Alessandro Del Ninno
News
Court of Justice of the EU: the mere online publication, for a fee, of criminal convictions does not constitute the processing of personal data for journalistic purposes.
DATA PROTECTION
12/07/2026

A Swedish company operates, for a fee, a database that allows users to search for individuals who have been charged in criminal proceedings and to view the convictions relating to them. An individual, convicted in 2011, requested the erasure of their personal data from that database. However, the erasure only took place at a later date, in accordance with the company’s internal data retention policy. The individual in question therefore brought a claim for damages before the Swedish courts under the General Data Protection Regulation (GDPR). In its defence, the company invoked the constitutional protection afforded to the database by virtue of freedom of expression. Under Swedish law, that protection precludes the application of the GDPR and leaves the data subject with no option but to bring an action for defamation, whether in criminal or civil proceedings, in order to assert their rights.

Having doubts as to the compatibility of that legislation with the GDPR, the Swedish court referred the matter to the Court of Justice. In its judgment, the Court notes that the GDPR provides that the law of the Member States must reconcile the protection of personal data with freedom of expression and information, including for journalistic purposes or for academic, artistic or literary expression. Member States may provide for exemptions and derogations from certain provisions of the GDPR where this is necessary to enable such reconciliation. However, Member States may not exclude the application of the GDPR to data processing for purposes other than those set out above. Nor may they deprive the data subject of the remedies guaranteed by the GDPR, leaving them only with the option of bringing criminal or civil proceedings for defamation. Indeed, that person must be able to exercise, in relation to the processing of their personal data, the remedies conferred on them directly by that regulation.

According to the Court, personal data is processed for ‘journalistic purposes’ where such processing is intended to inform the public or to share opinions or ideas, the content is prepared in accordance with professional or ethical standards and is the subject of editorial work or adaptation, or, at the very least, forms part of an editorial line. The facts presented must have been verified.

The online publication, for a fee, of criminal convictions does not appear – subject to verification by the national court – to satisfy these conditions and, therefore, cannot be regarded as serving such a journalistic purpose.