¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Provisional text
JUDGMENT OF THE COURT (Fifth Chamber)
9 July 2026 (*)
( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Scope – Making information relating to criminal convictions available to the public online in return for remuneration – Reconciling the right to protection of personal data with the right to freedom of expression and information – Article 79 – Right to an effective judicial remedy – Scope – Article 85 – Concept of processing of personal data carried out for ‘journalistic purposes’ )
In Case C‑199/24,
REQUEST for a preliminary ruling under Article 267 TFEU from the Attunda tingsrätt (District Court, Attunda, Sweden), made by decision of 1 March 2024, received at the Court on 13 March 2024, in the proceedings
ND
v
Legal Newsdesk Sweden AB, formerly Garrapatica AB
THE COURT (Fifth Chamber),
composed of M. L. Arastey Sahún, President of the Chamber, J. Passer, E. Regan (Rapporteur), D. Gratsias and B. Smulders, Judges,
Advocate General: M. Szpunar,
Registrar: C. Strömholm, Administrator,
having regard to the written procedure and further to the hearing on 14 May 2025,
after considering the observations submitted on behalf of:
– ND, by ND and J. Södergren, advokat,
– Legal Newsdesk Sweden AB, by J. Sundqvist, advokat,
– the Swedish Government, by F.-L. Göransson, C. Meyer-Seitz, J. Olsson and A. M. Runeskjöld, acting as Agents,
– the Bulgarian Government, by R. Stoyanov and T. Tsingileva, acting as Agents,
– the Finnish Government, by A. Laine and H. Leppo, acting as Agents,
– the European Commission, by A. Bouchagiar, H. Kranenborg and I. Söderlund, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 4 September 2025,
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Article 85(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2) (‘the GDPR’).
2 The request has been made in proceedings between ND and Legal Newsdesk Sweden AB, formerly Garrapatica AB, concerning the refusal by that company of ND’s request for the erasure of his personal data from the database called ‘Lexbase’, managed by that company.
Legal context
European Union law
Directive 95/46/EC
3 Article 9 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), entitled ‘Processing of personal data and freedom of expression’, provided:
‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’
4 That directive was repealed and replaced by the GDPR with effect from 25 May 2018.
The GDPR
5 Recital 153 of the GDPR states:
‘Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the [Charter of Fundamental Rights of the European Union (“the Charter”)]. This should apply in particular to the processing of personal data in the audiovisual field and in news archives and press libraries. Therefore, Member States should adopt legislative measures which lay down the exemptions and derogations necessary for the purpose of balancing those fundamental rights. … In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.’
6 Article 4 of the GDPR, entitled ‘Definitions’, and included in Chapter I of that regulation, itself entitled ‘General provisions’, provides:
‘For the purposes of this Regulation:
…
(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
… .’
7 Article 10 of the GDPR, entitled ‘Processing of personal data relating to criminal convictions and offences’, and included in Chapter II of that regulation, itself entitled ‘Principles’, provides:
‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’
8 Article 55 of the GDPR, entitled ‘Competence’, and included in Chapter VI of that regulation, itself entitled ‘Independent supervisory authorities’, states, in paragraph 1 thereof, that each supervisory authority is competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with the GDPR on the territory of its own Member State.
9 Article 57 of the GDPR, entitled ‘Tasks’, provides, in point (h) of paragraph 1 thereof, that, without prejudice to other tasks set out under this Regulation, each supervisory authority has, on the territory of its Member State, the task of conducting investigations on the application of the GDPR.
10 The investigative powers of the supervisory authorities are listed in paragraph 1 of Article 58 of the GDPR, entitled ‘Powers’. Paragraph 2 of that article sets out the corrective powers held by those authorities. Paragraph 3 of that article states the authorisations and advisory powers of those authorities.
11 Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, includes, inter alia, Articles 77 to 79 and 82 of that regulation.
12 Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’, provides, in paragraph 1 thereof:
‘Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.’
13 Article 78, entitled ‘Right to an effective judicial remedy against a supervisory authority’, provides, in paragraphs 1 and 2 thereof:
‘1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to … an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.’
14 Article 79 of the GDPR, entitled ‘Right to an effective judicial remedy against a controller or processor’, states in paragraph 1 thereof:
‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’
15 Article 82 of the GDPR, entitled ‘Right to compensation and liability’, provides in paragraph 1 thereof:
‘Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.’
