[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGe-fLrI0EZc5SpA6EyYHhyphWI5RZPL6r6p8ebBE9Hc":3},{"article":4,"iocs":37,"watch_terms":38,"solutions":39,"lesson":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"68b251e9-63c6-48fe-b461-e28480225871","CJEU - C‑199\u002F24 - Legal Newsdesk Sweden AB","cjeu-c-199-24-legal-newsdesk-sweden-ab-3c4125","← Older revision Revision as of 07:22, 14 July 2026 Line 7: Line 7: |Judgement_Link= |Judgement_Link= |Date_Decided= |Date_Decided=09.07.2026 |Year= |Year= Line 19: Line 19: |GDPR_Article_Link_4= |GDPR_Article_Link_4= |EU_Law_Name_1= |EU_Law_Name_1=Article 8 CFREU |EU_Law_Link_1= |EU_Law_Link_1=https:\u002F\u002Ffra.europa.eu\u002Fen\u002Feu-charter\u002Farticle\u002F8-protection-personal-data |EU_Law_Name_2= |EU_Law_Name_2=Article 11 CFREU |EU_Law_Link_2= |EU_Law_Link_2=https:\u002F\u002Ffra.europa.eu\u002Fen\u002Feu-charter\u002Farticle\u002F11-freedom-expression-and-information |National_Law_Name_1= |National_Law_Name_1= Line 39: Line 39: |Reference_Case_Number_Name= |Reference_Case_Number_Name= |Initial_Contributor=cci |Initial_Contributor=bms | | }} }} Line 68: Line 68: ==== The questions referred ==== ==== The questions referred ==== The District Court referred three somewhat complex questions to the Court of Justice about the interpretation of [[Article 85 GDPR|Article 85 GDPR]]: The District Court referred three somewhat complex questions to the Court of Justice about the interpretation of [[Article 85 GDPR]]: # ''Does Article 85(1) of the GDPR make it possible for the Member States to adopt legislative measures in addition to those which they must adopt under Article 85(2) of the regulation relating to the processing of personal data for purposes other than journalistic ones or the purposes of academic, artistic or literary expression?'' # ''Does Article 85(1) of the GDPR make it possible for the Member States to adopt legislative measures in addition to those which they must adopt under Article 85(2) of the regulation relating to the processing of personal data for purposes other than journalistic ones or the purposes of academic, artistic or literary expression?'' Line 78: Line 78: === Holding === === Holding === TBD The CJEU held that [[Article 85 GDPR|Article 85(1) GDPR]] does not allow Member States to create derogations from the GDPR beyond those expressly permitted by [[Article 85 GDPR|Article 85(2)]]. [[Article 85 GDPR|Article 85(1)]] requires Member States to reconcile data protection with freedom of expression and information. However, it does not itself authorise exemptions from the GDPR. Such exemptions may only be introduced under [[Article 85 GDPR|Article 85(2)]] and only for processing carried out for journalistic purposes or for academic, artistic or literary expression. The CJEU therefore found that Member States cannot rely on Article 85(1) to exclude other forms of processing from the application of the GDPR. The CJEU also held that [[Article 85 GDPR]] does not permit Member States to restrict the remedies available to data subjects under Chapter VIII GDPR. National law cannot limit a data subject whose criminal-conviction data is published online to defamation proceedings only. Accordingly, the data subject must retain access to the remedies provided under [[Article 77 GDPR|Articles 77]], [[Article 78 GDPR|78]], [[Article 79 GDPR|79]] and [[Article 82 GDPR|82 GDPR]], including the right to lodge a complaint with the DPA, seek an effective judicial remedy and claim compensation. Regarding journalistic purposes, the CJEU confirmed that the concept must be interpreted broadly. The fact that processing is carried out online, for payment or in relation to criminal convictions does not, by itself, exclude the application of [[Article 85 GDPR|Article 85(2)]]. However, the mere publication of information is not sufficient. Processing qualifies as journalistic only where it is intended to inform the public and is carried out in accordance with journalistic professional and ethical standards. It must involve editorial work or adaptation, or at least follow an editorial policy, and the relevant factual information must be verified. The CJEU found that making unedited criminal judgements available to any paying user did not appear to satisfy those requirements. In particular, the activity did not appear to involve editorial assessment, adaptation or a journalistic policy. The fact that the documents could be useful to journalists was not enough to bring the processing within [[Article 85 GDPR|Article 85(2)]]. It was for the referring Court to verify whether the controller’s activity met the conditions for processing for journalistic purposes. The CJEU did not impose a fine, award compensation or order corrective measures. Those issues remained for the referring Court to decide. == Comment == == Comment == ''Share your comments here!'' ''Share your comments here!''","The Court of Justice of the European Union (CJEU) has ruled that Member States cannot create data protection derogations from the GDPR beyond those explicitly permitted by Article 85(2). This means that exemptions for processing personal data for journalistic, academic, artistic, or literary expression cannot be extended to other forms of processing. The court also clarified that data subjects must retain access to remedies under Chapter VIII of the GDPR, even when their criminal conviction data is published online, and cannot be limited solely to defamation proceedings.","CJEU rules Member States cannot create GDPR derogations beyond Article 85(2).","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C%E2%80%91199\u002F24_-_Legal_Newsdesk_Sweden_AB&diff=52200&oldid=49085","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-07-14T07:22:51+00:00","2026-07-14T08:00:19.869809+00:00",7,[17],{"name":18,"type":19},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":40,"vendors":41},[],[],{"slug":43,"title":44,"body":45,"framework_refs":46,"framework_notes":56},"cjeu-rules-member-states-cannot-expand-gdpr-derogations-beyond-article-852","CJEU Rules Member States Cannot Expand GDPR Derogations Beyond Article 85(2)","The CJEU clarified that national Member States do not have the authority to create data protection exemptions beyond those explicitly permitted under GDPR Article 85(2), which covers journalistic, academic, artistic, and literary expression. Organizations and legislators who assumed broader national derogations were permissible now face significant legal exposure if their processing activities relied on those extended exemptions. Critically, the ruling reaffirms that data subjects retain full access to GDPR Chapter VIII remedies — including complaints and legal proceedings — even when sensitive data such as criminal convictions is published online, and cannot be restricted to defamation law alone. This matters because it closes a loophole that some publishers and data processors may have exploited to avoid accountability under the GDPR's robust enforcement framework.",[47,48,49,50,51,52,53,54,55],"GDPR Article 85(2) — Derogations for journalistic, academic, artistic, and literary expression","GDPR Chapter VIII — Remedies, liability, and penalties","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 10 — Processing of criminal conviction data","NIST Privacy Framework PR.PO-P1 — Policies and procedures for privacy","NIST SP 800-53 PT-2 — Authority to process personally identifiable information","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS)","CIS Control 3 — Data Protection","ITIL Service Value System — Risk and compliance management",{}]