EU court draws line between journalism and paid criminal record databases

(CN) — Selling access to people’s criminal records does not become journalism simply because a company says it is, Europe’s highest court ruled Thursday.

ND, convicted of a criminal offense in Sweden in 2011, has spent years trying to have that judgment removed from Lexbase, a searchable database operated by Legal Newsdesk Sweden. He is seeking 300,000 Swedish krona, about $31,000, in damages, arguing the company violated the European Union’s privacy law by refusing to erase his personal data.

The Court of Justice of the European Union said Sweden cannot rely on constitutional free-expression protections to take away the remedies guaranteed by the General Data Protection Regulation, the EU’s privacy law adopted in 2016. While the regulation allows countries to accommodate journalism, art, literature and academic expression, those exceptions have limits.

One of them, the judges said, is that governments cannot invent broader exemptions than EU law itself provides. As the court put it, the law “merely states that member states are by law to reconcile the right to protection of personal data pursuant to that regulation with the right to freedom of expression and information, without providing that that reconciliation may result in the adoption of exemptions or derogations from that regulation.”

Sweden has embraced government transparency for more than 250 years. Its 1766 Freedom of the Press Act, widely considered the world’s first freedom of information law, established a constitutional tradition of public access to official documents that still shapes the country today. Court judgments and many other official records are generally public. Over time, that openness has helped fuel businesses that collect court decisions and other personal information, then sell searchable access online.

Lexbase is one of them. Legal Newsdesk argued that Lexbase was covered by a Swedish publication certificate, known as an utgivningsbevis, which gives certain publications constitutional protection for freedom of expression. Under Swedish law, that largely shut off the ordinary remedies available under the GDPR, leaving people like ND largely limited to defamation claims.

The judges disagreed. Holding a publication certificate, they said, is not enough on its own to keep a publisher outside the GDPR or prevent people from using the regulation’s ordinary remedies.

The court also declined to say that paid databases can never qualify as journalism. Charging users, publishing online or handling criminal conviction data does not automatically disqualify an activity. What matters, the judges said, is whether the processing genuinely serves journalistic purposes.

“Consequently, in order to fall within the concept of ‘journalistic purposes,’ within the meaning of that provision, processing of personal data must have as its purpose the disclosure to the public of information, opinions or ideas, in compliance with ethical rules and codes of conduct, following editing or adaptation, or at least, in accordance with an editorial policy, and after verification of the factual allegations concerned,” the court wrote.

Lorna Woods, emeritus professor of internet law at the University of Essex, said the court took a more restrictive view of how far member states can go in carving out exceptions from the GDPR. While countries still have room to balance privacy with freedom of expression, she said, the judgment makes clear that flexibility has limits.

She said the judges also rejected the idea that every activity involving public information amounts to journalism.

“I think this case seeks to draw a line between journalism and other forms of communicating to the public — perhaps excluding also some forms of ‘citizen journalism,’” Woods said.

Maximilian Gerhold, a data protection and media law specialist at OPPENLÄNDER Rechtsanwälte who also lectures at the University of Passau, said the ruling strengthens professional media by drawing a clearer line around who can claim the GDPR’s journalism exemption. Bloggers are not automatically excluded, he said, but meeting the court’s criteria will likely prove much harder outside traditional news organizations.

“The mere publication of personal data can no longer be regarded as privileged,” Gerhold said. He said Sweden will now have to rethink how it reconciles its long-standing commitment to government transparency with the privacy standards required under EU law.

That shift could be felt well beyond newsrooms, according to Joakim Söderberg, a data protection lawyer at Noyb, the European Center for Digital Rights. He said the judgment puts fresh pressure on Sweden’s data-broker industry, where companies have long relied on publication permits while claiming constitutional protection from privacy rules.

“Being a webshop for criminal convictions isn’t really the same thing as being a journalist,” he said.

He said the judgment should make it easier to challenge companies that trade in personal data while claiming journalistic status. Söderberg also called it a wake-up call for Swedish lawmakers and public authorities, arguing they should stop selling personal data to commercial brokers that later invoke publication permits to shield themselves from GDPR claims.

The next test comes in Sweden. Jan Södergren, a human rights lawyer at J.Södergren Advokatbyrå who represented ND before the Court of Justice of the European Union, said the ruling sharply narrows how far the journalism exemption can stretch.

“Simply republishing public court records for payment, without editorial work or adherence to journalistic ethics, does not qualify,” Södergren said.

He said businesses operating that way remain subject to the GDPR’s ordinary enforcement mechanisms, including claims for compensation, rather than leaving affected individuals with defamation actions alone.

Legal Newsdesk Sweden did not respond to a request for comment.

Attunda District Court must now determine whether Lexbase actually carried out the editorial work, followed an editorial policy and complied with the journalistic ethics described by the EU court. If it did not, the company may no longer be able to rely on Sweden’s publication-certificate system to keep ordinary GDPR remedies out of reach.

Courthouse News reporter Eunseo Hong is based in the Netherlands.