16 Article 85 of the GDPR, headed ‘Processing and freedom of expression and information’, provides:
‘1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
3. Each Member State shall notify to the [European] Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them’.
Swedish law
17 The protection of the freedom of the press and the freedom of expression is governed by laws of constitutional status, namely by the Tryckfrihetsförordningen (1949:105) (constitutional law on the freedom of the press (1949:105)) (SFS 1949, No 105; ‘the Constitutional Law on freedom of the press’) and the Yttrandefrihetsgrundlagen (1991:1469) (constitutional law on the freedom of expression (1991:1469)) (SFS 1949, No 1469; ‘the Constitutional Law on freedom of expression’).
18 According to the information in the request for a preliminary ruling, the Constitutional Law on freedom of expression guarantees the freedom of expression, inter alia by means of radio and television broadcasts or certain types of websites.
19 Under Article 1 of Chapter 9 of that law, an application for compensation for abuse of the freedom of expression due to the content of a programme may be founded only on the fact that that programme involves freedom of expression offences. Identifying someone as having a lifestyle which is criminal or culpable or otherwise providing information which is liable to expose that person to the contempt of others constitutes the crime of defamation and is a freedom of expression offence under Article 1 of Chapter 5 of that law and Article 3 of Chapter 7 of the Constitutional Law on freedom of the press. However, such an act is not punishable under criminal law if, having regard to the circumstances, the disclosure of that information was justified and if the person who disclosed the information can show that it was true or that he or she had reasonable grounds for believing that it was true.
20 Under Article 4 of Chapter 1 of the Constitutional Law on freedom of expression, the protection guaranteeing that freedom is to be applied to certain types of databases if a there is a certificate of constitutional protection for the activity.
21 Article 14 of Chapter 1 of the Constitutional Law on freedom of expression provides that no public body may, unless so authorised under that law, take action against a person who has allegedly abused the freedom of expression or contributed to such abuse in a programme, or take action against the programme. Further, it follows from Article 11 of Chapter 1 of that law that it is not permitted for a public body to prohibit or obstruct the creation, publication or dissemination to the public of a programme and recordings of that nature on the ground of its content, unless that measure has a basis in the Constitutional Law on freedom of expression.
22 In accordance with Chapter 1, Paragraph 7, first subparagraph, of the Lagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (Law laying down supplementary provisions to the EU General Data Protection Regulation (2018:218)), of 19 April 2018 (SFS 2018, No 218), the GDPR is not to apply where that application would contravene the Constitutional Law on freedom of the press or the Constitutional Law on freedom of expression. Under the second subparagraph of that provision, certain articles of the GDPR are not to apply to the processing of personal data carried out for, inter alia, journalistic purposes.
The dispute in the main proceedings and the questions referred for a preliminary ruling
23 Legal Newsdesk Sweden manages the Lexbase database, which allows searches to be carried out on individuals and undertakings that have been the subject of criminal proceedings before a Swedish court. That database contains personal data.
24 ND, the applicant in the main proceedings, was convicted of a criminal offence by a judgment of 17 January 2011.
25 Legal Newsdesk Sweden published that judgment on the Lexbase database, where it remained accessible until February 2024. Although the applicant in the main proceedings made a request to that company for the erasure of his personal data, those data were not erased immediately, and were erased only later, on the basis of its internal policy on data storage.
26 ND brought an action before the Attunda tingsrätt (District Court, Attunda, Sweden), which is the referring court. He sought an order that Legal Newsdesk Sweden be required, on the basis of infringement of the GDPR, to pay damages of 300 000 Swedish kronor (SEK) (approximately EUR 26 000), plus interest.
27 Legal Newsdesk Sweden disputed that claim and, on that occasion relied on the certificate of constitutional protection in respect of freedom of expression, known as an utgivnigsbevis, which was issued by the Myndigheten för press, radio och tv (the Swedish Press and Broadcasting Authority), covering the information published on the Lexbase database. The referring court observes that, under Swedish law, in such a situation, the GDPR is not applicable, the right to protection of personal data being thus ensured, inter alia, by the Constitutional Law on freedom of the press and by the Constitutional Law on freedom of expression, which provide, by way of legal remedies, only for the possibility to bring criminal proceedings for defamation and for civil liability for defamation.
