Opinion of Advocate General Szpunar delivered on 4 September 2025

Uitspraak

Provisional text

OPINION OF ADVOCATE GENERAL

SZPUNAR

delivered on 4 September 2025 (¹)

Case C‑199/24

ND

v

Legal Newsdesk Sweden AB, formerly Garrapatica AB

(Request for a preliminary ruling from the Attunda tingsrätt (District Court, Attunda, Sweden))

( Reference for a preliminary ruling – Approximation of laws – Protection of personal data – Processing of data relating to criminal convictions – Making information relating to criminal convictions available to the public online in return for payment – Balancing the right to protection of personal data against the right to freedom of expression and information )

1.        The present request for a preliminary ruling from the Attunda tingsrätt (District Court, Attunda, Sweden) gives the Court the opportunity to clarify the scope of Article 85 of Regulation (EU) 2016/679, (²) in a situation where a database operator refuses to grant a person’s request to erase personal data relating to their criminal conviction.

I.      Legal framework

A.      European Union law

2.        Article 85 of the GDPR deals with ‘Processing and freedom of expression and information’. It is worded as follows:

‘1.      Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

2.      For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

3.      Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.’

B.      Swedish law

3.        The yttrandefrihetsgrundlagen (1991:1469) (Constitutional Law on freedom of expression (1991:1469); ‘the Law on freedom of expression’) is one of the so-called mediegrundlagar (constitutional media laws) in Sweden and contains provisions on constitutional protection for, inter alia, radio and television broadcasts and certain websites. Its purpose is to ensure freedom of expression in that regard. According to Chapter 1, Paragraph 4, of the Law on freedom of expression, the constitutional provisions on programme transmission are to be applied to a certain type of database if there is a publication certificate for the activity. In the present case, a publication certificate has been issued for Lexbase, which means that the database is subject to constitutional protection.

4.        In accordance with Chapter 1, Paragraph 7, first subparagraph, of the lagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (Law (2018:218) laying down supplementary provisions to the EU GDPR; ‘the Law on data protection’), the GDPR is not to apply where it would contravene the tryckfrihetsförordningen (Constitutional Law on freedom of the press; ‘the Law on freedom of the press’) or the Law on freedom of expression. Under the second subparagraph of the above provision, certain articles of the GDPR are not to apply to the processing of personal data carried out for, inter alia, journalistic purposes.

5.        It follows from Chapter 1, Paragraph 14, of the Law on freedom of expression that a public body may not, except by virtue of that law, take action against a person who has abused the freedom of expression or contributed to such abuse in a programme, or take action against the programme for such a reason. Furthermore, it follows from Chapter 1, Paragraph 11, thereof that it is not permitted for a public body to prohibit or obstruct the transmission, publication or dissemination to the public of a programme, on the ground of its content, unless that law provides a basis for such a measure.

6.        Damages for abuse of the freedom of expression due to the content of a programme may – under Chapter 9, Paragraph 1, of the Law on freedom of expression – be based only on the ground that the programme which is the subject of the claim for damages entails freedom of expression offences. Identifying a person as having a lifestyle which is criminal or culpable or otherwise providing information which is liable to expose a person to the contempt of others constitutes the crime of defamation and is an interference with the freedom of expression under Chapter 5, Paragraph 1, of the Law on freedom of expression and Chapter 7, Paragraph 3, of the tryckfrihetsförordningen (1949:105) (Ordinance (1949:105) on the freedom of the press). However, such conduct is not punishable if, having regard to the circumstances, it was justified in order to provide information on the matter and if the person who provided the information can show that it was true or that he or she had reasonable grounds for believing it to be true.

