Introduction

1.

Sporting regulations are at the interface of a number of sources of law. This is demonstrated by the fact that anti-doping rules are the product of both private and public legislative activity. In particular, the World Anti-Doping Code (‘the Code’), adopted in application of the statutes of the World Anti-Doping Agency (‘WADA’), is a private instrument that the signatory States have undertaken to respect through the United Nations International Convention against Doping in Sport.  ( 2 ) The regulations, designed to harmonise the anti-doping policies, rules and regulations of sports organisations and public authorities around the world, thus constitutes a very specific transnational sectoral legal system.  ( 3 )

2.

The Court has previously been called upon to rule on the compatibility of sports regulations with EU law, in particular from the point of view of the freedom to provide services or competition.  ( 4 )

3.

The present case gives the Court of Justice an unprecedented  ( 5 ) opportunity to consider certain aspects of the anti-doping regulations in the light of the requirements linked to the protection of personal data. It is a question of reconciling, on the one hand, the requirements of ethical sport, which, in the present case, would involve the online publication of the names of athletes who have had sanctions imposed on them for infringements of anti-doping rules and, on the other hand, the protection of the personal data of those athletes, arising from Regulation (EU) 2016/679  ( 6 ) (‘the GDPR’).

4.

At a time when the Code is being revised,  ( 7 ) the scope of the forthcoming judgment could extend beyond European borders.

Legal framework

European Union law

5.

Article 16(1) TFEU states that everyone has the right to the protection of personal data concerning them. Article 16(2) states that ‘the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.’

6.

Article 165(2) TFEU provides that Union action is to be aimed in particular at ‘developing the European dimension in sport, by promoting fairness and openness in sporting competitions and cooperation between bodies responsible for sports, and by protecting the physical and moral integrity of sportsmen and sportswomen, especially the youngest sportsmen and sportswomen’. To that end, Article 165(4) provides that ‘the Council, on a proposal from the Commission, shall adopt recommendations’.

7.

Recital 35 of the GDPR states that ‘personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for … health care services …; a number, symbol or particular assigned to a natural person to uniquely identify the natural person for health purposes; information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device or an in vitro diagnostic test.’

8.

Article 2 of the GDPR, entitled ‘Material scope’, states in paragraph 1 that ‘this Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’. It follows from Article 2(2)(a) of the GDPR that that regulation does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of Union law’.

9.

Article 4 of the GDPR, entitled ‘Definitions’, provides, in point 15 that, for the purposes of that regulation, ‘“data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status’.

10.

Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides:

11.

Article 6 of that regulation, entitled ‘Lawfulness of processing’, states:

12.

Article 9 of the GDPR, entitled ‘Processing of special categories of personal data’, prohibits, in paragraph 1 thereof, the processing of personal data concerning health, among other things. It follows from Article 9(2)(g) of that regulation that paragraph 1 does not apply if ‘processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’.

13.

Article 10 of the GDPR, entitled ‘Processing of personal data relating to criminal convictions and offences’, provides that ‘processing of personal data relating to criminal convictions and offences … shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’

14.

Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’, provides, in paragraph 1 thereof:

15.

Article 78 of the GDPR, entitled ‘Right to an effective judicial remedy against a supervisory authority’, provides, in paragraph 1 thereof:

Austrian law

16.

It follows from Paragraph 5(5) of the Anti-Doping-Bundesgesetz 2021 (2021 Federal Law on Anti-Doping) of 23 December 2020 (BGBl. I, 152/2020; ‘the ADBG’) that the Nationale Anti-Doping Agentur Austria GmbH (National Anti-Doping Agency, Austria; ‘NADA’) is a public utility company with limited liability which acts as an independent anti-doping agency and is responsible for processing personal data.

17.

Pursuant to Paragraph 5(6)(4) of the ADBG, NADA is to inform the Bundes-Sportorganisation (Federal Sports Organisation, Austria), sporting organisations, athletes and other persons, and competition organisers of the following information, and is to make that information available to the general public free of charge: ‘precautionary measures (such as suspensions) and bans on athletes and other persons which have been brought to [its] attention …, and the lifting of those measures, stating the names of the persons concerned, the duration of the ban and the reasons for the ban, without it being possible to make any inference about special categories of personal data of the persons concerned, in particular data relating to health. That information may be omitted for particularly vulnerable persons and amateur athletes …’

18.

Paragraph 6(2) of the ADBG provides in particular that NADA is to ensure the security of personal data and special categories of personal data, in accordance with Articles 32 to 34 of the GDPR. That provision states that ‘the need to process the data stems from the effective implementation of the [Code’s] anti-doping rules and the provisions of the present Federal Law, in so far as the persons concerned have contractually undertaken to comply with the Code’. In addition, ‘special categories of personal data, in particular data relating to health, can only be processed in so far as is strictly necessary under the anti-doping provisions of the present Federal Law or of the Code’.

19.

The Österreichische Anti-Doping Rechtskommission (Austrian Anti-Doping Legal Committee; ‘the ÖADR’) is a public committee, independent of government bodies, private individuals and NADA, which, pursuant to Paragraph 7(1) of the ADBG, must ‘conduct disciplinary proceedings for the competent federal sports federation in accordance with the anti-doping rules in force of the competent international sports federation (anti-doping proceedings)’.

20.

Pursuant to Paragraph 21(3) of the ADBG, the ÖADR must, ‘no later than 20 days after the decision has become final, inform the Bundes-Sportorganisation [the federal sports organisation], sporting organisations, athletes, and other persons, competition organisers and the general public of precautionary measures imposed (for example, suspensions) and decisions taken in anti-doping proceedings, indicating the name of the person concerned, the duration of the suspension and the grounds for the suspension, without it being possible to make any inference about the data concerning the health of the person concerned. That information may be omitted in the case of particularly vulnerable persons, amateur athletes and persons who contributed significantly to the detection of potential infringements of the anti-doping rules by disclosing information or other indications. Any disclosure concerning amateur athletes shall be made on public health grounds where an infringement of the anti-doping rules has been established pursuant to Paragraph 1(2)(3) or Paragraph 1(2)(9) to (11).’

21.

It follows essentially from Paragraph 23(14) of the ADBG that the same obligations are imposed on the Unabhängige Schiedskommission (Independent Arbitration Committee, Austria; ‘the USK’).

The dispute in the main proceedings, the questions referred for a preliminary ruling and the procedure before the Court of Justice

22.

In the context of anti-doping proceedings, the athletes AR, YT, DI and RN (‘the applicants’) were the subject of suspension decisions (for a certain period of time or for life, depending on the case), taken either by the ÖADR, which is competent to conduct anti-doping proceedings, or by the USK, which is competent to review the ÖADR’s decisions.

23.

Under Austrian anti-doping legislation, NADA publishes on its website a list of the names of persons who have been suspended in accordance with a decision of the ÖADR or the USK. For the duration of the suspensions, that list includes the first name and surname of the athlete concerned, the sport practised, the infringement of the anti-doping rules committed, the penalty imposed, and the start and end dates of the penalty. The ÖADR also publishes the same data, along with any prohibited substances involved, in a press release on its own website.

24.

On 14 and 15 October 2021, the applicants asked the ÖADR and NADA to cease displaying their respective names and sporting disciplines. The ÖADR and NADA did not accede to those requests.

25.

On 22 October 2021 the applicants lodged complaints with the Österreichische Datenschutzbehörde (‘the Austrian Data Protection Authority’) in accordance with Article 77(1) of the GDPR, seeking a declaration that there had been an infringement of the right to erasure or restriction of data, and an order requiring the ÖADR and NADA to remove the publication of their names and the sports from the abovementioned websites. They also argued that the case involved a special category of personal data and the processing of personal data relating to criminal convictions and offences, within the meaning of Articles 9 and 10 of the GDPR respectively. They submitted that the undifferentiated publication system provided for in Austrian law is incompatible with Article 6(3) of the GDPR and is neither necessary nor proportionate.

26.

On 26 November 2021, the Austrian Data Protection Authority dismissed the claim as unfounded. As regards YT, in particular, the complaint was rejected on the grounds of lack of interest in bringing proceedings, since the relevant data had not yet been published.

27.

The applicants then brought an action before the Bundesverwaltungsgericht (Federal Administrative Court, Austria), which is the referring court, based on Article 78(1) of the GDPR. In that context, NADA, the first defendant in the main proceedings, submitted that the publication of personal data on its website was necessary in order to comply with a legal obligation to which it was subject and to perform a task carried out in the public interest within the meaning of Article 6(1)(c) and (e) of the GDPR.

28.

The referring court stayed the main proceedings because the USK had made a request for a preliminary ruling in the case in NADA and Others.  ( 8 ) After the dismissal of that request as inadmissible by judgment of 7 May 2024,  ( 9 ) the national proceedings before the referring court resumed their course.

29.

In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

30.

Written observations were submitted by the applicants in the main proceedings, NADA, the Austrian Data Protection Authority, the Commission and the Austrian, Latvian, Netherlands, Polish and Finnish Governments. The applicants in the main proceedings, NADA, the Commission and the Austrian, Latvian and Finnish Governments also presented oral argument at the public hearing, which was held on 13 May 2025.

Analysis

31.

After examining the first question referred for a preliminary ruling on the applicability of the GDPR, I shall analyse the second, fifth and sixth questions, which concern certain specific data, before examining the issue relating to the principle of proportionality (third and fourth questions). Finally, I shall consider the seventh question, which is more procedural in nature.

The first question

32.

By its first question, the referring court asks, in essence, whether or not the implementation of anti-doping legislation constitutes an ‘activity’ which falls within the ‘scope of Union law’ within the meaning of the first sentence of Article 16(2) TFEU.

