CJEU - C‑199/24 - Legal Newsdesk Sweden AB
CJEU rules commercial databases publishing criminal convictions are not journalistic and not GDPR exempt.
The Court of Justice of the European Union (CJEU) ruled that the publication of criminal conviction data in commercially available databases does not qualify as journalistic activity. Therefore, such activities cannot claim exemption from GDPR under national laws implementing Article 85(2) GDPR. The court also clarified that Article 85 GDPR does not permit broad derogations from the entire GDPR for these types of data processing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Legal Newsdesk Sweden AB?
Get an email when a new story names Legal Newsdesk Sweden AB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU confirmed that publishing criminal conviction data in commercially available databases is not journalistic activity and therefore cannot exploit the Article 85(2) GDPR exemption that member states may grant to press and media. Organizations that have been processing sensitive personal data—including special category data like criminal records—under a misapplied journalistic exemption are now exposed to full GDPR liability. This ruling matters because it closes a loophole that data brokers and legal intelligence platforms may have exploited to bypass strict rules on processing criminal conviction data under Article 10 GDPR. Businesses must immediately audit their legal bases for processing such data and remediate any reliance on inapplicable exemptions.