28 In that regard, having recalled the contents of Article 85(1) and (2) of the GDPR and recital 153 of that regulation, the referring court observes that that regulation expressly authorises Member States to provide for exemptions or derogations for the processing of personal data carried out, inter alia, for ‘journalistic purposes’.
29 However, the referring court notes that the GDPR does not define what is to be understood by processing of personal data for ‘journalistic purposes’. Furthermore, it observes that, although the Court of Justice has stated that that concept must be interpreted broadly and that activities the object of which is to disclose information, opinions or ideas to the public, irrespective of the medium which is used to transmit them, including as regards data from documents which are in the public domain under national legislation, are to be regarded as carried out for journalistic purposes, on the other hand, it has not been clarified whether that disclosure requires there to be some form of editing or adaptation of that information.
30 In those circumstances, the Attunda tingsrätt (District Court, Attunda) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Does Article 85(1) of the GDPR make it possible for the Member States to adopt legislative measures in addition to those which they must adopt under Article 85(2) of the regulation relating to the processing of personal data for purposes other than journalistic ones or the purposes of academic, artistic or literary expression?
(2) If the previous question is answered in the affirmative: Does Article 85(1) of the GDPR allow a reconciliation of the right to the protection of personal data pursuant to that regulation with [the right to] freedom of expression and of information which means that the only legal remedy available to a person whose personal data are processed by making criminal convictions involving that person available to the public on the internet in return for payment is the initiation of criminal proceedings for defamation or the claiming of damages for defamation?
(3) If the first question is answered in the negative or the second question is answered in the negative: Can an activity which consists of making available to the public on the internet in return for payment, without any [adaptation] or editing, public documents in the form of criminal convictions constitute processing of personal data for the purposes set out in Article 85(2) of the GDPR?’
Consideration of the questions referred
The first question
31 By its first question, the referring court asks, in essence, whether Article 85(1) of the GDPR must be interpreted as precluding Member States from adopting, on the basis of that provision, legislative measures going beyond what is provided for under Article 85(2) of that regulation, in so far as they introduce derogations from certain chapters of that regulation in respect of the processing of personal data for purposes other than journalistic purposes or the purposes of academic, artistic or literary expression, on the ground that those measures are necessary to reconcile the right to protection of personal data with the right to freedom of expression and information.
32 In that regard, it must be recalled that, pursuant to Article 85(1) of the GDPR, Member States are by law to reconcile the right to the protection of personal data under that regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
33 As a preliminary point, it should be borne in mind that, according to settled case-law, an interpretation of a provision of EU law cannot have the result of depriving the clear and precise wording of that provision of all effectiveness. Thus, where the meaning of a provision of EU law is absolutely plain from its very wording, the Court cannot depart from the interpretation which must be made of that provision in the light of its wording alone (see, to that effect, judgment of 25 January 2022, VYSOČINA WIND, C‑181/20, EU:C:2022:51, paragraph 39 and the case-law cited).
34 In the present case, it must be observed that Article 85(1) of the GDPR merely states that Member States are by law to reconcile the right to protection of personal data pursuant to that regulation with the right to freedom of expression and information, without providing that that reconciliation may result in the adoption of exemptions or derogations from that regulation.
35 Admittedly, as the Advocate General noted, in essence, in point 17 of his Opinion, it is clear from the use of the word ‘including’ in Article 85(1) of the GDPR that the processing for specific purposes referred to in that provision, namely processing for journalistic purposes or the purposes of academic, artistic or literary expression, constitutes only part of the processing operations which may be the object of reconciliation under that provision.
36 However, Article 85(1) of the GDPR must be read in the light of Article 85(2) of that regulation, under which, for processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapters II to VII and IX of that regulation if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
37 It is thus clear from the wording of Article 85(1) and (2) of the GDPR that, while paragraph 1 of that article establishes a general rule requiring Member States to reconcile, by legislative measures, the right to the protection of personal data and the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression, the special rule set out in paragraph 2 of that article, according to which they are to provide for exemptions or derogations from various chapters of that regulation if that is necessary to allow that reconciliation, only applies to those specific purposes.
