Tietosuojavaltuutetun toimisto (Finland) - TSV/179/2021
Finland's DPA reprimands a controller for GDPR violations regarding athlete suspension lists.
Finland's Data Protection Authority (DPA) issued a reprimand to a controller for GDPR violations related to publishing a list of suspended athletes. The DPA found that the controller improperly processed personal data, lacked a valid legal basis for publication, and violated principles of lawfulness, fairness, transparency, and data minimization. The decision referenced a CJEU ruling confirming GDPR applicability to anti-doping infringements.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Tietosuojavaltuutetun toimisto?
Get an email when a new story names Tietosuojavaltuutetun toimisto, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Finnish controller published a list of suspended athletes without a valid legal basis, violating core GDPR principles including lawfulness, fairness, transparency, and data minimization. The root cause was a failure to establish and verify an appropriate legal basis before publicly disclosing personal data — a foundational requirement under GDPR Article 6. This case is significant because it confirms that anti-doping infringement data falls within GDPR's scope, as affirmed by a CJEU ruling, meaning sports organizations cannot assume special exemptions apply. Publishing more personal data than necessary, and without proper justification, exposes both the individuals affected and the organization to serious legal and reputational consequences. Controllers must treat public disclosures of personal data with the same rigor as any other high-risk processing activity.