By Antonia Gold & Krishan Neelendra
Shayna Jack and a One-Way Street
Do you remember the story of Shayna Jack?
In 2019, after returning a positive drug test, the Australian sprint swimmer was sent home from the 2019 World Aquatics Championships in Gwangju. The banned substance in question was Ligandrol, a substance which helps to repair and build muscles. Shayna insisted from the outset, that she had never knowingly and deliberately taken it. Following this, Shayna was vilified by the tabloid press, ostracised by sections of the athletics community, and trolled online. When the Court of Arbitration for Sport later accepted that her ingestion of this substance was not intentional, and halved her four-year ban, her name was already fixed online as an athlete who had doped, and there it stayed. There is often little space for nuance online.
Shayna’s experience illustrates a persistent tension within anti-doping disclosure regimes: publishing doping violations has long been treated as a one-way street. The Court of Justice of the European Union (CJEU) reviewed this practice in Case C-474/24, NADA Austria and Others. It held that processing an individual’s personal data for the purpose of making a public disclosure about a doping violation must be undertaken proportionately in compliance with the General Data Protection Regulation (GDPR). As a result, disclosers must look beyond the violation to the individual affected by it, when assessing how (including how long) doping violations are disclosed, and how long their names should remain on the suspension list.
Deterrence vs. Privacy: the Code Scrutinised
Article 14.3.2 of the 2021 World Anti-Doping Code requires public disclosure of anti-doping violations, including details of the violations: who violated the code, how they violate it, which sport they participated in, and how they will be sanctioned. As the CJEU acknowledged in NADA Austria, such disclosures serve a number of important objectives. For example, they help to safeguard fairness, competitiveness and equal opportunity, and help to uphold ethical values within sport. They are also an important means of deterring athletes from infringing anti-doping rules, thereby serving to strengthen the sanctions imposed.
Despite these objectives, the CJEU held that the public disclosure of a doping violation “entails a serious interference with the fundamental rights to respect for private life and to the protection of personal data.”[1]
This interference, as the CJEU recognised, is relevant because anti-doping publications are freely accessible to a potentially unlimited audience, and the information may continue circulating online even after the original publication has been removed. Social media has allowed fans to engage with athletes, teams, and competitions more easily than ever and created an online environment in which athletes’ conduct, performance and decision-making are subject to rapid, widespread and often highly polarised online commentary. In a social media environment that is more likely to amplify negative coverage of athletes[2], the impact on athletes of doping violation disclosures can last long after a ban has run its course, and stretch far beyond the confines of the sporting arena. One sanctioned athlete captured this lasting impact starkly, recalling that “now I have an indelible stamp which is still a problem today to get a new job.”[3]
What This Means for Public Disclosures of Doping Violations
When considering the potential impact of sanction disclosures on athletes, the CJEU held in NADA Austria that doping disclosures are not a world unto itself when it comes to processing personal data, they must comply with the GDPR. Therefore, the key objectives underpinning doping violation disclosures do not displace the requirements mandated by the GDPR. Athletes, including those found to have committed anti-doping violations, remain data subjects under the GDPR and are entitled to the protections afforded by that legislation. As a result, when processing personal data in order to publish this information, such personal data must be processed lawfully, fairly and in a transparent manner in relation to the athlete, and such processing must be adequate, relevant and limited to what is necessary.
When considering how, what and for how long to disclose a doping violation, the GDPR requires the discloser to undertake a case-by-case assessment of whether the particular information disclosed, the persons receiving it and the period of availability are genuinely necessary for the objective pursued. This assessment should also consider the seriousness of the violation and the athlete’s profile. The CJEU held that:
- The longer the publication period, the greater the impact on the athlete, the stronger justification needed to satisfy the proportionality assessment, especially where the publication is accessible to a potentially unlimited number of addressees.
- Publication of doping violations for a period exceeding the period during which the sanctions in question apply would likely be disproportionate to the importance of the objective pursued.
- Publication of a doping violation, which extends materially beyond the point at which an athlete becomes too old to compete within a sport, is likely disproportionate.
NADA Austria signals that the CJEU is no longer prepared to treat the integrity objectives of disclosure regimes as a trump card against the individual athlete’s rights under the GDPR. The same logic is not confined to doping; for example, organisations that maintain public registers or make public disclosures about match-fixing sanctions may face the same proportionality question the CJEU has now put to anti-doping regulators.
More broadly, modern sport has become increasingly data-driven. Athletes’ performances are dissected frame by frame, their physical capabilities measured in ever greater detail, and their conduct scrutinised both on and off the field of play. In many respects, athletes are expected to accept an extraordinary level of transparency about their performance, behaviour, health and bodies. NADA Austria is a timely reminder that, in this environment, athletes do not leave their privacy and data protection rights at the turnstiles. They remain entitled to the protections afforded by the GDPR, and even the unique demands of professional sport must operate within the framework of data protection law.
[1]NADA Austria and Others, Case C-474/24, ECLI:EU:C:2026:579 (July 14, 2026), https://infocuria.curia.europa.eu/tabs/document/C/2024/C-0474-24-00000000RP-01-P-01/ARRET/323684-EN-1-html.
[2]Joe Watson et al., Negative Online News Articles Are Shared More to Social Media, 14 Sci. Rep., art. 21592 (2024) (finding that social media users are 1.91 times more likely to share links to negative news articles than to positive ones).
[3]Isaac Lockett et al., From Violation to Stigma: A Literature Review of Athletes’ Lived Experiences Following Anti-Doping Sanctions, 8 Frontiers Sports & Active Living (2026).