33.

The answer to that question is significant, since, if it does not, the GDPR would not apply to the dispute in the main proceedings. The GDPR was adopted on the basis of Article 16 TFEU, and Article 2(2)(a) of that regulation excludes from its scope the processing of personal data carried out in the course of an activity ‘which falls outside the scope of Union law’.

34.

As a preliminary point, and even though it is not mentioned by the referring court, I would like to point out that the exception set out in Article 2(2)(d) of the GDPR provides that that regulation does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties …’. The reason for that exception is that the processing of personal data for such purposes by ‘competent authorities’ is governed by a more specific EU act, namely Directive (EU) 2016/680,  ( 10 ) adopted on the same day as the GDPR. It cannot be ruled out, at this stage, that the substantive criterion for that exception may be met in the present case. The question whether the data processing at issue in the present case is carried out for the purposes referred to in Article 2(2)(d) of the GDPR concerns the subject matter of the fifth question referred for a preliminary ruling (relating to Article 10 of the GDPR), dealing with the criminal nature or otherwise of the convictions and offences which are the subject matter of the data processing at issue. However, the organic test for the exception set out in Article 2(2)(d) of the GDPR has not been addressed: do NADA and the ÖADR constitute ‘competent authorities’ within the meaning of Article 3(7) of Directive 2016/680? If not, the GDPR applies, which will be my working hypothesis for the remainder of the analysis. On the other hand, if they are held to be competent authorities and the substantive criterion is also met, the question of the applicability of Directive 2016/680 instead of the GDPR, would arise, which is a matter for the national court to ascertain.

35.

Having made that observation, I note that in the present case it is not disputed that the processing of personal data at issue, carried out by the Austrian anti-doping authorities and consisting of the publication on the internet of the names of the athletes concerned, the sporting discipline practised, the infringement of the anti-doping rules committed, the penalty imposed, and the start and end dates of that penalty, corresponds to processing to which the GDPR applies by virtue of Article 2(1) thereof, namely processing of personal data wholly or partly by automated means.  ( 11 )

36.

The issue which is more in dispute is whether that processing falls within the scope of the exception provided for in Article 2(2)(a) of the GDPR.

37.

In my analysis, I shall first refer to the principle that the exception provided for in Article 2(2)(a) of the GDPR must be interpreted strictly, and then draw the conclusions applicable for anti-doping activities in the light of the arguments put forward by NADA.

Strict interpretation of the exception provided for in Article 2(2)(a) of the GDPR

38.

According to settled case-law, the exception provided for in Article 2(2)(a) of the GDPR, in so far as it makes the system of protection of personal data laid down by the GDPR inapplicable, and thus deviates from its objective of protection, must be interpreted strictly.  ( 12 )

39.

Indeed, as stated in essence in recitals 6 to 12 of the GDPR, the rapid technological developments, globalisation and the scale of the collection and sharing of personal data require a strong and coherent data protection framework in the European Union, ensuring a high level of protection of the rights and freedoms of natural persons with regard to the processing of such data, equivalent in all Member States, backed by strong enforcement, so as to create the trust that will allow the digital economy to develop across the internal market.

40.

From that perspective, the material scope of the GDPR, set out in Article 2, is therefore necessarily broad and the exceptions it provides for are to be interpreted strictly. The Court of Justice has thus held that Article 2(2)(a) of the GDPR, read in the light of recital 16 thereof, is designed solely to exclude from the scope of that regulation the processing of personal data carried out in the course of an activity which is intended to safeguard national security or an activity which can be classified in the same category.

41.

Activities having the aim of safeguarding national security encompass, in particular, those that are intended to protect essential State functions and the fundamental interests of society.  ( 13 )

42.

However, it is not individuals as such who are exempt from the application of the GDPR, but only their relevant activities.  ( 14 ) The sole fact that an activity is specific to the State or a public authority is not sufficient ground for that exception to be automatically applied to the activity.  ( 15 ) Nor is it sufficient that the controller concerned has activities connected with national security, since it is only the activity at issue in the context of the relevant processing that is relevant.  ( 16 ) Nor is it sufficient that, as part of a transfer of data for commercial purposes from a Member State to a third country, the data at issue are liable to be processed, at the time of that transfer or thereafter, by the authorities of the third country concerned for the purposes of public security, defence and State security.  ( 17 )

43.

In the present case, as the Austrian Government points out, Paragraph 1(1) of the ADBG provides that ‘because it influences sporting ability, doping is contrary to the principle of fairness in sporting competition and to the true intrinsic value of sport (fair play), and also poses health risks’.

44.

It cannot therefore be maintained that the publication of personal data by NADA and the ÖADR constitutes processing of data in connection with an activity, in this case combating doping, which relates to national security or which could be classified in that category under Article 2(2)(a) of the GDPR.

45.

It must be concluded that the exception based on that provision of the GDPR is not applicable to the data processing at issue in the present case.

46.

NADA’s arguments, based, first, on the fact that anti-doping activity is a matter for the Member States and, second, on the fact that that activity is not economic in nature, are not such as to invalidate that finding, as I shall now seek to demonstrate.

Anti-doping activity does not fall outside the scope of the GDPR …

–

… even though it is a matter for the Member States

47.

First, NADA submits that anti-doping policy is an area which, under the division of competences provided for in EU law, remains a matter for the Member States, notwithstanding the supporting competence provided for in the field of sport by Article 165 TFEU.

48.

However, the fact that the processing of personal data takes place in the course of an activity which falls within the competence of the Member States is not in itself relevant for excluding that processing from the scope of the GDPR on the basis of Article 2(2)(a) thereof, where it does not fall within an activity intended to safeguard national security or an activity which can be classified in the same category.  ( 18 )

49.

To exclude from the scope of the GDPR processing carried out in the course of an activity solely on the grounds that the activity falls within the competence of the Member States would, in my view, run counter to the wording, the context and the objectives of that regulation.

50.

When the text of Article 2(2)(a) of the GDPR alludes to the concept of an ‘activity which falls outside the scope of Union law’, it does not refer to a rationale based on competence, but rather a substantive rationale for defining the scope by the legislature within the GDPR itself, as conferred by Article 16(2) TFEU. That provision ‘constitute[s] and delegate[s]’ to the Union legislative competence for the protection and free movement of personal data, and to that end defines a specific scope.  ( 19 ) In addition, in the particular context of the protection of personal data, especially bearing in mind the self-contained nature of the issues linked to the processing of personal data which called for specific suitable legislative intervention, the concept of ‘scope of Union law’ goes beyond the cases of ‘implementing Union law’ within the meaning of Article 51 of the Charter of Fundamental Rights of the European Union (‘the Charter’).  ( 20 ) Lastly, ‘in many areas falling within the competence of the Member States, Union law continues to have an influence’.  ( 21 ) That is particularly true of the GDPR, the cross-cutting scope of which is necessarily broad in view of its objectives, as set out in point 39 of the present Opinion.

51.

Thus, although the ‘anti-doping’ activity is not regulated by an act of EU law and is a matter for the Member States, it cannot be inferred from that that the processing carried out in the context of that anti-doping activity does not fall within the ‘scope of Union law’ within the meaning of Article 2(2)(a) of the GDPR, as interpreted by the Court of Justice in the specific context of the GDPR.

52.

Furthermore, since the Treaty of Lisbon, sport has been regarded as a supporting competence of the European Union.  ( 22 ) Article 165(2) TFEU thus provides that: ‘Union action shall be aimed at … developing the European dimension in sport, by promoting fairness and openness in sporting competitions and cooperation between bodies responsible for sports, and by protecting the physical and moral integrity of sportsmen and sportswomen, especially the youngest sportsmen and sportswomen’. That wording refers in particular to anti-doping policies. It is true that such supporting competence does not confer any competence on the Union to legislate in the field of sport. However, although the activity of the Union is not normative, it still exists and allows the European Union to adopt legal acts with the aim of supporting, coordinating or complementing Member State action, in accordance with Article 6 TFEU.  ( 23 ) Therefore, the fact that the anti-doping rules are ‘sporting’ in nature does not permit the inference that their implementation constitutes an activity which falls outside the scope of Union law, within the meaning of Article 2(2)(a) of the GDPR.

–

… and despite the ‘absence’ of any economic characteristics

53.

Second, NADA submits that the practice of sport falls within the scope of EU law only in so far as it constitutes an economic activity. The anti-doping rules at issue are, in its view, based on purely sporting considerations, so that the data processing at issue in the present case does not constitute a matter coming under economic activity and therefore does not fall within the scope of EU law.

54.

I am not convinced by that argument, based on the alleged ‘severability’ of the anti-doping rules.

55.

The assertion that ‘the practice of sport comes under Community law only in so far as it constitutes an economic activity within the meaning of Article 2 of the [EC] Treaty’ takes us back to the judgment of 12 December 1974, Walrave and Koch.  ( 24 ) Since then, however, the European Union has exercised its data protection competence on the basis of Article 16 TFEU. The Member States thus intended to apply EU law on the protection of personal data, including in non-economic areas, as evidenced by the text, the context and the objectives of the GDPR.

56.

First of all, the text of Article 2(2)(a) of the GDPR determines the material scope of that regulation by referring to the concept of ‘activity’ and not ‘economic activity’ whether or not it falls within the scope of Union law.

57.

Second, the context of the GDPR, and in particular its provisions on the transfer of personal data to third countries or international organisations (Chapter V of the GDPR), confirms that textual approach. If the conditions for such a transfer to take place are not met, derogations in specific situations, provided for in Article 49 of the GDPR, may nevertheless authorise such a transfer. Yet, recital 112 of the GDPR expressly states that the derogations for such special situations ‘should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange … in order to reduce and/or eliminate doping in sport’. As pointed out by the Finnish Government, that recital indicates that the EU legislature did not consider that the processing of personal data in connection with doping control, although it relates to a non-economic activity, fell outside the scope of that regulation.