38 That interpretation is borne out, first of all, by recital 153 of the GDPR according to which the objective of Article 85 of that regulation is to enable Member States to provide for exemptions or derogations to certain provisions of that regulation ‘solely’ in the context of the processing of personal data for journalistic purposes or for the purposes of academic, artistic or literary expression.
39 Secondly, since Article 85(2) of that regulation defines, in exhaustive terms, the context in which the exemptions or derogations from certain chapters of that regulation are to be applied, those exemptions or those derogations must be interpreted strictly (see, by analogy, judgment of 30 April 2025, Inspektorat kam Visshia sadeben savet, C‑313/23, C‑316/23 and C‑332/23, EU:C:2025:303, paragraph 101 and the case-law cited).
40 Lastly, it must be recalled that the reconciliation of several rights guaranteed by the Charter, such as the right to protection of personal data and the right to freedom of expression and information, guaranteed in Articles 8 and 11 of the Charter respectively, must take place within the confines of a fair balance between those rights (see, to that effect, judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters), C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 50 and the case-law cited).
41 It is settled case-law that, in accordance with the principle of proportionality, achieving such a fair balance presupposes that the function of the fundamental rights at issue in society must be taken into account (judgments of 2 March 2023, Norra Stockholm Bygg, C‑268/21, EU:C:2023:145, paragraph 49, and of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 85 and the case-law cited).
42 In the present case, although, as is apparent from the wording of Article 85(2) of the GDPR, concerning processing carried out for journalistic purposes or the purposes of academic, artistic or literary expression, the EU legislature decided expressly to require Member States to provide for exemptions or derogations from certain chapters of that regulation, the scope of which exemptions or derogations may, however, vary from one Member State to another, and to refer to a significant number of those chapters to which those exemptions or those derogations may relate, it did so in so far as it considered that only the expressions made for those purposes, having regard to their function in a democratic society, warrant such significant exemptions or derogations from that regulation.
43 It follows that the reconciliation, by law, of the right to the protection of personal data under the GDPR with the right to freedom of expression and information which the Member States must carry out in accordance with Article 85(1) of that regulation cannot result in those States providing, on the basis of that provision, for exemptions or derogations from that regulation for the processing of personal data for purposes other than journalistic purposes or the purposes of academic, artistic or literary expression.
44 Having regard to the foregoing, the answer to the first question is that Article 85(1) of the GDPR must be interpreted as precluding Member States from adopting, on the basis of that provision, legislative measures going beyond what is provided for under Article 85(2) of that regulation, in so far as they introduce derogations from certain chapters of that regulation in respect of the processing of personal data for purposes other than journalistic purposes or the purposes of academic, artistic or literary expression, on the ground that those measures are necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information.
The second question
45 By its second question, the referring court asks, in essence, whether Article 85(1) of the GDPR must be interpreted as precluding the measures adopted by the Member States on its basis from providing, in so far as they give specific expression to the reconciliation which the Member States must carry out between the right to the protection of personal data and the right to freedom of expression and information, that the only legal remedies available to a person who has been convicted of criminal offences, where personal data on those convictions are made available to the public on the internet, in return for payment, are the possibility to bring criminal proceedings for defamation or to bring an action for compensation for the damage suffered as a result of having been defamed.
46 In that regard, Article 85(2) of the GDPR allows the Member States to adopt legislative measures derogating from Chapters II to VII and IX of that regulation if that is necessary to reconcile the right to the protection of personal data under that regulation with the right to freedom of expression and information.
47 However, it must be stated that Chapter VIII of the GDPR includes Article 77(1), Article 78(1) and (2), Article 79(1) and Article 82(1) of the GDPR, which concern the legal remedies which must be available to a person in respect of the processing of his or her personal data such as that at issue in the present case, in so far as they guarantee, respectively, first, the right of data subjects to lodge a complaint with a supervisory authority; secondly, the right of each natural or legal person to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them; thirdly, the right to an effective judicial remedy of any person who considers that his or her rights under that regulation have been infringed as a result of the processing of his or her personal data in breach of that regulation by a data controller or processor and; fourthly, the right of any person who has suffered material or non-material damage as a result of an infringement of that regulation to receive compensation from the controller or processor for the damage suffered.
