[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fExu8yWO3Ox_kzB8opYUVmh-20SMy1qYn1HBVnICWGg0":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"5f6b0b63-a791-484b-862e-abc605258358","CJEU - C‑199\u002F24 - Legal Newsdesk Sweden AB","cjeu-c-199-24-legal-newsdesk-sweden-ab-8f690d","← Older revision Revision as of 08:00, 15 July 2026 Line 43: Line 43: }} }} The CJEU opined that the publication of information about criminal convictions in commercially available databases does not constitute a journalistic activity and cannot be exempt from the GDPR under national laws implementing Article 85(2) GDPR. He also stated that Article 85 GDPR does not justify legal derogations from the entire GDPR. The CJEU held that the mere publication of information about criminal convictions in commercially available databases does not constitute a journalistic activity and cannot be exempt from the GDPR under national laws implementing Article 85(2) GDPR. The Court also held that Article 85 GDPR does not justify legal derogations from the entire GDPR. ==English Summary== ==English Summary==","The Court of Justice of the European Union (CJEU) ruled that the publication of criminal conviction data in commercially available databases does not qualify as journalistic activity. Therefore, such activities cannot claim exemption from GDPR under national laws implementing Article 85(2) GDPR. The court also clarified that Article 85 GDPR does not permit broad derogations from the entire GDPR for these types of data processing.","CJEU rules commercial databases publishing criminal convictions are not journalistic and not GDPR exempt.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C%E2%80%91199\u002F24_-_Legal_Newsdesk_Sweden_AB&diff=52222&oldid=52214","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-07-15T08:00:49+00:00","2026-07-15T10:00:27.148874+00:00",7,[17,20],{"name":18,"type":19},"Lexbase","product",{"name":21,"type":22},"Legal Newsdesk Sweden AB","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[21,18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":61},"cjeu-rules-commercial-criminal-data-databases-cannot-claim-gdpr-journalism-exemption","CJEU Rules Commercial Criminal Data Databases Cannot Claim GDPR Journalism Exemption","The CJEU confirmed that publishing criminal conviction data in commercially available databases is not journalistic activity and therefore cannot exploit the Article 85(2) GDPR exemption that member states may grant to press and media. Organizations that have been processing sensitive personal data—including special category data like criminal records—under a misapplied journalistic exemption are now exposed to full GDPR liability. This ruling matters because it closes a loophole that data brokers and legal intelligence platforms may have exploited to bypass strict rules on processing criminal conviction data under Article 10 GDPR. Businesses must immediately audit their legal bases for processing such data and remediate any reliance on inapplicable exemptions.",[51,52,53,54,55,56,57,58,59,60],"GDPR Article 10 (Processing of criminal convictions data)","GDPR Article 85(2) (Exemptions for journalistic purposes)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 37–39 (Data Protection Officer obligations)","GDPR Article 6 (Lawfulness of processing)","NIST Privacy Framework PR.PO-P1 (Policies, Processes, and Procedures)","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 Section 7.2.1 (Identify and document purpose)","ITIL Service Design – Compliance and Legal Requirements",{}]