[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJ3gYM7t4e3HH8254-q9sUGOnHjXZghRArmfk2ML7XUs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"88f825db-7136-4943-9c94-8076d6418548","cjeu-rules-member-states-cannot-expand-gdpr-derogations-beyond-article-852","68b251e9-63c6-48fe-b461-e28480225871","CJEU Rules Member States Cannot Expand GDPR Derogations Beyond Article 85(2)","The CJEU clarified that national Member States do not have the authority to create data protection exemptions beyond those explicitly permitted under GDPR Article 85(2), which covers journalistic, academic, artistic, and literary expression. Organizations and legislators who assumed broader national derogations were permissible now face significant legal exposure if their processing activities relied on those extended exemptions. Critically, the ruling reaffirms that data subjects retain full access to GDPR Chapter VIII remedies — including complaints and legal proceedings — even when sensitive data such as criminal convictions is published online, and cannot be restricted to defamation law alone. This matters because it closes a loophole that some publishers and data processors may have exploited to avoid accountability under the GDPR's robust enforcement framework.","**Immediate Actions:**\n- Audit all data processing activities that rely on national derogations to confirm they fall strictly within GDPR Article 85(2) permitted categories.\n- Review any internal policies or legal opinions that assumed broader national exemptions were valid and update them to reflect this ruling.\n\n**Compliance & Legal Improvements:**\n- Ensure data subject rights procedures — including complaint and remedy pathways under GDPR Chapter VIII — are fully operational and not restricted to defamation or other narrow legal channels.\n- Engage legal counsel to assess whether current data processing for publishing or media activities complies with the narrowly defined Article 85(2) derogations.\n- Update privacy notices and Records of Processing Activities (RoPA) to accurately reflect the lawful basis for any sensitive data processing.\n\n**Governance & Training Measures:**\n- Train legal, compliance, and editorial teams on the boundaries of GDPR derogations to prevent inadvertent non-compliance.\n- Establish a regulatory monitoring process to track CJEU and national court rulings that affect GDPR interpretation and enforcement.",[12,13,14,15,16,17,18,19,20],"GDPR Article 85(2) — Derogations for journalistic, academic, artistic, and literary expression","GDPR Chapter VIII — Remedies, liability, and penalties","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 10 — Processing of criminal conviction data","NIST Privacy Framework PR.PO-P1 — Policies and procedures for privacy","NIST SP 800-53 PT-2 — Authority to process personally identifiable information","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS)","CIS Control 3 — Data Protection","ITIL Service Value System — Risk and compliance management",{},"published","2026-07-14T08:20:23.399553+00:00","2026-07-14T08:20:23.108+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C%E2%80%91199\u002F24_-_Legal_Newsdesk_Sweden_AB&diff=52200&oldid=49085","cjeu-c-199-24-legal-newsdesk-sweden-ab-3c4125","CJEU - C‑199\u002F24 - Legal Newsdesk Sweden AB",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]