II.    Facts, procedure and questions referred

7.        Legal Newsdesk Sweden AB (‘Legal Newsdesk’), the defendant in the main proceedings, operates the database Lexbase and publishes on it the personal details of persons who have been involved in criminal proceedings. In that connection, Legal Newsdesk allows searches to be carried out on individuals and companies that have been the subject of criminal proceedings or civil complaints before a Swedish court. The Myndigheten för press, radio och tv (the Swedish Press and Broadcasting Authority) (now the Mediemyndigheten (the Swedish Media Agency)) issued a so-called utgivningsbevis (certificate of no legal impediment to publication conferring constitutional protection; ‘publication certificate’) to Lexbase.

8.        On 17 January 2011, ND, the applicant in the main proceedings, was convicted of a crime and the relevant sentencing decision was available on Lexbase until February 2024. The sentencing decision has been removed from the public register of criminal records. Although the applicant in the main proceedings requested Legal Newsdesk to delete his personal data, those data were not deleted immediately, but only following a routine check.

9.        ND brought an action before the Attunda tingsrätt (District Court, Attunda), which is the referring court, seeking an order against Legal Newsdesk requiring it to pay damages of 300 000 kronor (SEK) (approximately EUR 26 000), plus interest. Legal Newsdesk contested that claim, arguing that the content published on Lexbase was covered by a publication certificate. However, according to national law, in those circumstances, the GDPR does not apply as such, since the right to the protection of personal data is guaranteed by the constitutional laws on the media, which provide only for the possibility of holding the person responsible for a breach of such protection criminally liable for defamation and for a right to claim compensation in that respect.

10.      In that regard, the referring court notes that Article 85(2) of the GDPR explicitly authorises Member States to provide for exemptions and derogations in relation to the processing of personal data for ‘journalistic purposes’ and, more generally, in order to guarantee the freedom of expression and information. However, with respect to the processing of personal data for ‘journalistic purposes’, the GDPR does not define what is meant by such purposes. Furthermore, even if such purposes were to cover any disclosure of information, opinions or ideas to the public, the case-law does not clarify the effect of Article 85 of the GDPR on the legal remedies that must be made available to data subjects in accordance with Articles 79 and 82 thereof.

11.      It was against that background that, by order of 1 March 2024, received at the Court on 13 March 2024, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1)      Does Article 85(1) of the GDPR make it possible for the Member States to adopt legislative measures in addition to those which they must adopt under Article 85(2) of the regulation relating to the processing of personal data for purposes other than journalistic ones or the purposes of academic, artistic or literary expression?

(2)      If the previous question is answered in the affirmative: Does Article 85(1) of the GDPR allow a reconciliation of the right to the protection of personal data pursuant to that regulation with the freedom of expression and of information which means that the only legal remedy available to a person whose personal data are processed by making criminal convictions involving that person available to the public on the internet in return for payment is the initiation of criminal proceedings for defamation or the claiming of damages for defamation?

(3)      If the first question is answered in the negative or the second question is answered in the negative: Can an activity which consists of making available to the public on the internet in return for payment, without any processing or editing, public documents in the form of criminal convictions constitute processing of personal data for the purposes set out in Article 85(2) of the GDPR?’

12.      Written observations were submitted by the parties to the main proceedings, the Bulgarian, Finnish and Swedish Governments and the European Commission. The parties to the main proceedings, the Kingdom of Sweden and the Commission attended the hearing held on 14 May 2025.

III. Assessment

A.      Questions 1 and 2 – the scope of Article 85(1) and (2) of the GDPR

13.      By its first two questions, which should be examined together, the referring court seeks, in essence, to ascertain whether Article 85(1) of the GDPR must be interpreted as allowing a national law under which the only legal remedy available to a person whose personal data are processed by making criminal convictions involving that person available to the public on the internet in return for payment is the initiation of criminal proceedings for defamation or the claiming of damages for defamation.

