EU court strips Lexbase of journalistic GDPR exemption
The EU's top court has ruled that a Swedish website selling access to criminal records cannot claim journalistic protections under GDPR, establishing a new boundary for data brokers across Europe.
The Court of Justice of the European Union ruled on July 9th that operating a paid database of criminal convictions does not qualify as "journalistic purposes" under the General Data Protection Regulation. The decision centers on Lexbase, a Swedish service that allows users to search for and access criminal records in exchange for payment. The court explicitly rejected the company's argument that its commercial activities deserved the same legal shielding as traditional news media.
The ruling stems from a lawsuit filed by a man convicted in 2011 who requested the removal of his data from the Lexbase database. The company delayed the removal, citing its internal storage policy, prompting the individual to seek damages for GDPR violations. In its defence, Lexbase argued that Sweden's constitutional freedom of expression protected it as a publisher.
This defence created a significant clash between national law and EU regulations. The court noted that under Swedish law, such constitutional protections precluded the application of the GDPR entirely, leaving individuals with defamation as their only legal recourse. However, the EU court clarified that the GDPR requires member states to balance data protection rights with freedom of expression, not override the EU rulebook.
To resolve the dispute, the CJEU set a strict definition of what constitutes journalism in the context of data processing. The court stated that journalistic purposes involve content prepared according to ethical rules, edited, adapted, or aligned with an editorial policy. "The mere placing online, in return for payment, of decisions on criminal convictions, does not in principle constitute processing of personal data for 'journalistic purposes'," the court said in a statement.
This distinction carries immediate implications for the business models of commercial data brokers operating across Europe. By drawing a line between publishing and merely hosting public records for profit, the ruling removes a powerful legal shield that companies have used to avoid compliance costs and GDPR fines. Data brokerage firms will now have to reassess how they handle public but sensitive information, as they can no longer rely on broad press freedom exemptions.
Lexbase has long been controversial in Sweden, facing heavy criticism over its impact on personal integrity despite its popularity. Three separate parliamentary inquiries have attempted to curb such services, but none has resulted in new legislation, according to public broadcaster SVT. With national lawmakers stalled, the EU court has now intervened to enforce privacy standards, signaling that commercial databases cannot bypass European data laws by rebranding as publishers.