58.

Lastly, the criterion based on a connection with EU law through an economic activity does not seem to me to be relevant to the objectives of the GDPR either. Indeed, such a criterion would result in having to determine the scope of the GDPR on a case-by-case basis, depending on whether or not the processing of the data in question was linked to particular provisions of EU law or to the freedoms governing the internal market. Such an approach, which varies according to the specific situations in question, could make the limits of the scope of that regulation unsure and uncertain,  ( 25 ) in breach of that regulation’s essential objective of ensuring consistent and homogeneous application of the rules for the protection of personal data throughout the European Union and removing obstacles to flows of personal data within the European Union.

59.

Moreover, I would add that, at least for professional athletes, we cannot rule out a link between the anti-doping regulations and their professional activity and therefore an economic connection, in particular with the freedoms of movement and the freedom to provide services.  ( 26 ) The penalties incurred are likely to have significant economic consequences as a result of the athletes’ suspension, sometimes for life. If, in order to determine the scope of the GDPR, it were necessary to rely on the existence of such an economic link, the unsatisfactory result would be that the GDPR could, for example, apply to professional athletes but not to amateur athletes.  ( 27 ) Such a difference in treatment depending on whether or not the activity is regarded as economic is difficult to reconcile with the GDPR and its objectives of protecting personal data.

Conclusion on the first question

60.

Having regard to all of the foregoing, I propose that the Court of Justice should answer the first question to the effect that the first sentence of Article 16(2) TFEU and Article 2(2)(a) of the GDPR must be interpreted as meaning that the processing of personal data consisting, pursuant to national anti-doping rules, in the publication of the names of the athletes concerned, the sport they practise, the infringement of the anti-doping rules they have committed, the penalty imposed on them and the start and end dates of that penalty, cannot be regarded as part of an ‘activity which falls outside the scope of Union law’ within the meaning of Article 2(2)(a) of the GDPR.

The second question

61.

By its second question, the referring court asks whether the publication of the personal data at issue relates to ‘data concerning health’ within the meaning of Article 9 of the GDPR.

Broad interpretation of the concept of ‘data concerning health’

62.

Question 2 is prompted by the fact that Article 9 of the GDPR provides for a particularly protective legal regime for categories of personal data referred to as ‘sensitive’, which include ‘data concerning health’ (or ‘health data’). Such data, considered to lie at the heart of individual privacy, require a high level of protection, provided at the same time through the protection of privacy, professional secrecy and legislation on personal data protection.  ( 28 ) Their processing is, therefore, prohibited by Article 9(1) of the GDPR, unless one of the derogations provided for in Article 9(2) applies. That approach is reflected in recital 51 of the GDPR, concerning sensitive data, according to which such specific protection is due to the fact that ‘the context of their processing could create significant risks to the fundamental rights and freedoms’. According to recital 54 of the GDPR, if the data are processed for reasons of public interest, the aim is to prevent that data being processed ‘for other purposes by third parties such as employers or insurance and banking companies’.  ( 29 ) The need for data protection has also increased with the computerisation of healthcare structures and the dematerialisation of data carriers and data flows.  ( 30 )

63.

I would add that the prohibition on processing health data, laid down in Article 9(1) of the GDPR, is independent of whether or not the information revealed by the data processing is correct, or whether the controller is acting with the aim of obtaining information that falls within one of the special categories referred to in that provision.  ( 31 ) It must be inferred from this that the objective of the controller, and in particular the fact that the processing is necessary pursuant to a legal obligation or a public interest, while constituting a relevant factor in the possible application of one of the 10 derogations provided for in Article 9(2) of the GDPR, is not a factor that must be taken into account when classifying information as ‘health data’.  ( 32 )

64.

Pursuant to Article 4(15) of the GDPR, read in conjunction with recital 35 of that regulation, such data include all personal data related to the physical or mental health of a natural person which reveal  ( 33 ) information about his or her past, current or future health status.

65.

The Court of Justice has previously held that, having regard to the objective of the GDPR, the concept of ‘data concerning health’ referred to in Article 9(1) of that regulation must be interpreted broadly.  ( 34 ) According to the contextual and teleological interpretation of Article 4(15) and Article 9 of the GDPR, in order to be classified as such, it is sufficient for the data in question to be capable, even indirectly, of revealing, by means of an intellectual operation involving collation or deduction, information about the health status of the data subject.  ( 35 )

66.

In that context, I have the impression that broadly two categories of health data could be distinguished.

67.

On the one hand, data generated in a medical context seem to me to be capable of being regarded, ‘by their very nature’,  ( 36 ) as ‘objective’  ( 37 ) health data. As set out in recital 35 of the GDPR, they relate to information concerning, for example, a physical or mental illness, a disability, disease risk, medical history or clinical treatment. They generally appear in the data subject’s medical record.  ( 38 ) Similarly, data which, although non-medical, are collected for inclusion in the medical record, such as administrative data intended to be included in that record, are as such covered by recital 35 of the GDPR as ‘health data’. In that regard, the data in question are considered to relate to health and reveal information about the data subject’s health status.

68.

In that context, the concept of ‘disease risk’, mentioned in recital 35 of the GDPR, is certainly of some importance. As is apparent from the work of the Article 29 Working Party, it includes data concerning the potential future health status of a data subject. A ‘scientifically proven or commonly perceived’ risk of disease in the future is thus taken into account, and excessive alcohol consumption, tobacco consumption or drug use are cited as examples.  ( 39 )

69.

On the other hand, outside of a medical context, a piece of information may concern health, in particular if the information in question is capable, even indirectly, of revealing information on the past, current or future physical or mental health status of a natural person.  ( 40 ) It is the ‘grey area’  ( 41 ) of the concept of ‘health data’ that raises the question of how far that information’s indirect link with health can lead to it being classified as health data. The determining factor here is whether it is possible, on the basis of the data in question, to draw inferences about the health status of the data subject, whether they relate to a pathological or physiological status, irrespective of the reliability of those inferences. Contextual factors may be taken into account in that respect,  ( 42 ) as may the link between the information in question and the ability to infer an aspect of a person’s health from it.  ( 43 )

70.

For example, the Article 29 Working Party regarded information about an individual’s membership of groups with a health-related objective such as Weight Watchers or Alcoholics Anonymous to be health data.  ( 44 ) In addition, raw data from a ‘personal measurement’ (such as weight or blood pressure recorded by a smart watch) which would not in itself be health data could, in combination with other information, allow inferences to be made about the health of the data subject. The Article 29 Working Party states in that regard that an assessment must be made on a case-by-case basis: an application that tracks and stores the number of steps taken over a few days and deletes those data after one week might not process ‘health data’. However, an application combining several years’ worth of extensive quantified records of an individual (tracking, for example, sleep and exercise habits, detailed records of diet, weight, body mass index, blood pressure and other vital statistics, and a mood diary) is regarded as processing health data. In that case, not only the conclusions and inferences, but also the raw data, will be considered to be health data.  ( 45 )

Application to the present case

71.

In the dispute in the main proceedings, the regulations at issue provide that, in addition to the names of the athletes concerned and the duration of their suspension, the reasons for that suspension are to be disclosed by reference to the category of infringement(s) detected. Where the infringement relates to a prohibited substance or method, that is also to be indicated in the press release published on the ÖADR website.  ( 46 )

72.

First of all, it must be borne in mind that infringements of the anti-doping rules that are disclosed to the public are divided into several categories.  ( 47 )

73.

Like the Austrian Data Protection Authority, I take the view that only the infringements provided for in categories 2.1 and 2.2 should be examined in the light of the concept of ‘health data’. The other infringements relate to offending conduct which does not, in itself, appear to me to be likely to reveal, even indirectly, information about the health status of the data subject. For example, information that an athlete has breached his or her whereabouts obligation (category 2.4 infringement) or trafficked in prohibited substances (category 2.7 infringement) does not reveal any information about his or her health status.

74.

Next, it should be noted that the detection of category 2.1 and 2.2 infringements involves anti-doping tests on the athlete concerned and the analysis of samples in order to detect prohibited substances and methods. I would add that the analyses are carried out by accredited professionals  ( 48 ) and therefore in a quasi-medical or even medical context. The finding of such infringements is therefore linked to ‘information derived from the testing or examination of a body part or bodily substance’ within the meaning of recital 35 of the GDPR. Such information could, therefore, be regarded as health data by nature.

75.

In that regard, it is true that the test is carried out with a view to detecting doping substances taken to improve athletic performance and that the processing, consisting in the disclosure of the information in question, meets a punitive objective with regard to the athlete concerned and is intended to act as a deterrent. However, it should be borne in mind that the objective pursued is irrelevant to the classification of the data at issue.  ( 49 )

76.

Similarly, the fact that doping substances are not medicines does not seem convincing to me. First, the concept of ‘health data’ does not include only medical data for therapeutic purposes. Moreover, some medicinal products are harmful to health if misused. Second, while combating doping is certainly intended to promote fairness and equality among athletes, it is also a health concern.  ( 50 ) A number of substances or methods are prohibited in particular because of their harmful effects on health, even if that effect varies according to the product, the quantity absorbed or the constitution of the person concerned.  ( 51 )

77.

Therefore, in order to classify the information at issue, irrespective of the fact that the objective sought by the athlete is to improve his or her performance, the effects of the absorption of a prohibited substance on the health of that athlete cannot, in my view, be disregarded, whether those effects are present or future.

78.