1.      The structure of Article 85 of the GDPR

14.      I will first examine the structure and origin of Article 85 of the GDPR.

15.      Under Article 85(1) of the GDPR, Member States shall by law reconcile the right to the protection of personal data pursuant to the GDPR with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

16.      That provision mirrors and seeks to reconcile – a term reminiscent of the wording used in Council of Europe Convention 108 (³) – three distinctive and potentially conflicting fundamental rights contained in the Charter of Fundamental Rights of the European Union (‘the Charter’): the protection of person data, (⁴) freedom of expression and information (⁵) and freedom of the arts and sciences. (⁶)

17.      Since Article 85(1) of the GDPR contains the word ‘including’, I can infer that the activity of journalism constitutes one of several sub-categories of the broader category of the right to freedom of expression and information.

18.      As regards that specific sub-category of processing carried out for journalistic purposes, (⁷) Article 85(2) of the GDPR specifies that Member States are to provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

19.      Turning to the difference and interplay between paragraphs 1 and 2 of Article 85 of the GDPR, while the former sets out the general regulatory mandate and principles, the latter establishes the implementing mechanism for a specific list of areas, by expressly allowing Member States to exempt and derogate from certain chapters of the GDPR.

20.      A few remarks on that provision are in order at this stage.

21.      First, as indicated by the wording of Article 85(1) of the GDPR, (⁸) Member States have an obligation (and not a mere discretionary power) to reconcile data protection with freedom of expression.

22.      Secondly, a specific mechanism for the implementation of that obligation is established only for the processing of data for journalistic purposes or for the purposes of academic, artistic or literary expression. Nowhere does Article 85 of the GDPR specify whether recourse can also be had to that mechanism with regard to other areas coming within the ambit of freedom of expression, but not constituting processing for the aforementioned purposes.

23.      Thirdly, under Article 85(2) of the GDPR, Member States are under an obligation to provide for exemptions and derogations from a number of chapters of the GDPR, thereby limiting the effective scope of those chapters if those exemptions and derogations are necessary to reconcile data protection with freedom of expression. This indicates that there are situations in which data protection must be curtailed in order for it to be compatible and reconcilable with freedom of expression.

24.      Fourthly, when Member States fulfil their obligations under Article 85 of the GDPR, they are acting within the scope of the GDPR. Thus, they are implementing EU law within the meaning of Article 51(1) of the Charter, with the result that the Charter is applicable to that exercise of reconciliation. (⁹)

25.      Fifthly, the task of actually conducting the reconciliation exercise is left to the Member States. It is for them to calibrate that relationship in line with their own legal and constitutional traditions. This inevitably leads to a certain disparity of levels of protection across the European Union, both as regards data protection and as regards freedom of expression, since two potentially opposing rights need to be reconciled. However, that is precisely what the EU legislature intended.

26.      Finally, Article 85 of the GDPR in no way provides a legal basis for Member States to declare the entire GDPR to be inapplicable to certain situations. That is true of both paragraph 1 and paragraph 2 of that provision. Although that point will be for the referring court to verify, it is my contention that Article 85 of the GDPR does not provide a legal basis for the Swedish legislation declaring the GDPR to be inapplicable to the extent that it conflicts with Swedish legislation on freedom of expression.

2.      The relationship between paragraphs 1 and 2 of Article 85 of the GDPR

27.      As stated above, Article 85 of the GDPR is silent on whether recourse can be had to paragraph 2 of that provision in connection with matters falling within the scope of freedom of expression which do not constitute processing for journalistic purposes. (¹⁰) Can a Member State provide for exemptions and derogations from Chapters II to VII and IX even when they do not concern processing for journalistic purposes?

28.      In my view, Member States cannot provide for exemptions and derogations from entire chapters of the GDPR.

29.      First, the fact that Article 85(2) of the GDPR carefully lists a given number of chapters of the GDPR that are to be restricted is an indication that that provision applies only to the specific matter dealt with in that paragraph, that is to say, processing carried out for journalistic purposes.