48 Chapter VIII of that regulation is not included among those referred to in Article 85(2) of the GDPR and it must therefore be inferred that, since Article 85(1) of that regulation does not allow Member States to provide for the exemptions or derogations envisaged by Article 85(2) for the processing of personal data for purposes other than those referred to by the latter paragraph, it does not, a fortiori, allow the Member States to derogate from Article 77(1), Article 78(1) and (2), Article 79(1) and Article 82(1) of that regulation.
49 Consequently, and since the GDPR does not contain any information on the detailed procedural rules for the exercise of the legal remedies provided for by that regulation, it falls to the Member States, in accordance with the principle of procedural autonomy, to establish those rules, in so far as they are neither less favourable than those governing similar situations under national law (principle of equivalence) nor of such a nature as to render impossible in practice or excessively difficult the exercise of the rights conferred by EU law (principle of effectiveness) (see, to that effect, judgment of 4 September 2025, Quirin Privatbank, C‑655/23, EU:C:2025:655, paragraph 66 and the case-law cited).
50 On the other hand, inasmuch as Article 77(1), Article 78(1) and (2), Article 79(1) and Article 82(1) of the GDPR, which are directly applicable, confer on data subjects a right to exercise the remedies provided for therein, the Member States may not make the exercise of those remedies subject to substantive conditions other than those arising from that regulation.
51 Having regard to the foregoing, the answer to the second question is that Article 85(1) of the GDPR must be interpreted as precluding the measures adopted by the Member States on its basis from providing, in so far as they give specific expression to the reconciliation which the Member States must carry out between the right to the protection of personal data and the right to freedom of expression and information, that the only legal remedies available to a person who has been convicted of criminal offences, where personal data on those convictions are made available to the public on the internet, in return for payment, are the possibility to bring criminal proceedings for defamation or to bring an action for compensation for the damage suffered as a result of having been defamed.
The third question
Admissibility
52 The Bulgarian Government submits that the third question is inadmissible because the facts set out in the order for reference do not make it possible to determine clearly the purpose of the processing of personal data at issue in the main proceedings or to assess whether that processing complies with Article 10 of the GDPR.
53 In accordance with settled case-law, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. The Court may refuse to rule on a question referred for a preliminary ruling from a national court only where it is quite obvious that the interpretation of EU law sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment of 18 June 2024, Bundesrepublik Deutschland (Effect of a decision granting refugee status), C‑753/22, EU:C:2024:524, paragraph 44 and the case-law cited).
54 In particular, as regards the latter situation, according to settled case-law, reflected in Article 94(a) and (b) of the Rules of Procedure of the Court of Justice, the need to provide an interpretation of EU law which will be of use to the national court makes it necessary, in particular, for that court to, first, set out the relevant facts or provide, at least, an account of the facts on which the questions are based, and secondly to, define the legislative context of the questions it is asking (judgment of 12 March 2026, Marhaux, C‑150/25, EU:C:2026:188, paragraph 27 and the case-law cited).
55 In the present case, the third question concerns the interpretation of the term ‘journalistic purposes’ used in Article 85(2) of the GDPR and therefore the interpretation of a provision of EU law. In order to answer such a question, it does not appear necessary either to know the purpose of the processing of the personal data at issue in the main proceedings or to assess whether that processing complies with Article 10 of that regulation.
56 Since, moreover, it is not obvious from the file that the interpretation of EU law sought bears no relation to the actual facts of the main action or its purpose, the third question must be declared admissible.
Substance
57 By its third question, the referring court asks, in essence, whether Article 85(2) of the GDPR must be interpreted as meaning that making available to the public on the internet in return for payment, without any adaptation or editing, public documents in the form of criminal convictions can be considered to constitute processing of personal data for ‘journalistic purposes’ within the meaning of that provision.
58 At the outset, in the light of the Court’s case-law according to which the concept of ‘processing’, within the meaning of Article 4(2) of the GDPR, has a broad scope (judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21, EU:C:2023:949, paragraph 50 and the case-law cited), it must be held that making public documents consisting of criminal convictions available to the public on the internet must be regarded as processing of personal data within the meaning of the GDPR.
59 As has been recalled in paragraph 36 of the present judgment, where such processing is carried out for journalistic purposes or for the purposes of academic, artistic or literary expression, Article 85(2) of the GDPR states that the Member States are to provide for exemptions or derogations from Chapters II to VII and IX of that regulation if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
60 Admittedly, neither Article 85(2) of the GDPR nor any other provision of that regulation contains a definition of the concept of ‘journalistic purposes’ or an express reference to the law of the Member States enabling the meaning or scope of that concept to be determined.
