[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbmpE0Oha-D2GdWTuEW1OMVp1wphxRGN5K5hq4784meQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1b7b3c48-2c36-4cc8-b8b7-84c3548d58e2","cjeu-rules-commercial-criminal-data-databases-cannot-claim-gdpr-journalism-exemption","5f6b0b63-a791-484b-862e-abc605258358","CJEU Rules Commercial Criminal Data Databases Cannot Claim GDPR Journalism Exemption","The CJEU confirmed that publishing criminal conviction data in commercially available databases is not journalistic activity and therefore cannot exploit the Article 85(2) GDPR exemption that member states may grant to press and media. Organizations that have been processing sensitive personal data—including special category data like criminal records—under a misapplied journalistic exemption are now exposed to full GDPR liability. This ruling matters because it closes a loophole that data brokers and legal intelligence platforms may have exploited to bypass strict rules on processing criminal conviction data under Article 10 GDPR. Businesses must immediately audit their legal bases for processing such data and remediate any reliance on inapplicable exemptions.","**Immediate actions:**\n- Audit all data processing activities involving criminal conviction or special category data to verify the legal basis is valid and correctly applied.\n- Withdraw or suspend any processing of criminal conviction data that relies solely on a journalistic or freedom-of-expression exemption if the activity is commercial in nature.\n\n**Compliance & governance improvements:**\n- Conduct a formal Data Protection Impact Assessment (DPIA) for any product or service that publishes, aggregates, or commercialises personal data about individuals' criminal histories.\n- Engage a qualified Data Protection Officer (DPO) to review all Article 85 exemption claims and ensure they are narrowly scoped and documented.\n- Update internal data classification policies to explicitly flag criminal conviction data as requiring explicit legal authority under Article 10 GDPR before processing.\n\n**Detection & monitoring measures:**\n- Implement periodic legal-basis review cycles (at minimum annually) to reassess whether exemptions relied upon remain valid in light of new court rulings.\n- Establish an alert workflow so that relevant CJEU or national court judgements are flagged to the legal and privacy team within 48 hours of publication.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 10 (Processing of criminal convictions data)","GDPR Article 85(2) (Exemptions for journalistic purposes)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 37–39 (Data Protection Officer obligations)","GDPR Article 6 (Lawfulness of processing)","NIST Privacy Framework PR.PO-P1 (Policies, Processes, and Procedures)","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 Section 7.2.1 (Identify and document purpose)","ITIL Service Design – Compliance and Legal Requirements",{},"published","2026-07-15T10:22:06.854634+00:00","2026-07-15T10:22:06.575+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C%E2%80%91199\u002F24_-_Legal_Newsdesk_Sweden_AB&diff=52222&oldid=52214","cjeu-c-199-24-legal-newsdesk-sweden-ab-8f690d","CJEU - C‑199\u002F24 - Legal Newsdesk Sweden AB",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]