CJEU - C‑199/24 - Legal Newsdesk Sweden AB
CJEU rules Member States cannot create GDPR derogations beyond Article 85(2).
The Court of Justice of the European Union (CJEU) has ruled that Member States cannot create data protection derogations from the GDPR beyond those explicitly permitted by Article 85(2). This means that exemptions for processing personal data for journalistic, academic, artistic, or literary expression cannot be extended to other forms of processing. The court also clarified that data subjects must retain access to remedies under Chapter VIII of the GDPR, even when their criminal conviction data is published online, and cannot be limited solely to defamation proceedings.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU clarified that national Member States do not have the authority to create data protection exemptions beyond those explicitly permitted under GDPR Article 85(2), which covers journalistic, academic, artistic, and literary expression. Organizations and legislators who assumed broader national derogations were permissible now face significant legal exposure if their processing activities relied on those extended exemptions. Critically, the ruling reaffirms that data subjects retain full access to GDPR Chapter VIII remedies — including complaints and legal proceedings — even when sensitive data such as criminal convictions is published online, and cannot be restricted to defamation law alone. This matters because it closes a loophole that some publishers and data processors may have exploited to avoid accountability under the GDPR's robust enforcement framework.