Lastly, it seems to me that the fact that the name of the prohibited substance detected in the body is published online by the ÖADR is such as to inform the public of the risks which its absorption may entail for the health of the athlete in question.

79.

Admittedly, the mere mention of the name of the prohibited substance present in the body could be considered insufficient, in itself, to reveal information on the health status, or even the future health status, of the athlete concerned. The actual content of the information could, in that respect, be regarded as too succinct and the link with health status too indirect, or even too hypothetical, to constitute ‘health data’ within the meaning of the GDPR. However, it cannot be ruled out that, when combined with other elements, that information may, even indirectly, be capable of revealing, by means of an intellectual operation involving collation or deduction, information about the health status of the data subject, including his or her future health status.

80.

I therefore take the view that the reference to the name of the substance in question (or its category) gives indications which, even if not very detailed, are capable of providing information, albeit indirectly, on the health status of the data subject. In the specific context of the GDPR, such a reference constitutes, in certain circumstances which it is for the referring court to verify, ‘data concerning health’ within the meaning of Article 4(15) and Article 9(1) of the GDPR, read in conjunction with recital 35 of that regulation.

81.

However, I do not consider that that would be the case if the prohibited substance in question (or its category) were not mentioned. In that event, it would be impossible to draw a link between the finding of an infringement based on the presence of a prohibited substance in the body, on the one hand, and information about the health status of the data subject, on the other, even by means of an ‘intellectual operation involving collation or deduction’. In my view, such a link would then be too indirect for the information disclosed to fall into the category of ‘data concerning health’ under the GDPR.

Conclusion on the second question

82.

I therefore propose that the Court of Justice should rule that Article 9(1) of the GDPR must be interpreted as meaning that disclosing the name of the athlete concerned, the duration of his or her suspension and the grounds for that suspension does not constitute processing of data concerning health, within the meaning of that provision, unless those grounds include the name of the prohibited substance or substances found to be present in the body of the athlete in question, where that indication is capable of revealing, even indirectly, information on the health status, including the future health status, of the athlete concerned, a matter which it is for the referring court to ascertain.

The fifth question

83.

The referring court asks, in essence, whether the publication at issue constitutes processing of personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR. It explains, in that regard, that the penalties in the main proceedings include the revocation of titles and the forfeiture of prize money, and a suspension for a number of years or a lifetime ban from all competitions (national and international). It also states that, pursuant to Paragraph 24(4) of the ADBG, sports organisations may not ‘have recourse’ to persons suspended under anti-doping legislation and therefore may not offer them gainful employment.

84.

Before analysing the nature of the anti-doping convictions and offences in question, I will address the significance of a criminal classification in the context of Article 10 of the GDPR.

The ‘criminal’ nature of convictions and offences within the meaning of Article 10 of the GDPR

85.

It should be borne in mind that the EU legislature does not prohibit the processing of personal data relating to criminal convictions and offences, but subjects it to enhanced scrutiny, in so far as it may have a significant impact on the lives of the data subjects, in particular in relation to damage to reputation or discrimination in other areas. Such processing may be carried out only ‘under the control of official authority’ or when the legislation authorising such data processing provides for ‘appropriate safeguards for the rights and freedoms of data subjects’.  ( 52 ) Article 10 of the GDPR reserves such enhanced protection for criminal offences alone, it being understood that the term ‘criminal’ refers to both ‘convictions’ and ‘offences’.  ( 53 )

86.

Article 10 of the GDPR may therefore apply to the keeping of registers of criminal convictions and offences by private bodies,  ( 54 ) for example in the context of combatting money laundering or the activities of forensic laboratories.  ( 55 ) Another example is the processing of personal data by vehicle hire companies that identify and designate a driver who has infringed road traffic regulations.

87.

In the present case, the question is therefore whether the ‘sports record’ placed online by NADA and the ÖADR constitutes a ‘register’ of criminal convictions and offences falling within the scope of Article 10 of the GDPR and which therefore requires enhanced protection.

Analysis of whether anti-doping convictions and offences are ‘criminal’ within the meaning of Article 10 of the GDPR

88.

According to the case-law of the Court of Justice, the concept of ‘criminal offence’, which is decisive for determining whether Article 10 of the GDPR is applicable to the processing of personal data, requires an autonomous and uniform interpretation throughout the European Union, having regard to the objective pursued by that provision and the context of which it forms part; the classification given by the Member State concerned to those offences is not conclusive in that regard as the classification may vary from one country to another.

89.

The three ‘Engel criteria’ adopted by the Court,  ( 56 ) namely the legal classification of the offence under national law, the very nature of the offence and the degree of severity of the penalty that the person concerned is liable to incur, are thus relevant when assessing whether an offence is criminal in nature.

90.

Although it is for the referring court to assess, in the light of those criteria, whether the convictions and offences at issue in the main proceedings are criminal in nature within the meaning of Article 10 of the GDPR, the Court of Justice, when giving a preliminary ruling, may nevertheless provide clarification designed to give the national court guidance in its assessment.  ( 57 )

91.

I shall therefore examine the offences and convictions at issue in the light of those three criteria.

–

Legal classification of the offence under national law

92.

It is apparent from the request for a preliminary ruling that, under Austrian law, the ÖADR conducts disciplinary proceedings for the relevant sports federation. Similarly, the Austrian Government emphasised at the hearing that the anti-doping regulations are of a sui generis nature in that infringements of the anti-doping rules are breaches of the rules of the sports federations concerned, which the athletes undertake to respect,  ( 58 ) and not breaches of the law.

93.

The classification of anti-doping offences under national law is therefore not consistent with a ‘criminal’ classification within the meaning of Article 10 of the GDPR.

94.

That said, the scope of the first Engel criterion needs to be put in perspective, since even in the case of offences which are not classified as ‘criminal’ by national law, the intrinsic nature of the offence in question and the degree of severity of the penalties to which it is liable to give rise may nevertheless result in it being criminal in nature.  ( 59 ) That applies in particular to anti-doping regulations, since the trans-State system put in place involves various international and national stakeholders,  ( 60 ) and the Member States have incorporated the Code in different ways into their respective legal systems. The implementation of anti-doping regulations therefore necessarily varies from one State to another, depending on the different models of State organisation, although it appears that, in most Member States, NADOs do not have criminal jurisdiction in that regard.  ( 61 )

95.

It is therefore necessary to examine the other two Engel criteria.

–

Nature of the offence

96.

The second Engel criterion requires verification of whether the purpose of the penalty for the offence at issue is punitive; the mere fact that it also has a preventive purpose does not mean that it cannot be characterised as a ‘criminal penalty’. The very nature of criminal penalties is that they seek both to punish and to deter unlawful conduct. By contrast, a measure which merely repairs the damage caused by the offence at issue is not criminal in nature.  ( 62 )

97.

It is apparent from the request for a preliminary ruling that there are two categories of penalty for anti-doping infringements.

98.

Those are, first, the revocation of titles and forfeiture of prize money, which consists in recovering winnings in order to reallocate them to the athletes who would have been entitled to them if the penalised athlete had not taken part in the competition. Such a penalty appears to be a response to a breach of the ‘rules of the game’ (‘lex sportiva’) and may be regarded as essentially aimed at restoring fair play in competitions,  ( 63 ) although that does not in any way detract from its punitive nature for the athlete concerned.

99.

The second category involves suspension from taking part in sporting competitions, lasting for a few months or several years, or even, as in the case of one of the applicants in the main proceedings, going as far as a lifetime ban from all competitions. Such a suspension may certainly be seen as a desire to ‘ban’ the offending athlete in order to remove him or her from the community of athletes and, in so doing, to preserve the integrity of that community. However, it is also intended to penalise athletes who have infringed the anti-doping rules with which they had undertaken to comply, and to deter other athletes from doing the same.

100.

The primary purpose of those anti-doping penalties, or at least of suspension from competitions, does not therefore appear to be to compensate for the harm suffered by third parties as a result of the offence, but rather to penalise the conduct of the athlete concerned, which is consistent with a criminal conviction.  ( 64 ) In that respect, anti-doping regulations, even if they do not amount to a body of criminal law, have a punitive purpose.  ( 65 )

101.

However, ‘criminal’ characterisation under the second Engel criterion could give rise to two kinds of uncertainty.

102.

An initial uncertainty arises from the fact that disciplinary proceedings have tended to be dealt with under the civil head of Article 6 ECHR by the Strasbourg Court,  ( 66 ) except, for example, where deprivation of liberty is involved and the penalty is sufficiently severe.  ( 67 )

103.

In particular, the Strasbourg Court considers that Article 6 ECHR is applicable in its civil aspect to ‘disputes relating to the withdrawal of the right to exercise a profession’,  ( 68 ) including in the field of sport.  ( 69 )

104.

The criminal nature of a ban on the exercise of a profession is therefore far from self-evident.

105.

However, it seems to me that it cannot be inferred, ipso facto and absolutely, that a disciplinary penalty resulting in suspension from sporting competitions could never be a criminal matter.

106.

Such an approach would appear to be purely formal.

107.

It should also be borne in mind that the two aspects of Article 6 ECHR, civil and criminal, are not necessarily mutually exclusive.  ( 70 )

108.

Lastly, it should be borne in mind that the Strasbourg Court examines the criminal or civil nature of the offence in question in the light of the complaints raised before it and for the purposes of assessing whether the guarantees of a fair trial provided for in Article 6 ECHR apply in their civil (paragraph 1) or criminal (paragraphs 1 to 3) aspects.

109.

