The CJEU Sets Limits on Sweden's Ability to Restrict the Application of the GDPR

Background

Legal Newsdesk, which operates Lexbase, refused to erase personal data relating to an individual convicted of a criminal offence in 2011. The individual subsequently brought proceedings against the company, seeking damages of SEK 300,000 for alleged infringements of the General Data Protection Regulation (GDPR).

Legal Newsdesk argued that Lexbase benefits from constitutional protection through a Swedish publishing certificate (utgivningsbevis), meaning that the GDPR does not apply. Under Chapter 1, Section 7 of the Swedish Data Protection Act, the GDPR is disapplied to the extent that its application would conflict with the Freedom of the Press Act or the Fundamental Law on Freedom of Expression. According to the company, the data subject's only available remedies were therefore to bring criminal defamation proceedings or to seek damages on that basis.

The Attunda District Court referred three questions to the CJEU for a preliminary ruling.

The CJEU's ruling

The Court answered all three questions and reached the following conclusions.

Exemptions from the GDPR are limited to journalistic, academic, artistic and literary purposes

While Member States are required to reconcile the right to data protection with freedom of expression, Article 85 permits derogations from the GDPR only where personal data are processed for journalistic, academic, artistic or literary purposes.

Accordingly, Sweden may not rely on Article 85(1) to introduce broader exemptions covering other forms of personal data processing, irrespective of the weight attached to freedom of expression in the particular circumstances.

Data subjects must retain access to the remedies provided by the GDPR

The rights and remedies contained in Chapter VIII of the GDPR—including the right to lodge a complaint with a supervisory authority, the right to an effective judicial remedy and the right to compensation—cannot be restricted by national law.

A legal framework under which a data subject is limited to pursuing criminal defamation proceedings is therefore incompatible with the GDPR.

The Lexbase model is unlikely to qualify for the journalistic exemption

The third question concerned whether Lexbase's activities constitute processing of personal data for journalistic purposes within the meaning of Article 85(2) GDPR.

The CJEU reiterated that the concept of "journalistic purposes" must be interpreted broadly. However, the processing must genuinely pursue the objective of disclosing information, opinions or ideas to the public.

This requires, among other things, that the material be subject to some degree of editorial processing before publication, that publication takes place in accordance with recognised journalistic ethics or at least an identifiable editorial policy, and that factual assertions are verified prior to publication.

In the Court's view, a service that simply makes criminal convictions available to anyone willing to pay, without editorial review or processing, is unlikely to satisfy those requirements.

Although the final assessment remains for the Attunda District Court, the CJEU has provided clear guidance as to how the relevant criteria should be applied. The case will now return to the national court for determination, and any final judgment may ultimately be appealed.

Practical implications

The judgment has significant implications for services such as Lexbase. The CJEU effectively rejects the Swedish approach under which constitutional protections for freedom of expression automatically displace the GDPR.

Possessing a publishing certificate will no longer, in itself, be sufficient to exclude the application of the GDPR. The decisive question is whether the activity genuinely falls within the scope of the journalistic exemption.

Organisations publishing personal data under a publishing certificate should therefore carefully assess whether their operations satisfy the standards identified by the CJEU regarding editorial control, ethical oversight and editorial independence. Where those requirements are not met, the journalistic exemption will not apply and the GDPR will apply in full.

The judgment provides important clarification in an area of law that has long been characterised by legal uncertainty.

If you have questions about how this judgment may affect your organisation, our data protection specialists would be pleased to advise.