Not Every Body Data Is Health Data: The EU Court's Wake-Up Call

When Is a Body Swab Not Health Data?

Imagine you're an athlete, and your federation publishes a doping ban. Is that your health data? Not necessarily, says the EU Court of Justice in case C-474/24. The ruling clarifies that data about your body only becomes 'health data' when it's used in a health context. This is a game-changer for sports, digital health, and even e-commerce.

Featured Snippet Bait: The EU Court ruled that publishing anti-doping sanctions is health data only if the context reveals health information. Otherwise, it's just a disciplinary measure. Context is king.

The Case: Anti-Doping Sanctions Under the Microscope

A German athlete challenged the publication of his doping ban, arguing it violated GDPR as health data. The Court disagreed: a ban for a prohibited substance doesn't automatically reveal a health condition. It's like getting a parking ticket—it says you parked illegally, not that your car is broken.

But if the sanction mentions a specific illness or treatment, then it's health data. The key is whether the information, combined with context, discloses health status. This aligns with the GDPR's contextual approach—data isn't inherently sensitive; its use makes it so.

Why This Matters Beyond Sports

Think about fitness apps, smartwatches, or even e-commerce sites that infer health from purchase data. If you buy vitamins, is that health data? Not automatically. But if the seller uses that to infer you're pregnant and targets ads, that inference becomes health data. The Court's logic applies broadly: the purpose and context determine sensitivity.

For companies, this means you can't just label data as 'health' or 'non-health' upfront. You need to assess each use case. It's like deciding if a banana is a fruit or a weapon—it depends on whether you're eating it or throwing it.

Practical Guidelines for Data Handlers

Contextual analysis: Always evaluate the purpose and surrounding information. A step count is not health data; a step count used to diagnose a condition is.
Inference governance: If you derive health insights from non-health data, treat those inferences as health data. Document your reasoning.
Transparency: Tell users when their data is used for health inferences. No one likes surprises, especially about their body.

For more details, read the full judgment on EUR-Lex.

FAQ

Does this ruling apply only to athletes?

No. The principle applies to any personal data that could reveal health information. The context determines sensitivity, not the data type.

Can I still use fitness data for marketing?

Yes, but if you infer health conditions (e.g., pregnancy, illness), those inferences become health data and require explicit consent or a lawful basis under GDPR.

What should companies do now?

Review all data processing that involves body-related data. Map out contexts and inferences. Update privacy policies and consent mechanisms accordingly.

Context Check: Is Your Data Health Data?

Use this checklist to evaluate if body-related data becomes health data under the EU Court's ruling.

Is the data about a physical or mental state? (e.g., weight, heart rate)
Is the data used to infer a health condition? (e.g., pregnancy, disease)
Is the data combined with medical context? (e.g., doctor's notes)
Is the data published in a health-related setting? (e.g., hospital, fitness app)
Does the data reveal a specific illness or treatment?

If you checked any box after the first, the data likely qualifies as health data. Context is everything.