On the other hand, in the context of Article 10 of the GDPR, the issue relates to the assessment of whether the conviction or offence is criminal for the purposes of determining whether the processing at issue (here, publication) concerns information deserving enhanced protection involving the control of an official authority. In addition, there is nothing to prevent the adoption of a broader interpretation entailing a stronger protection of the rights and freedoms in question.  ( 71 ) It is in that context of Article 10 of the GDPR that the referring court should assess whether or not the Engel criteria, and in particular the second criterion relating to the nature of the offence, are met.

110.

A second uncertainty arises from the fact that anti-doping offences and convictions are directed only at a particular group of persons, namely athletes, in the same way as disciplinary penalties, the purpose of which is generally to ensure that its members comply with rules of conduct specific to the group in question.  ( 72 ) Such provisions are designed to protect the profession’s honour and reputation and to maintain public trust in it.  ( 73 )

111.

It is true that such a finding would make it possible to classify the offence as ‘disciplinary’ in the sense that it applies to a certain number of persons covered by a specific set of rules. In that respect, the present case differs from the case which gave rise to the judgment in Latvijas Republikas Saeima, in which penalty points were given for road traffic offences on the basis of a text of general application.  ( 74 )

112.

However, that does not rule out the classification of the offence as a ‘criminal offence’ within the meaning of Article 10 of the GDPR. If the narrower scope specific to disciplinary regulations were sufficient to prevent the offence from being classified as a ‘criminal’ offence, we would once again be adopting a purely formal approach to the concept. Such an approach is difficult to reconcile with the case-law, which requires, in that regard, that in order to define the nature of the offence the punitive or preventive purpose of the penalty must be sought, as opposed to a purely remedial objective.

113.

In the present case, as already mentioned,  ( 75 ) anti-doping convictions are not intended to make good any damage caused by the offences in question (or not solely intended to do so, if we include the damage caused to the sporting community), but, on the contrary, they have a punitive purpose which confers on them the status of ‘criminal’ convictions within the meaning of the interpretation of that second criterion by the case-law, irrespective of whether or not the applicable legislation is general in nature. I would also point out that the Court of Arbitration for Sport (Switzerland), an international institution offering arbitration or mediation in the world of sport, itself recognises, where appropriate, the ‘quasi-penal’ nature of anti-doping penalties.  ( 76 )

114.

In addition, certain anti-doping offences, such as trafficking in prohibited substances, may give rise to penalties under both anti-doping regulations and national criminal law. It is true that the Strasbourg Court has held that the fact that acts liable to lead to a disciplinary penalty also constitute criminal offences is not sufficient for a person liable under disciplinary law to be regarded as having been ‘charged’ with a criminal offence.  ( 77 ) It seems to me, however, that that could constitute an element to be taken into account in the context of the second Engel criterion.

115.

Consequently, despite the reservations expressed, I consider at this stage that it cannot be ruled out that, in view of their punitive or preventive nature, certain anti-doping offences may be regarded as being criminal in nature within the meaning of Article 10 of the GDPR.

–

Degree of severity of the penalty

116.

The third Engel criterion must be determined by reference to the maximum penalty provided for in the relevant provisions.  ( 78 )

117.

The degree of severity varies according to the anti-doping offence committed. For example, the length of the suspension incurred varies according to the anti-doping offences in question. Recidivism and the perpetrator’s intention may also play a role in that respect.  ( 79 )

118.

It is clear from the request for a preliminary ruling that, in the present case, the penalty may involve ‘a multi-year or life ban from all (national and international) competitions’, which may therefore lead to a permanent prohibition on practising the profession of athlete.

119.

It is true that such a ban is not a custodial sentence. However, that is not a decisive element, since ‘the relative lack of seriousness of the penalty at stake cannot deprive an offence of its inherently criminal character’.  ( 80 ) Furthermore, depending on the duration of the suspension, the professional sports careers of the data subjects are likely to come to an end, particularly given the age of the data subjects and the fact that, in certain sports in particular, careers are relatively short.

120.

In addition to that suspension, which may be ‘for life’, there is the practical impossibility of finding employment in the sporting field, in view of the prohibition on association with a person who has been suspended for the entire duration of his or her suspension.

121.

As well as the economic and financial consequences for the data subject, there is also the disapproval of society and stigmatisation in both the public and private spheres.

122.

It follows, in my view, that such a penalty is of a severity capable of having an effect equivalent to a criminal conviction within the meaning of Article 10 of the GDPR; that is, however, a matter for the referring court to assess in each particular case.

123.

Accordingly, I take the view that, in principle, anti-doping offences and convictions should be regarded as falling within the disciplinary sphere, except in cases where the conviction is of such severity as to be regarded as a criminal matter. Such an assessment, which cannot be called into question solely on the basis of the classification under national law, is also consistent with the punitive and preventive purpose of the conviction, which confers a criminal nature on the offence committed. In that context, a lifetime ban on participating in any competition could therefore, in my view, constitute a penalty having an effect equivalent to a criminal penalty, capable of triggering the applicability of Article 10 of the GDPR.

124.

Lastly, I would add that I am not convinced by NADA’s argument warning against the implications, for all professional bodies, of applying Article 10 of the GDPR to the processing of data relating to disciplinary offences and convictions. There is no question here of ‘criminalising’ all disciplinary offences and convictions in a general and abstract manner. The foregoing analysis has shown that the assessment must be made in the light of the circumstances of each individual case and with a view to interpreting Article 10 of the GDPR, which, where there is a ‘register’ of convictions and offences falling within its scope, requires enhanced protection. Moreover, the legal basis for the processing of data relating to such offences and convictions classified as ‘criminal’ may also lie in EU or Member State legislation providing for ‘appropriate safeguards’.

Conclusion on the fifth question

125.

I consider that the Court of Justice should give the following answer to the fifth question: Article 10 of the GDPR must be interpreted as meaning that it may apply to the processing of personal data relating to convictions or offences under national anti-doping regulations, where, irrespective of the classification of those offences under national law, the convictions which they involve have a punitive purpose and have a degree of severity such that they have an effect equivalent to a criminal penalty, a matter which it is for the referring court to ascertain.

The sixth question

126.

If the fifth question is answered in the affirmative, the referring court asks whether the activities or decisions of an authority which has been given responsibility for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures, in accordance with Article 10 of the GDPR, are subject to judicial review.

127.

First, I would point out that the authority at issue is the ‘official authority’ within the meaning of Article 10 of the GDPR, which should not be confused with the ‘supervisory authority’, within the meaning of Article 51 of the GDPR.  ( 81 ) It should also be borne in mind that the processing of personal data relating to criminal convictions and offences is to be carried out only under the control of official authority or when the processing is authorised by EU or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.  ( 82 ) The answer to that question must therefore be linked to the answers to the third and fourth questions, examined below.  ( 83 )

128.

Second, it should be noted that the GDPR does not contain a definition of the concept of ‘official authority’ or ‘control of official authority’ within the meaning of Article 10 of that regulation. It is for the Member States to determine which body exercises the control of an ‘official authority’ where personal data is processed within the meaning of Article 10 of the GDPR. As the Commission states, it cannot be ruled out that more than one service may be considered an ‘official authority’, and it is not necessarily the ‘controller’.

129.

Third, it is true that the wording of Article 10 of the GDPR does not, as such, provide for judicial review of the activities or decisions of that ‘official authority’. That said, the contextual interpretation of that provision argues in favour of such a review if the data subjects wish to assert their rights. Like a number of interested parties, I take the view that the review of acts relating to the processing of personal data, including where that review follows a decision of an official authority within the meaning of Article 10 of the GDPR, must comply with Article 79(1) of the GDPR, even if the referring court does not refer to that provision in its question. Under that provision, without prejudice to any administrative or extrajudicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR, each data subject has the right to an effective judicial remedy where he or she considers that his or her rights under the GDPR have been infringed as a result of the processing of his or her personal data in breach of that regulation. Moreover, as the Finnish Government emphasises, the very existence of an effective judicial review designed to ensure compliance with EU law is of the essence of the rule of law.

130.

Fourth, such an interpretation is confirmed by the objective pursued by Article 10 of the GDPR, namely to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data at issue, is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data.  ( 84 ) An interpretation of Article 10 of the GDPR that excluded, a priori and generally, the activities or decisions of an official authority within the meaning of that provision from any judicial review would run counter to those purposes.

131.

In those circumstances, and in the absence of any further clarification as to the activities or decisions of the official authority in question, I consider that the sixth question should be answered to the effect that Article 10 of the GDPR, read in the light of Article 79(1) of that regulation, must be interpreted as meaning that it must be possible for the activities or decisions of an authority which has been given responsibility under that provision for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures to be subject to judicial review.

The third and fourth questions

132.

By the third and fourth questions, which may be considered together, the referring court asks, in essence, first, whether Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR may be interpreted as precluding an obligation, imposed by national law on national anti-doping bodies, to publish the personal data concerned, namely, in particular, the names of athletes sanctioned for an infringement of the anti-doping rules, the duration of the ban imposed and the reasons for it.

133.

Second, the court asks whether the GDPR requires a case-by-case balancing of the interests involved by the controller before publication or whether the proportionality test provided for by the legislator is sufficient.

Proportionality of the publication in question

134.

In the ADBG, the national legislator provided for the publication of certain data (name of the athlete, duration and reasons for the ban), free of charge,  ( 85 ) for the attention of the federal sports organisation, sports organisations, athletes, other persons (support personnel), competition organisers and the general public, without it being possible to infer health data. It is also provided that the information to be published may be withheld from the general public only if the data subject is a recreational athlete, particularly vulnerable (a minor) or a person who has made a significant contribution to the detection of potential infringements of the anti-doping rules by sharing information or other indications. Unless I am mistaken, the ADBG makes no explicit provision, in such a case, either regarding the indication of the prohibited substance that may be involved, or publication via the internet.