61 Nevertheless, according to the Court’s case-law on the concept of ‘journalism’ used in Article 9 of Directive 95/46, which may be regarded as transposable to the interpretation of the concept of ‘journalistic purposes’ in Article 85(2) of the GDPR, activities may be classified as ‘journalistic activities’ if their object is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them (judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 61).
62 In addition, recital 153 of the GDPR states that, in order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as ‘journalism’, broadly.
63 It is also apparent from recital 153 thereof that the exemptions and derogations under Article 85(2) of the GDPR seek to reconcile the right to the protection of personal data with the right to freedom of expression and information, enshrined in Article 11 of the Charter.
64 However, while the concept of ‘journalistic purposes’ used in Article 85(2) of the GDPR must be interpreted broadly, the fact remains that that interpretation cannot cover all forms of expression, but must be understood in a way that takes account of what differentiates, from the point of view of the manner in which they are created, journalistic expression from other forms of expression, having regard to the role played by that concept in the general scheme of that provision.
65 Besides, in interpreting Article 11 of the Charter, it is necessary to take into account, pursuant to Article 52(3) thereof, the case-law of the European Court of Human Rights in relation to Article 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950 (judgment of 15 March 2022, Autorité des marchés financiers, C‑302/20, EU:C:2022:190, paragraph 67 and the case-law cited).
66 First, it is common ground that journalistic activity presupposes the editing or adaptation of the information, opinions or ideas disclosed, carried out on a regular or professional basis, or, at the very least, the act of making that information or those opinions or ideas available, carried out in accordance with editorial decisions (see, by analogy and to that effect, ECtHR, 17 January 2023, Axel Springer SE v. Germany, CE:ECHR:2023:0117JUD000896418, § 33, and ECtHR, 5 April 2022, NIT S.R.L. v. Republic of Moldova, CE:ECHR:2022:0405JUD002847012, § 193).
67 Secondly, even when disclosing opinions or ideas, journalistic activity presupposes that factual allegations supporting such opinions or ideas have been verified so as to be sufficiently reliable (see, by analogy, ECtHR, 21 January 1999, Fressoz and Roire v. France, CE:ECHR:1999:0121JUD002918395, §§ 52 and 54, and ECtHR, 16 March 2017, Ólafsson v. Iceland, CE:ECHR:2017:0316JUD005849313, § 53).
68 Thirdly, in order to be regarded as ‘journalistic’, the activity carried out must be subject to compliance with the profession’s ethical rules and codes of conduct (see, by analogy, ECtHR, 27 June 2017, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, CE:ECHR:2017:0627JUD000093113, §§ 183 and 186, and ECtHR, 28 June 2018, M.L. and W.W. v. Germany, CE:ECHR:2018:0628JUD006079810, § 105).
69 On the other hand, given that the concept of ‘journalism’ must be interpreted broadly, as is apparent from paragraph 62 of the present judgment, neither the fact that the activity concerned, in the course of which data processing is carried out, is carried out on the internet, in return for payment (see, to that effect, judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraphs 59 to 62), nor the fact that that processing concerns criminal convictions is such as to preclude that processing from being carried out for ‘journalistic purposes’.
70 It is true that the nature of the personal data concerned by processing, in particular whether those data may be sensitive, and the nature and specific arrangements for such processing, in particular the number of persons who have access to those data and the arrangements for access to them, must be taken into account in order to assess whether the protection of the right to freedom of expression and information, inter alia that enjoyed by journalists, justifies derogation from certain provisions of the GDPR (see, to that effect, judgment of 21 March 2024, Landeshauptstadt Wiesbaden, C‑61/22, EU:C:2024:251, paragraph 106), and in particular derogation from Article 10 of that regulation, which establishes special protection for the processing of personal data relating to criminal convictions and offences. Nevertheless, the fact that processing relates to such data is irrelevant for the purposes of determining whether, prior to that assessment, that processing may be regarded as having been carried out for ‘journalistic purposes’.
