DATA PROTECTION OF ATHLETES IN FRANCE
In sport, large volumes of personal data are routinely processed, and such data includes sensitive information on athletes’ performances and their health.
In France, athletes’ data is legally protected under the European Union General Data Protection Regulation (GDPR) and national data protection legislation, especially Law No. 78-17 of 6 January 1978, as amended, and its implementing Decree of 29 May 2019, and subject to the strict oversight of the Commission nationale de l’informatique et des libertés (CNIL).
Health and disability-related data of athletes is regarded as “special categories of personal data” under Article 9(1) GDPR.
In principle, all data of athletes is prohibited from being used in France, unless it is strictly justified and supported by explicit consent pursuant to Article 9(2) GDPR. This applies particularly using personal data for classifying Paralympic athletes.
The CNIL issued Guidance on 14 May 2024 for sports bodies on the collection of data regarding athletes’ disability, emphasising the principles of data minimisation and purpose limitation. Only data that is strictly necessary for performance optimisation, competition management, or regulatory compliance may be collected.
Robust security measures, which are reflected in the CNIL Guidance, are also in place to ensure the confidentiality and integrity of such information. Furthermore, the Guidance emphasises that compliance with Article 6 GDPR is insufficient in itself, thereby reinforcing the stricter regime applicable to sensitive data.
Particular attention is also given to anti-doping frameworks. The Agence française de lutte contre le dopage (AFLD) operates under a dedicated data protection policy governing the collection, use and sharing of personal data in connection with anti-doping controls. This policy aims to reconcile the effectiveness of anti-doping programmes with the protection of athletes’ privacy.
In practice, the processing of sensitive data—such as biological samples and whereabouts information—is subject to strict safeguards, including limited access on a need-to-know basis, secure handling, and controlled sharing with other anti-doping organisations, which are bound by equivalent standards.
Data retention is also regulated, with defined periods which may be extended, where necessary, for investigative or disciplinary purposes.
Athletes retain the full range of rights under the GDPR, including the rights of access, rectification, erasure, and objection. These rights constitute essential safeguards against disproportionate or opaque data practices in an increasingly data-driven sports environment.
More broadly, recent European initiatives emphasise that the protection of athletes’ data must be understood within a wider framework of fundamental rights in sport, including privacy, health, dignity, non-discrimination, and effective remedies. As highlighted in the H.E.R.O. Roadmap for the Protection, Respect and Promotion of the Human Rights of Athletes in Sport in Europe, sports governance is increasingly expected to align with international human rights standards.
At the European Union level, particular mention should be made of the judgment of 4 October 2024 of the Court of Justice of the European Union (CJEU) in the case of Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens (Case C-621/22), in which the CJEU clarified that a commercial interest may, in principle, constitute a “legitimate interest” under Article 6(1)(f) of the GDPR.
However, such processing remains subject to strict conditions: it must be strictly necessary, comply with the principle of data minimisation, and not override the fundamental rights and freedoms of data subjects.
We advise athletes and sports organisations on sports data matters in France, including disputes, and further information is available by emailing our Managing Partner, Dr Lucien Valloni, or our International Sports Law Consultant, Prof Dr Ian Blackshaw, at valloni@valloni.ch and blackshaw@valloni.ch respectively.