30.      Secondly, Article 85(3) of the GDPR, which obliges each Member State to notify to the Commission the provisions of its law which it has adopted under paragraph 2, would make little sense if Member States could also, under Article 85(1), provide for exemptions and derogations from the GDPR chapters listed in Article 85(2). Article 85(3) of the GDPR seeks to place the Commission in a position enabling it to carry out a careful screening exercise when Member States have derogated from specific chapters of the GDPR. That objective would be frustrated if Member States could, under Article 85(1) of the GDPR, provide for exemptions and derogations not subject to a notification obligation.

31.      Thirdly, a look at the legislative process leading to the adoption of the GDPR is instructive. It reveals that the Commission, in its initial draft of (what then became) Article 85 of the GDPR, following the logic of the precursor to that provision in Directive 95/46/EC, (¹¹) intended to limit the reconciliation of data protection and freedom of expression to processing carried out solely for journalistic purposes. In that vein, it proposed that the provision in question be composed of two paragraphs, which broadly resemble Article 85(2) and (3) of the GDPR. (¹²) The European Parliament sought to extend the proposed regime to cover freedom of expression in general. It was proposed that the reference to ‘journalistic purposes’ be deleted and replaced by ‘whenever … necessary’. (¹³) However, that proposal was not ultimately taken forward.

32.      The result is Article 85 of the GDPR in its present form. If it were possible for a Member State to adopt the same measures under Article 85(1) as under Article 85(2) of the GDPR, the position of the Parliament which was rejected at that earlier stage would, in effect, prevail.

33.      Ergo, at most, Member States may, in specific circumstances, under Article 85(1) of the GDPR, restrict the rights contained in the GDPR. The precise conditions under which that is possible is, in the present case, hypothetical and would go beyond the scope of the dispute before the referring court.

3.      No exemptions or derogations from Chapter VIII of the GDPR

34.      Furthermore, neither Article 85(1) of the GDPR, nor, indeed, any other provision of the GDPR, allows Member States to restrict the rights conferred on data subjects under Chapter VIII (on remedies, liability and penalties), as that would circumvent the express omission of that chapter from Article 85(2) of the GDPR.

35.      It follows from the information submitted by the referring court that the right to the protection of personal data in the context of the dissemination of data relating to criminal offences is guaranteed only through criminal liability for defamation and the possibility of claiming damages in that respect. The consequence of this is that the national law in question directly excludes several remedies referred to in Chapter VIII in the case of processing of personal data protected by freedom of expression under national law, such as lodging a complaint under Article 77 of the GDPR, as the supervisory authority does not appear to have the power to impose criminal penalties or award compensation. For the same reasons, the national law in question appears to exclude the possibility of obtaining an injunction against the controller under Article 79(1) of the GDPR.

36.      Based on that finding, my proposed reply to the first two questions is that Article 85(1) of the GDPR must be interpreted as precluding a national law under which the only legal remedy available to a person whose personal data are processed by making criminal convictions involving that person available to the public on the internet in return for payment is the initiation of criminal proceedings for defamation or the claiming of damages for defamation.

B.      Question 3 – the concept of ‘journalistic purposes’ in Article 85(2) of the GDPR

37.      By its third question, the referring court seeks to ascertain, in essence, whether an activity which consists of making available to the public on the internet in return for payment, without any processing or editing, public documents in the form of criminal convictions constitutes processing of personal data for journalistic purposes as set out in Article 85(2) of the GDPR. (¹⁴)

38.      At the outset, it should be stressed that the referring court merely seeks guidance on whether the present case falls within the scope of Article 85(2) of the GDPR. By contrast, the referring court does not enquire whether the Kingdom of Sweden has – should Article 85(2) of the GDPR be applicable – correctly reconciled freedom of expression with data protection.