135.

In practice, NADA and the ÖADR implemented that legislation by means of online publication for professional athletes, and in the case of the publication by the ÖADR the prohibited substance in question was mentioned.

–

Preliminary observations and reminder of principles

136.

It should be recalled that the objective pursued by the GDPR, as set out in Article 1 and recitals 1 and 10 thereof, is, inter alia, to ensure a high level of protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, which is enshrined in Article 8(1) of the Charter and Article 16(1) TFEU and is closely linked to the right to respect for private life enshrined in Article 7 of the Charter.

137.

In that regard, the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality.  ( 86 )

138.

In the present case, the publication of the personal data of the athletes concerned is carried out on the basis of a legal obligation imposed on the controllers by national law.  ( 87 )

139.

Accordingly, that data processing may be regarded as falling within the scope of Article 6(1)(c) of the GDPR, which provides that processing which is necessary for compliance with a legal obligation to which the controller is subject is lawful. Given that combating doping could be regarded as the performance of a task carried out in the public interest,  ( 88 ) the processing at issue may also fall within the scope of Article 6(1)(e) of the GDPR. However, it is not necessary to decide which of those conditions of lawfulness is applicable in the present case or whether both apply.  ( 89 )

140.

Article 6(3) of the GDPR stipulates, with regard to both those situations where processing is lawful, referred to in Article 6(1)(c) and (e) of the GDPR, that such processing must be based on EU law or on the law of the Member State to which the controller is subject, and that that legal basis must meet a public interest objective and be proportionate to the legitimate aim pursued.

141.

Similarly, any processing of personal data must, inter alia, comply with the principles set out in Article 5(1) of the GDPR, and in particular the principles of lawfulness and ‘data minimisation’, set out in points (a) and (c) respectively of that provision. According to the principle of minimisation, personal data are to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, which gives expression to the principle of proportionality.  ( 90 )

142.

The questions referred by the national court therefore involve ascertaining whether the national legislation, as the legal basis for the processing at issue, satisfies the requirements arising from those provisions, namely that it meets a public interest objective and is proportionate to the legitimate aim pursued.

143.

In the present case, in the context of combating doping in sport, which is certainly a public interest objective, sanctions are adopted for infringements of the anti-doping rules. In addition, the disclosure to the general public of the personal data at issue pursues two equally legitimate objectives, which were mentioned by the interested parties and by the Austrian Government at the hearing. One aim is to deter athletes from committing infringements of the anti-doping rules and thus to prevent doping in sport. The other aim is to prevent circumvention of the anti-doping rules by informing all persons likely to sponsor or engage the athlete in question that he or she is suspended.  ( 91 )

144.

The referring court must therefore determine whether the national legislation providing for the processing in question, as implemented by NADA and the ÖADR, is appropriate for contributing to the attainment of the public interest objectives which it pursues, and whether it is necessary and proportionate to those objectives, the Court of Justice having jurisdiction to provide it with the necessary guidance on interpretation.

–

The appropriateness of the publication for attaining the objectives pursued

145.

It seems to me that the publication of the data in question may be regarded without too much difficulty as being appropriate for attaining the two objectives pursued.

146.

First, the act of publishing the name of the penalised athlete, together with the reasons for and the duration of his or her suspension, informs the general public that doping does not go unpunished and that it is accompanied not only by sanctions but also by publication of the name of the suspended athlete. That is likely to encourage the public, including athletes, whether professionals or amateurs, to refrain from infringing anti-doping rules, and therefore meets the objective of deterrence and prevention.

147.

Second, the publication of the ban also makes it possible to inform persons who might wish to employ the athlete concerned in any capacity whatsoever in connection with sport that he or she is suspended and is not supposed to perform sporting functions. I would add that associating with a suspended athlete also constitutes a breach of anti-doping rules.  ( 92 ) Such publication may thus help to prevent such infringements from being committed out of ignorance.

148.

On the other hand, I do not see how the reference to the prohibited substance in question, which is not expressly provided for by the national law but is published by the ÖADR, makes it possible to attain the objectives pursued. Neither the objective of deterrence nor that of preventing circumvention of the anti-doping rules require the infringement to be described in such detail.

–

The need for publication in the light of the objectives pursued

149.

In accordance with recital 39 of the GDPR, verifying the need for the processing at issue in the light of the objectives pursued means verifying whether there are any alternative measures that are less restrictive of the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, but just as effective in achieving the objective relied on.  ( 93 )

150.

First, with regard to the objective of deterrence, public disclosure of the names of the athletes concerned does not seem to me to be absolutely necessary in all cases.

151.

Admittedly, deterrence is all the more effective if, particularly in the case of a famous athlete, the sanctions are accompanied by disclosure of his or her name. High-level athletes who enjoy a certain level of recognition have a particular responsibility in that respect, and the disclosure of their names may therefore be all the more relevant in the light of the objective pursued.

152.

However, in the case of professional athletes not covered by the exceptions provided for by the ADBG, national legislation provides for automatic disclosure of their names, the impact of which becomes unlimited through online publication,  ( 94 ) regardless of the particular circumstances relating to individual elements (reputation of the athlete, level of competition, repeat infringements, intentional nature, and so forth). In that regard, I take the view that, by their general nature, the national provisions in question are likely to go beyond what is required to prevent doping through deterrence.

153.

Second, as regards the objective of preventing circumvention of the ban on associating with a suspended person, that involves knowing which athlete is involved. That makes it necessary to disclose the name of the suspended person. In that regard, it is apparent from the request for a preliminary ruling that, according to Paragraph 1(2)(8) of the ADBG, it may constitute an anti-doping infringement for an athlete to have contact with a member of support staff who is the subject of a prohibition or sanction.

154.

That said, the unlimited scope of the publication, linked to it being placed online, seems to me to go beyond what is necessary.  ( 95 )

155.

That objective of avoiding circumvention of the rules appears to apply essentially in the world of sport  ( 96 ) and to those responsible for enforcing penalties or in charge of sports bodies or sports associations. A more restricted dissemination of the identity of the athlete in question would appear, in that context, to achieve the objective in an effective way that is less detrimental to the protection of personal data. Moreover, NADA explained at the hearing that, for certain categories of lower-level athletes, information about the suspension may be provided through the federations.

156.

As regards economic operators or employers outside the world of sport, a more limited publication would certainly not enable them to know that the athlete in question is suspended and that they are prohibited from associating with him or her. However, if such an uninformed person were accused of associating with a suspended person (an athlete or other person), it seems to me that the rules on the burden of proof would make it possible, in that event, to ascertain whether or not that ‘association’ was conscious and intentional.  ( 97 ) Conversely, publishing the suspension online, together with the name of the suspended person in question, seems to me to result in placing the onus on everyone to check whether or not the person with whom they are contracting or associating is suspended. That generalised suspicion, brought about by the online publication of the ‘sports record’, seems to me to go beyond the intended objective.

157.

I would add that the choice of online publication by NADA and the ÖADR is liable to undermine further the right to privacy, in particular since the information may be accessed throughout the world.  ( 98 ) That is also the opinion of the Article 29 Working Party, which highlights the risk that data published online may be used for other purposes or be further processed, both more intrusive.  ( 99 )

158.

In my view, publishing the relevant name, but limited to the relevant bodies and sports federations, accompanied, for example, by pseudonymised publication on the internet, would make it possible to achieve the two objectives pursued in a way that is less prejudicial to the protection of personal data and more consistent with the principle of data minimisation.

159.

I would add that the argument put forward by NADA, based on a comparison with the publication of sanctions in the context of other professions, such as lawyers or health professions, fails to convince me. As the Netherlands Government stated in that regard, publication of the names of suspended lawyers or doctors seems necessary because anyone can be a litigant or a patient, whereas, in the context of doping, it is sufficient for the name of the athlete concerned to be known in sporting circles, by the sports federations concerned, save in specific circumstances to be assessed on a case-by-case basis.

160.

Consequently, I have serious doubts as to the need for the processing at issue in the light of the objectives pursued.

–

Proportionality ‘stricto sensu’, namely balancing the interests at stake

161.

In assessing the proportionality of the processing concerned, it is necessary to weigh up the various rights, freedoms or interests at stake. An objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected, which implies, in the present case, properly balancing the objective of general interest pursued against the rights of the person whose personal data are disclosed.  ( 100 )

162.

I would add that, in the context of the present analysis, regard should be had to the answers that the Court of Justice gives to the second question referred concerning the existence of health data within the meaning of Article 9 of the GDPR and to the fifth question referred concerning data relating to criminal convictions or offences, falling within the scope of Article 10 of the GDPR. Compliance with the principle of ‘minimisation’ of sensitive data within the meaning of Article 9 of the GDPR does not preclude personal data from being disclosed to the public where that disclosure is necessary and proportionate.  ( 101 ) That is so even where the data in question are covered by Article 10 of the GDPR, provided that the legislation authorising the disclosure provides for appropriate safeguards for the rights and freedoms of data subjects.  ( 102 ) That said, as regards data falling within the scope of those two provisions, the interests of the data subjects are of particular importance in balancing the interests involved.  ( 103 )

163.

In the present case, the processing at issue, which includes the online publication of the identity of the athlete concerned, constitutes a significant interference with the fundamental rights to respect for private life and to the protection of personal data and is liable to provoke the disapproval of society and result in the stigmatisation of the data subject. That is, in any event, the ‘digital pillory’ effect intended.

164.

The seriousness of that interference must therefore be weighed against the importance of the objectives pursued by publication.

165.

