1. Article 2(2)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with the first sentence of Article 16(2) TFEU,

must be interpreted as meaning that processing of personal data consisting in the publication, pursuant to national anti-doping rules, of the names of athletes sanctioned for infringing those rules, the sports discipline practised by them, the infringement of those rules that has been committed, the sanction imposed on those athletes, and the start and end dates of that sanction, comes within the scope of EU law and, accordingly, within the scope of that regulation.

1. Article 2(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and Article 9(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

must be interpreted as meaning that that regulation applies to the activity carried out by the directorate of a public authority, consisting in storing in the personnel file of one of its officers data relating to his status as a suspect in a criminal investigation. It is irrelevant in that regard that that directorate obtained those data through another directorate belonging to the same public authority, the latter directorate being empowered to conduct that type of investigation.

The activities of a committee of inquiry set up by a Member State parliament to scrutinise the executive are not, as such, activities concerning national security outside EU law, even where the committee is investigating a police State-protection authority because of suspected political influence over it.

Under Article 2(2)(d) and Article 23 of Regulation (EU) 2016/679, the GDPR applies to the personal-data processing envisaged by national legislation transposing Directive 2004/82, Directive 2010/65 and Directive (EU) 2016/681, as regards: (i) processing by private operators; and (ii) processing by public authorities covered, solely or in addition, by Directive 2004/82 or Directive 2010/65. It does not apply to processing envisaged by that legislation where the processing is covered only by Directive (EU) 2016/681 and is carried out by the passenger information unit (PIU) or by the authorities competent for the purposes referred to in Article 1(2) of that directive.