39.      The question is, therefore, whether the Legal Newsdesk database is a database for journalistic purposes.

40.      In the absence of a clear definition, the starting point in order to interpret what is meant by the term ‘journalistic purposes’ must be its ordinary meaning. Here, standard dictionaries offer a rather narrow definition of ‘journalism’: ‘the work of collecting and writing news stories for newspapers, magazines, radio, television or online news sites; the news stories that are written’; (¹⁵) ‘the work of writing articles for newspapers, magazines, television, or radio’. (¹⁶)

41.      We can, at this stage, rely to a large extent on the Court’s case-law on Article 9 of Directive 95/46, the precursor to Article 85 of the GDPR. In that case-law, the Court has held that notions relating to the right to freedom of expression, such as journalism, are to be interpreted broadly, (¹⁷)thereby demonstrating that the reconciliation of data protection with freedom of expression does not follow the traditional rule-exception system. Moreover, activities involving the systematic collection and publication of comprehensive lists of personal tax data, derived from public records and subsequently published, may be classified as ‘journalistic activities’ if their object is the disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them. They are not limited to media undertakings and may be undertaken for profit-making purposes. (¹⁸)

42.      Furthermore, as the Commission correctly pointed out, journalistic purposes are not necessarily linked to traditional media such as newspapers, radio and television. (¹⁹) The Court has thus held that the exemptions and derogations provided for in Article 9 of Directive 95/46 apply not only to media undertakings but also to every person engaged in journalism, (²⁰) meaning that, in principle, bloggers and individuals can also rely on Article 85(2) of the GDPR.

43.      In addition, the fact that the publication of data within the public domain is done for profit-making purposes does not, prima facie, preclude such publication being considered as an activity undertaken ‘solely for journalistic purposes’. Every undertaking will seek to generate a profit from its activities. A degree of commercial success may even be essential to professional journalistic activity. (²¹)

44.      Yet, in a case concerning whether the recording and publication on a public video website of a video of police officers performing their duties in a police station fell within the scope of Article 9 of Directive 95/46, the Court held that the view cannot be taken that all information published on the internet, involving personal data, comes under the concept of ‘journalistic activities’ and thus benefits from the exemptions or derogations provided for in Article 9 of Directive 95/46. (²²)

45.      Finally, the Court tends to afford considerable leeway to the referring courts in determining whether there is actual processing for journalistic purposes in the cases at issue. In that connection, it places importance on whether the sole purpose of a publication is ‘the disclosure to the public of information, opinions or ideas’. (²³)

46.      While it will ultimately be for the referring court to apply that case-law to the dispute before it, based on the information contained in the order for reference, I do not think that the purpose of the processing by Legal Newsdesk is the public disclosure of information, opinions or ideas. (²⁴) All the company does is operate a database providing access solely to criminal court decisions, without any further processing or editing of those data. I doubt that that information on criminal convictions is published in order to draw the attention of society to a particular issue. Rather, one is left with the impression, as the Commission also convincingly argued, that Legal Newsdesk makes such information available only to those who pay for it, without there being any indication that the company aims, more generally, to draw the public’s attention to that information.

47.      Having regard to the above considerations, I find it difficult to propose that such an activity should be considered to be carried out for journalistic purposes.

48.      My proposed reply to the third question is therefore that Article 85(2) of the GDPR must be interpreted as meaning that an activity which consists of making available to the public on the internet in return for payment, without any processing or editing, public documents in the form of criminal convictions does not constitute processing of personal data for journalistic purposes.

IV.    Conclusion

49.      In the light of all the foregoing considerations, I propose that the Court should answer the questions referred for a preliminary ruling by the Attunda tingsrätt (District Court, Attunda, Sweden) as follows:

(1)      Article 85(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as precluding a national law under which the only legal remedy available to a person whose personal data are processed by making criminal convictions involving that person available to the public on the internet in return for payment is the initiation of criminal proceedings for defamation or the claiming of damages for defamation.

(2)      Article 85(2) of Regulation 2016/679

must be interpreted as meaning that an activity which consists of making available to the public on the internet in return for payment, without any processing or editing, public documents in the form of criminal convictions does not constitute processing of personal data for journalistic purposes.