CJEU Rules Commercial Criminal Data Databases Cannot Claim GDPR Journalism Exemption
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU confirmed that publishing criminal conviction data in commercially available databases is not journalistic activity and therefore cannot exploit the Article 85(2) GDPR exemption that member states may grant to press and media. Organizations that have been processing sensitive personal data—including special category data like criminal records—under a misapplied journalistic exemption are now exposed to full GDPR liability. This ruling matters because it closes a loophole that data brokers and legal intelligence platforms may have exploited to bypass strict rules on processing criminal conviction data under Article 10 GDPR. Businesses must immediately audit their legal bases for processing such data and remediate any reliance on inapplicable exemptions.
Tactical Insight
Immediate actions
- Audit all data processing activities involving criminal conviction or special category data to verify the legal basis is valid and correctly applied.
- Withdraw or suspend any processing of criminal conviction data that relies solely on a journalistic or freedom-of-expression exemption if the activity is commercial in nature.
Compliance & governance improvements
- Conduct a formal Data Protection Impact Assessment (DPIA) for any product or service that publishes, aggregates, or commercialises personal data about individuals' criminal histories.
- Engage a qualified Data Protection Officer (DPO) to review all Article 85 exemption claims and ensure they are narrowly scoped and documented.
- Update internal data classification policies to explicitly flag criminal conviction data as requiring explicit legal authority under Article 10 GDPR before processing.
Detection & monitoring measures
- Implement periodic legal-basis review cycles (at minimum annually) to reassess whether exemptions relied upon remain valid in light of new court rulings.
- Establish an alert workflow so that relevant CJEU or national court judgements are flagged to the legal and privacy team within 48 hours of publication.