective supervision do not displace the requirements of necessity, proportionality and data minimisation.
Publication of anti-doping sanctions
AR and Others v Österreichische Datenschutzbehörde and Others (NADA Austria and Others), Case C-474/24, EU:C:2026:579, judgment of 14 July concerned four professional athletes who had been sanctioned for infringements of Austrian anti-doping rules.
The GDPR issue arose because Austrian legislation required the anti-doping bodies to publish online the athletes’ names, the duration of their bans and the reasons for those bans. The athletes challenged the actual or impending publication of that information, arguing that it was incompatible with the GDPR. This required the CJEU to consider the lawfulness and proportionality of the publication, whether the information constituted health data or criminal-offence data, and whether an athlete could lodge a preventive complaint with a supervisory authority before publication occurred.
The CJEU accepted that combating doping constitutes an objective of general interest. Publication may contribute to deterrence, prevent the circumvention of sanctions and inform competition organisers, employers and sponsors. The publication of anti-doping decisions is not, therefore, inherently incompatible with the GDPR.
Nevertheless, online publication constitutes a significant interference with the rights to privacy and data protection. The information may be made available to an unlimited audience, reproduced elsewhere and remain accessible even after its removal from the original website. As the CJEU stated:
“The seriousness of that interference must therefore be balanced against the importance of the objective pursued by the publication in question.”
Publication cannot therefore operate as an entirely automatic consequence of every anti-doping infringement. Where the applicable legislation does not itself ensure that publication will be proportionate in each case, the circumstances of the individual athlete and infringement must be considered. The seriousness of the offence, the athlete’s professional status and public profile, the consequences of publication and the period for which the information remains available may all be relevant.
The CJEU was particularly clear that publication extending beyond the duration of the sporting sanction would be disproportionate. It also clarified that information concerning an anti-doping infringement is not automatically “data concerning health” under Article 9 GDPR. It may, however, constitute health data where the substance or method disclosed, alone or together with other information, enables conclusions to be drawn concerning the athlete’s physical or mental health.
FIFA’s processing of football agents’ data
Two days later, the CJEU examined FIFA’s data-processing rules in FT and RRC Sports GmbH v Fédération Internationale de Football Association (FIFA), Case C-209/23, EU:C:2026:597, judgment of 16 July 2026.
This case arose from a challenge brought by a football agent and a German football agency against several provisions of the FIFA Football Agent Regulations (“FFAR”).
The GDPR issue arose from two connected processing operations. First, the FFAR required agents to upload extensive information to FIFA’s digital platform, including representation agreements, payments, contractual arrangements and information concerning their agencies. Secondly, Article 19 FFAR provided for information to be made available concerning agents’ identities and contact details, the clients represented, the services provided, sanctions imposed and all transactions involving agents, including their remuneration.
The referring court therefore asked whether those collection and disclosure requirements could be justified under Article 6(1)(f) GDPR on the basis of FIFA’s legitimate interests.
The CJEU accepted that establishing professional and ethical standards, protecting clients against unethical conduct and safeguarding inexperienced players could constitute legitimate interests. It also recognised that FIFA could collect certain information where this was necessary to supervise compliance with the FFAR.
However, collecting information for regulatory supervision is not the same as disclosing it to other participants in the football market. Each processing operation requires a separate justification.
The CJEU concluded that the disclosure of information concerning every transaction involving an agent was insufficiently limited. In paragraph 370, it held:
“Even if the FFAR were intended to pursue those legitimate interests, the provision […] for the disclosure and publication of all transactions involving agents remains contrary to the principle of data minimisation […] since the scope of such processing is not sufficiently circumscribed to ensure compliance with that principle.” (Unofficial translation from the French judgment.)
A similar problem arose in relation to sanctions. Although disclosure of sufficiently serious sanctions may sometimes be necessary and proportionate, the FFAR did not distinguish adequately between sanctions according to their seriousness, relevance or age. The CJEU observed:
“That obligation appears to require the disclosure and publication of all sanctions imposed, irrespective of their seriousness, the extent to which the conduct giving rise to those sanctions may have undermined confidence in the markets concerned, whether any harm was suffered by third parties, or the time elapsed since the infringement was committed.” )Unofficial translation from the French judgment.)
The CJEU consequently held that Article 6(1)(f) GDPR precludes rules requiring the disclosure and publication of every sanction imposed on agents or their clients and detailed information concerning all transactions involving agents.
A common message for sports organisations
Together, the judgments establish an important principle for sports governance. Integrity and transparency may constitute legitimate and substantial objectives, but they do not justify every processing operation carried out in their name.
Information that may properly be collected by a sports regulator does not necessarily need to be disclosed to other market participants or made publicly available. Collection, internal regulatory access, restricted disclosure and online publication are separate processing operations, each of which must be necessary and proportionate.
Sports organisations should therefore be cautious of automatic publication requirements, undifferentiated disciplinary registers and broad disclosure of commercial or transactional information. The relevant question under the GDPR is not merely whether transparency is useful, but whether the particular information disclosed, the persons receiving it and the period of availability are genuinely necessary for the objective pursued.
This article is intended for general informational purposes only and does not constitute legal advice. Specific legal advice should be obtained in relation to any particular circumstances.