CJEU: companies that publish online criminal convictions for a fee cannot automatically avoid GDPR by invoking journalism

Online databases that make available to the public, for a fee, decisions regarding criminal convictions cannot be automatically treated as journalistic activity and cannot be exempted from GDPR protections merely by invoking freedom of expression. The Court of Justice of the European Union has established that individuals whose data regarding criminal convictions are published online must be able to use the remedies provided by GDPR, not just procedures for defamation.

In short

The CJEU ruled in case C-199/24, Legal Newsdesk Sweden. The case concerns the Swedish database Lexbase, which allowed searches about individuals involved in criminal proceedings. A person convicted in 2011 requested the deletion of their data and then compensation based on GDPR. The court states that member states cannot exclude GDPR for processing that is not journalistic, academic, artistic, or literary. The paid publication of conviction decisions is not journalism if it does not aim to inform the public through verification, editorial selection, and professional rules.

The case originated in Sweden, where the company Legal Newsdesk Sweden managed the Lexbase database. The service allowed searches about individuals and companies that had been involved in proceedings before Swedish courts and provided access to conviction decisions.

A man convicted in 2011 requested the deletion of his data from Lexbase. The decision regarding his conviction remained accessible until February 2024 and was subsequently deleted based on the company's internal storage policy. The man then sought compensation of 300,000 Swedish crowns, approximately 26,000 euros, citing a violation of GDPR.

The company argued that the database benefits from constitutional protection in Sweden regarding freedom of expression. According to the Swedish court that referred the questions to the CJEU, this protection could exclude the application of GDPR and leave the individual concerned only the possibility of initiating criminal or civil proceedings for defamation.

The CJEU rejects this approach. The court states that Article 85 of GDPR obliges member states to reconcile the protection of personal data with freedom of expression and information, but derogations from GDPR are only permitted within the expressly provided limits for journalistic, academic, artistic, or literary purposes.

Member states cannot use freedom of expression to create general derogations from GDPR when the data processing does not pursue these purposes. The court clarifies that derogations must be interpreted strictly, as they reduce the protections offered to the individuals concerned.

The ruling is important for commercial databases that republish judicial documents. Data about criminal convictions benefits from special protection under GDPR. Their processing must be done under the control of an official authority or based on a law that provides adequate guarantees for the rights of the individuals concerned.

The CJEU also states that member states cannot deprive individuals of the remedies provided by GDPR. An individual must be able to file a complaint with a supervisory authority, challenge the decisions of that authority, seek an effective judicial remedy against the operator or authorized person, and request compensation for the harm suffered.

Limiting protection to actions for defamation is not sufficient. A defamation action examines whether the published information has affected a person's reputation. GDPR also concerns other issues: the legality of processing, the duration of data retention, the right to deletion, the proportionality of publication, and the protection of sensitive data.

The court also clarifies what "journalistic purposes" means. The notion must be interpreted broadly, but it does not include any publication of data on the internet. The activity must aim to inform the public or convey opinions or ideas, respecting the ethical and professional rules of journalism.

The CJEU states that journalistic activity involves editing or adapting, or at least an editorial policy. The facts presented must be verified. Data processing can be journalistic even when it occurs online or for a fee, but payment and publication on the internet are not sufficient to automatically transform a database into journalistic activity.

In the case of Lexbase, the court states that the mere online provision, for a fee, of public documents regarding criminal convictions does not seem to meet these conditions. The final verification belongs to the Swedish court, but the CJEU indicates that access for a fee to criminal decisions, without editing, adaptation, editorial policy, and journalistic verification, cannot be considered data processing for journalistic purposes.

The ruling does not prohibit journalism about criminal cases and does not exclude the publication of judicial information of public interest. It separates, however, journalism, which involves selection, verification, and editorial responsibility, from a commercial service that provides judicial documents about individuals, for a fee.

The decision is binding for the Swedish court handling the case and for other national courts faced with similar issues. The Swedish court will have to resolve the dispute in accordance with the interpretation given by the CJEU.