Legal Newsdesk Sweden: paid online publication of criminal convictions is in principle not journalism, national exemptions may not switch off the GDPR

What it is about

Question: may a Member State, under the freedom of expression exemption (Article 85), place a paid searchable database of criminal convictions (Lexbase, holding a Swedish constitutional publishing certificate) outside the GDPR so that the convicted person is left only with criminal defamation proceedings or an action for compensation? Ruling: no. Member States may not, on the basis of Article 85(1), introduce derogations going beyond Article 85(2) for processing that has no journalistic, academic, artistic or literary purpose, and they may not limit the data subject's remedies to those two options. Processing is journalistic only if it aims at disclosure to the public of information, opinions or ideas, in compliance with the ethical rules of the journalistic profession, after editing or at least in accordance with an editorial policy, and after verification of the facts.

What this means in practice

Providers of data about people, such as screening, background checks, registers or case law databases, cannot simply invoke the press exemption; without a genuine editorial process all GDPR rules apply, including the right to erasure and compensation. Check whether your retention and deletion policy for criminal data (Article 10) holds up. In the Netherlands too, the application of the journalistic exemption in the national implementing act must be measured against this standard.

The GDPR articles concerned

• Article 10: Processing of personal data relating to criminal convictions and offences
• Article 17: Right to erasure (‘right to be forgotten’)
• Article 79: Right to an effective judicial remedy against a controller or processor
• Article 82: Right to compensation and liability
• Article 85: Processing and freedom of expression and information