71 However, it should also be noted that Article 85(2) of the GDPR does not refer to the processing of personal data carried out in the course of journalistic activity, but to that carried out for ‘journalistic purposes’. The concept of ‘purposes’ implies that the processing of personal data which may fall within the scope of that provision is not limited to processing which occurs at the stage of publication of information, opinions or ideas and consists, on that occasion, of making personal data available to the public, but also includes the processing necessary for such publication (see, by analogy, judgment of 15 March 2022, Autorité des marchés financiers, C‑302/20, EU:C:2022:190, paragraphs 64 and 67 to 69).
72 In so far as journalistic work involves a selection and prioritisation of the information gathered, not only are the various operations processing personal data and which are necessary in order to publish information, opinions or ideas liable to be classified as processing for ‘journalistic purposes’ within the meaning of Article 85(2) of the GDPR, but also those which are related to personal data contained in the information which was ultimately not accepted following that selection.
73 Consequently, in order to fall within the concept of ‘journalistic purposes’, within the meaning of that provision, processing of personal data must have as its purpose the disclosure to the public of information, opinions or ideas, in compliance with ethical rules and codes of conduct, following editing or adaptation, or at least, in accordance with an editorial policy, and after verification of the factual allegations concerned.
74 An activity, such as that at issue in the main proceedings, consisting of making public documents relating to criminal convictions handed down available to the public on the internet, in return for payment, does not appear to require editing or adaptation, or appear to be carried out in accordance with an editorial policy, which it is nevertheless for the referring court to ascertain. Furthermore, it is not apparent from the documents before the Court that Legal Newsdesk Sweden is subject to the ethical rules and codes of conduct of the profession of journalist, which it is also for the referring court to verify.
75 It is true that those documents may constitute useful information for the purposes of journalistic activity. The fact remains, though, that the processing of personal data involved, in particular, in making such documents available to the public cannot be regarded as having been carried out ‘for journalistic purposes’ within the meaning of Article 85 of the GDPR unless those documents are intended exclusively for such an activity.
76 However, in the case at issue in the main proceedings, it is apparent from the material in the documents before the Court, although that is a matter for the referring court to verify, that any person may access, using the database concerned, the documents relating to the criminal convictions of the data subjects on the sole condition of making a payment, with the result that the processing of personal data carried out in order to make such access possible, such as the making available of the personal data contained in those documents, cannot be regarded as being carried out for journalistic purposes.
77 Having regard to the foregoing, the answer to the third question is that Article 85(2) of the GDPR must be interpreted as meaning that making available to the public on the internet, in return for payment, public documents consisting of criminal convictions cannot be regarded as processing of personal data carried out for ‘journalistic purposes’, within the meaning of that provision, unless it has as its purpose the disclosure to the public of information, opinions or ideas, in compliance with the ethical rules and codes of conduct of the profession of journalist, after editing or adaptation, or at least in accordance with an editorial policy, and after verification of the factual allegations concerned.
Costs
78 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Fifth Chamber) hereby rules:
1. Article 85(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as precluding Member States from adopting, on the basis of that provision, legislative measures going beyond what is provided for under Article 85(2) of that regulation, in so far as they introduce derogations from certain chapters of that regulation in respect of the processing of personal data for purposes other than journalistic purposes or the purposes of academic, artistic or literary expression, on the ground that those measures are necessary to reconcile the right to protection of personal data with the right to freedom of expression and information.
2. Article 85(1) of Regulation 2016/679
must be interpreted as precluding the measures adopted by the Member States on its basis from providing, in so far as they give specific expression to the reconciliation which the Member States must carry out between the right to the protection of personal data and the right to freedom of expression and information, that the only legal remedies available to a person who has been convicted of criminal offences, where the personal data on those criminal convictions are made available to the public on the internet, in return for payment, are the possibility to bring criminal proceedings for defamation or to bring an action for compensation for the damage suffered as a result of having been defamed.
3. Article 85(2) of Regulation 2016/679
must be interpreted as meaning that making available to the public on the internet, in return for payment, public documents consisting of criminal convictions cannot be regarded as processing of personal data carried out for ‘journalistic purposes’, within the meaning of that provision, unless it has as its purpose the disclosure to the public of information, opinions or ideas, in compliance with the ethical rules and codes of conduct of the profession of journalist, after editing or adaptation, or at least in accordance with an editorial policy, and after verification of the factual allegations concerned.
[Signatures]
* Language of the case: Swedish.