I note that the referring court’s question concerns publication under the ADBG, as implemented by NADA and the ÖADR, in respect of professional athletes not covered by the exceptions provided for (which concern amateur athletes, vulnerable persons and ‘whistleblowers’). Publication as regards professional athletes consists of publication by name, which is unlimited in scope, since it is disseminated to the general public via the internet, sometimes unlimited in duration, in the case of lifetime bans (which concerns one of the applicants in the main proceedings), systematic and automatic, which, under the ADBG, does not involve any individual assessment of the circumstances.

166.

With all the caution that this aspect of the proportionality review always requires,  ( 104 ) I am inclined to think that the combination of those various elements (reference to a name, unlimited scope, systematic and automatic nature of the publication) is liable, in certain circumstances, to result in an interference with the personal data protection rights of the individuals concerned such that it does not meet the requirements of a proper balancing of the different interests involved.

167.

For example, in the case of a long suspension,  ( 105 ) or even a life ban, of a little-known athlete whose professional sporting life came to an end some time ago, the lawful publication of his or her personal data could, over time, be regarded as excessive in relation to the purposes pursued.

168.

NADA argues that no distinction should be made according to the seriousness or repeated nature of the infringements committed, on the ground that that is taken into account at the penalty stage and has no bearing on publication, which must take place regardless of the circumstances. I am also unconvinced by that argument. Publication meets objectives which, although they form part of combating doping, are specific and involve a balancing of the interests involved, making it possible to take into account the requirements of the GDPR, which are not considered at the stage of the anti-doping penalty.

169.

Accordingly, I take the view that an obligation to publish personal data, such as that resulting from the ADBG and implemented by the ÖADR and NADA, is permissible only in so far as, having regard to the objectives of deterrence and avoidance of circumvention of the anti-doping rules, it remains proportionate, in particular as regards the scope and duration of publication, in the light of the specific circumstances at issue, which it is for the referring court to ascertain.

Context of the balancing exercise

170.

The referring court asks whether the GDPR requires the controller to carry out a case-by-case balancing of the interests involved before publication or whether the proportionality test provided for by the legislator is sufficient.

171.

In the present case, the legislator envisaged predefined situations irrespective of the circumstances of each individual case, referring to the elements of publication and reserving certain exceptions. In so doing, it has already provided a framework for publication and weighed up the interests of the athletes whose personal data are disclosed against the interests connected with combating doping.

172.

I note, however, that, as controllers designated by the national legislature, the national anti-doping bodies at issue (here NADA and the ÖADR) remain, pursuant to Article 5(2) of the GDPR, responsible for implementing the processing and accountable for compliance with the principles of lawfulness and proportionality of that processing, as well as for compliance with the principle of minimisation. They must, moreover, be able to demonstrate that paragraph 1 of Article 5 of that provision has been complied with.

173.

They are also required, under Article 24(1) and Article 25(1) of the GDPR, to implement appropriate technical and organisational measures (such as pseudonymisation), both at the time of the determination of the means of processing and at the time of the processing itself. Those measures, which are to be reviewed and updated where necessary, are designed to implement data protection principles in an effective manner and to integrate the necessary safeguards into the processing, in order to meet the requirements of the GDPR and protect the rights of data subjects.  ( 106 )

174.

I note, moreover, that, in the present case, although the legislature determined the purposes of the processing and, in part, the means of that processing, it was NADA and the ÖADR which, as controllers and the bodies in charge of its implementation, opted for publication via the internet, with the ÖADR also opting for publication of the name of the prohibited substance at issue.

175.

In that context, the answer to the question referred appears to me to be linked to the content and degree of precision of the national law applicable to the controller. It seems to me that the fact that the national legislature has provided for the principle of publication does not relieve the controller of its responsibility to comply with the requirements of the GDPR and to protect the rights of data subjects. That may mean that, in the application of national law, it takes account of circumstances specific to the case.  ( 107 ) Moreover, I note that such a case-by-case balancing exercise is incumbent on it in the present case as regards the publication of data concerning suspended athletes covered by the exceptions mentioned in the ADBG.

176.

Accordingly, I take the view that the abovementioned provisions of the GDPR, while not requiring it in every case, may require the controller to carry out a case-by-case balancing of the interests involved when determining, in particular, the means of processing, including prior to publication. In that regard, account could be taken of factors relating to the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of the data subjects, which may vary in probability and severity.

177.

Neither the argument that such a margin of discretion on the part of the controller is liable to result in discrimination between athletes in comparable situations, nor the risk of arbitrariness, abuse or even corruption, referred to in particular by the Commission and NADA, can justify dispensing with such a case-by-case balancing, which is intended to process personal data in a manner consistent with the GDPR. Such a balancing exercise may in fact prevent the discrimination which might result from applying identical treatment to different situations.

178.

It follows, in my view, that Articles 5 and 6 of the GDPR, read in the light of all the obligations and responsibilities incumbent on the controller, must be interpreted as not precluding a case-by-case balancing of the interests involved by the controller prior to that data processing, or even, in certain circumstances, as requiring such a balancing exercise if it is necessary in order to process personal data in a manner consistent with the GDPR.

Conclusion on the third and fourth questions

179.

In the light of the foregoing, I propose that the Court of Justice reply to the third question to the effect that Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR must be interpreted as precluding an obligation imposed on national anti-doping bodies to publish personal data, such as the names of athletes sanctioned for an infringement of the anti-doping rules, the duration of the ban imposed and the reasons for it (in particular the name of the prohibited substance) where, given the specific circumstances of the case, the requirement for proportionality is not or is no longer met, in particular as regards the scope and duration of the publication, which it is for the referring court to verify.

180.

As regards the fourth question, I propose that the Court of Justice should hold that Articles 5 and 6 of the GDPR, read in the light of all the obligations and responsibilities incumbent on the controller, must be interpreted as requiring the controller to carry out, prior to the processing of data, a case-by-case balancing of the interests involved if that is necessary in order to process personal data in a manner consistent with the GDPR.

The seventh question

181.

To understand the seventh question, it is necessary to recall the context in which it is asked. Even before her personal data had been published on the NADA and ÖADR websites, the applicant YT lodged a complaint with the Austrian data protection authority based on Article 17 of the GDPR, which provides for the right to erasure. The latter authority rejected YT’s complaint, as the data in question had not yet been published. Those data were subsequently published in the course of the appeal proceedings against the rejection of her complaint by the Austrian data protection authority.

182.

By its seventh question, the referring court asks, first, whether a complaint under Article 77 of the GDPR concerning an alleged infringement of the right to erasure (Article 17 of the GDPR) is admissible even though the personal data relating to the data subject had not yet been processed at the time when the complaint was lodged with the supervisory authority or at the time when that authority took a decision.

183.

Second, it questions the admissibility of such a complaint a posteriori if, at the time the complaint was lodged, there were already specific indications that an operation involving the processing of personal data by the controller was imminent or would take place in the near future.

Is a complaint to the supervisory authority prior to data processing admissible?

184.

Article 77(1) of the GDPR provides that every data subject has the right to lodge a complaint with a supervisory authority ‘if the data subject considers that the processing of personal data relating to him or her infringes this Regulation’.

185.

In accordance with the settled case-law of the Court of Justice, when interpreting that provision, I will consider not only its wording but also its context and the objectives pursued by the legislation of which it forms part.  ( 108 )

186.

First, the wording of Article 77 of the GDPR does not impose a time limit for lodging a complaint regarding the processing of personal data. In cases where processing has taken place and is subsequently challenged, the sooner the complaint is lodged, the more quickly the authority can carry out checks and the sooner the data subject can be protected.  ( 109 ) However, the wording of Article 77(1) of the GDPR does not provide for the situation where processing has not yet taken place. I note, in that regard, that that provision uses the word ‘infringes’ in the present tense, which seems to imply that the processing must already have taken place, but that the possibility of future processing is not, as such, excluded.  ( 110 )

187.

Second, as regards the contextual element, reference should be made to the tasks and powers of the supervisory authorities. In that regard, under Article 57(1)(f) of the GDPR, each supervisory authority is required to handle complaints lodged by any data subject, to investigate, to the extent appropriate, the subject matter of the complaint and to inform the complainant of the progress and the outcome of the investigation within a reasonable period. The supervisory authority must therefore deal with such a complaint ‘with all due diligence’.  ( 111 )

188.

Moreover, Article 58(1) of the GDPR gives each supervisory authority significant investigative powers for the purpose of handling complaints lodged. Where, following its investigation, such an authority finds an infringement of the provisions of that regulation, it is required to react appropriately in order to remedy the shortcoming found. To that end, Article 58(2) of the GDPR lists the various remedies that the supervisory authority may adopt, and in that regard the authority has a margin of discretion as to the choice of appropriate and necessary means.  ( 112 ) The powers of the supervisory authority laid down in Article 58(2)(a) of the GDPR include the power to ‘issue warnings’ to a controller that ‘intended’ processing operations are ‘likely’ to infringe provisions of the GDPR, which forms part of an approach that may be described as ‘protective’ of the rights of the data subject.  ( 113 )

189.

All those requirements and powers of the supervisory authorities are intended to strengthen the complaints procedure in order to make it a mechanism capable of effectively safeguarding the rights and interests of data subjects, or, in other words, ‘a genuine administrative remedy’.  ( 114 )

190.

As regards the contextual elements, it should also be noted that, as the Commission points out, the controller must fulfil certain obligations, including informing the data subject before processing.  ( 115 )

191.

It therefore seems to me that a precautionary or preventive approach by the supervisory authorities in handling complaints cannot, a priori, be ruled out in the context of the GDPR.

192.

Third, that interpretation is confirmed by the objectives pursued by that regulation. It is apparent in particular from recital 10 thereof that that regulation seeks to ensure a high level of protection for natural persons with regard to the processing of personal data within the European Union. Recital 11 of that regulation states, moreover, that effective protection of such data requires the strengthening of the rights of data subjects.

