Finland DPA Reprimands Controller for Unlawful Publication of Suspended Athletes' Personal Data
Written by AI from the linked story. Not reviewed by an editor. How this works
A Finnish controller published a list of suspended athletes without a valid legal basis, violating core GDPR principles including lawfulness, fairness, transparency, and data minimization. The root cause was a failure to establish and verify an appropriate legal basis before publicly disclosing personal data — a foundational requirement under GDPR Article 6. This case is significant because it confirms that anti-doping infringement data falls within GDPR's scope, as affirmed by a CJEU ruling, meaning sports organizations cannot assume special exemptions apply. Publishing more personal data than necessary, and without proper justification, exposes both the individuals affected and the organization to serious legal and reputational consequences. Controllers must treat public disclosures of personal data with the same rigor as any other high-risk processing activity.
Tactical Insight
Immediate actions
- Audit all existing public-facing publications of personal data to verify a documented and valid legal basis exists for each.
- Remove or restrict access to any published personal data where a lawful basis cannot be confirmed until a full legal review is completed.
Policy & Governance improvements
- Implement a mandatory Privacy Impact Assessment (PIA) process that must be completed before any personal data is published publicly.
- Establish a data minimization checklist requiring review of whether each data field in a publication is strictly necessary for the stated purpose.
- Define and document internal approval workflows requiring Data Protection Officer (DPO) sign-off prior to public disclosure of personal data.
Training & Awareness measures
- Train all staff involved in communications and publishing on GDPR legal bases (Article 6) and the specific risks of public data disclosure.
- Conduct annual GDPR compliance refresher sessions that include real-world enforcement cases to reinforce accountability.