193.

Restricting the duty of supervisory authorities to handle complaints under Article 57(1)(f) of the GDPR by interpreting Article 77(1) of the GDPR as excluding any possibility of lodging a complaint with a supervisory authority ‘with a view to processing’ could be at odds with the objectives of the GDPR, in particular the objective of ensuring a high level of protection of natural persons with regard to the processing of personal data within the European Union.

194.

I therefore consider, in the light of all those considerations, that it cannot be ruled out that a complaint made under Article 77 of the GDPR may be admissible, despite the fact that the processing of the data subject’s personal data has not yet taken place at the time the complaint is lodged with the supervisory authority.

195.

However, I agree with the Commission and the Austrian Government that the alleged infringement of the GDPR must be appropriate and that the processing concerned, which in the present case is the publication of personal data, cannot be purely hypothetical.  ( 116 )

196.

In the present case, the Court of Justice has received a request, based on Article 17 of the GDPR, concerning a complaint seeking the erasure of the data at issue, in which the applicant in the proceedings concerned (YT) has stated that the publication of her data was ‘almost certainly imminent’.

197.

However, a complaint seeking the erasure of those data (like a request for rectification of the data) presupposes, under the assumption made, that the processing in question, in the present case the publication of the data, has taken place. It would appear to be impossible for the controller to act on such a complaint and to erase data if they have not yet been disclosed, unless the complaint is interpreted as seeking to prevent the publication of the complainant’s data  ( 117 ) (and not to erase them), a matter which it is for the national court to determine.

198.

I would add that such an interpretation does not run counter to the objectives of ensuring a high level of protection of personal data, since other provisions of the GDPR make it possible to respond to requests concerning future processing. As the Austrian Government states, Article 79(1) of the GDPR, concerning the right to an effective judicial remedy, implies the existence, under national law, of procedural actions in the event of a threat of imminent unlawful interference with the rights conferred by the GDPR. That includes the possibility under Austrian law of applying for injunctive relief before the start of processing or even, if processing has started, the possibility of asking the Austrian authority to review the restriction of that processing on the basis of Article 18 of the GDPR.

199.

Accordingly, I take the view that it cannot be ruled out that a complaint made on the basis of Article 77 of the GDPR may be admissible, despite the fact that the processing of the data subject’s personal data has not yet taken place at the time the complaint is lodged with the supervisory authority, but is not purely hypothetical. However, in the circumstances of the dispute in the main proceedings, the complaint, based on the right to erasure provided for in Article 17 of the GDPR, is inadmissible since it concerns a processing operation (in the present case the publication of the data subject’s personal data) which, even if imminent, did not exist either at the time when that person lodged his or her complaint with the supervisory authority or at the time when the decision of that supervisory authority was adopted.

Does a complaint to the supervisory authority become admissible ‘a posteriori’?

200.

I note that that question concerns the interpretation of Article 77 of the GDPR, relating to the right to lodge a complaint with the supervisory authority. It therefore seems that the referring court is asking whether such a complaint, having been declared inadmissible, could become admissible a posteriori before the supervisory authority if the processing at issue (here the disclosure of the data) takes place while an appeal against the decision of that supervisory authority is pending before the appeal court. It seems to me that, in this respect, it is for the domestic legal system to settle the question whether the appeal court could, or even should in such a situation, refer the matter back to the supervisory authority for reconsideration in the light of new facts, whether it is for the data subject to lodge a fresh complaint or whether the appeal court may itself rule on the situation before it in the light of new factual elements consisting, in the present case, in the publication of the data. In that regard, care should be taken to ensure the effective protection of the rights guaranteed by the GDPR and the consistent and homogeneous application of its provisions.

201.

In so far as the question referred by the national court should be understood, as the Austrian Government understood it, as referring to the admissibility of such a complaint before the court hearing the appeal, in such a case it is necessary to examine the consequences of the effects linked to a factual change, namely the processing, consisting in the publication of personal data, occurring after the decision of the supervisory authority and while judicial remedy, sought on the basis of Article 78 of the GDPR, is pending against that decision, in the event that, at the time of the complaint, there were specific indications that the processing of personal data by the controller was imminent or would take place in the near future.

202.

It should be remembered that, in the context of the GDPR, the EU legislator has offered different remedies to persons claiming that that regulation has been infringed, it being understood that each of those remedies must be capable of being exercised ‘without prejudice’ to the others.  ( 118 )

203.

Thus, Article 78(1) of the GDPR provides that, without prejudice to any other administrative or non-judicial remedy, any natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. It follows that courts seised of an action against a decision of a supervisory authority should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them.  ( 119 ) For the judicial review of a decision on a complaint taken by a supervisory authority to be ‘effective’, as required by that provision, it must be a full judicial review.  ( 120 ) In addition, Article 79(1) of that regulation guarantees each data subject the right to an effective judicial remedy ‘without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77’.

204.

It is true that it has previously been held that, by adopting the GDPR, the EU legislature did not intend to bring about an exhaustive harmonisation of the remedies available in respect of infringements of the provisions of the GDPR, provided for in Articles 77 to 79 of that regulation.  ( 121 ) In particular, where a complaint has been made to a supervisory authority and judicial proceedings have been brought within the same Member State concerning the same instance of processing of personal data, the GDPR does not provide for specific rules.

205.

However, although the EU legislature did not intend to achieve exhaustive harmonisation in that regard, it did not wish to exclude the possibility mentioned in the question referred by the national court, that is to say, to admit a posteriori a complaint lodged in circumstances such as those of the dispute in the main proceedings.

206.

In the absence of EU rules governing the matter, it is therefore for each Member State, in accordance with the principle of procedural autonomy of the Member States, to lay down the detailed rules of administrative and judicial procedures intended to ensure a high level of protection of rights which individuals derive from EU law. In that context, it is for the national court to ensure the effective protection of the rights guaranteed by the GDPR and the consistent and homogeneous application of that regulation, in addition to the right to an effective remedy before a court or tribunal as referred to in Article 47 of the Charter.  ( 122 )

207.

Accordingly, it is for the national court to determine, on the basis of the national procedural provisions, how the remedies provided for by the national regulations are to be implemented in each case. In that regard, it must ensure that the practical arrangements for the exercise of the remedies do not disproportionately affect the right to an effective remedy before a court or tribunal. It must also ensure the effective protection of the rights guaranteed by the GDPR, and that those arrangements comply with the principles of effectiveness and equivalence.  ( 123 )

208.

In the absence of any clarification from the referring court as to the possibilities offered by its national law, it is therefore necessary, in my view, to hold that Article 77(1) of the GDPR, examined in the light of Article 78(1) of that regulation, must be interpreted as not precluding the admissibility of a complaint previously rejected as inadmissible by the supervisory authority, where the data processing takes place while judicial proceedings relating to the same facts are pending before the court. It is for the domestic legal system to regulate, in compliance with the principles of equivalence and effectiveness, the conditions for such admissibility, both before the supervisory authority and before the courts, so as to ensure the effective protection of the rights guaranteed by the GDPR, the consistent and homogeneous application of its provisions in addition to the right to an effective remedy before a court or tribunal.

Conclusion on the seventh question

209.

In the light of all the foregoing considerations, I propose that the Court of Justice should reply to the seventh question as follows: Article 77 of the GDPR must be interpreted as meaning that a complaint based on Article 17 of that regulation (alleged infringement of the right to erasure) is inadmissible where it concerns the processing by means of publication of the data subject’s personal data which, even if imminent, did not exist either at the time the complaint was lodged by that data subject with the supervisory authority, or at the time when the decision of that authority was adopted, without prejudice, however, to the possible admissibility of a complaint concerning the processing of personal data which is not purely hypothetical and which lends itself to preventive or precautionary action by the supervisory authority.

210.

Furthermore, examined in the light of Article 78(1) of the GDPR, Article 77 of the same regulation does not preclude the admissibility of a complaint previously rejected as inadmissible by the supervisory authority, where the data processing takes place while judicial proceedings relating to the same facts are pending before the court. It is for the domestic legal system to regulate, in compliance with the principles of equivalence and effectiveness, the conditions for such admissibility, both before the supervisory authority and before the courts, so as to ensure the effective protection of the rights guaranteed by the GDPR, the consistent and homogeneous application of its provisions, in addition to the right to an effective remedy before a court or tribunal.

Conclusion

211.

In the light of all of the foregoing, I propose that the Court of Justice reply as follows to the questions referred for a preliminary ruling by the Bundesverwaltungsgericht (Federal Administrative Court, Austria):

–

a complaint based on Article 17 of Regulation 2016/679 (alleged infringement of the right to erasure) is inadmissible where it concerns the processing by means of publication of the data subject’s personal data which, even if imminent, did not exist either at the time the complaint was lodged by that data subject with the supervisory authority, or at the time when the decision of that authority was adopted, without prejudice, however, to the possible admissibility of a complaint concerning the processing of personal data which is not purely hypothetical and which lends itself to preventive or precautionary action by the supervisory authority;

–

examined in the light of Article 78(1) of Regulation 2016/679, it does not preclude the admissibility of a complaint previously rejected as inadmissible by the supervisory authority, where the data processing takes place while judicial proceedings relating to the same facts are pending before the court. It is for the domestic legal system to regulate, in compliance with the principles of equivalence and effectiveness, the conditions for such admissibility, both before the supervisory authority and before the courts, so as to ensure the effective protection of the rights guaranteed by Regulation 2016/679, the consistent and homogeneous application of its provisions, in addition to the right to an effective remedy before a court or tribunal.