The European Union’s top court has struck a major blow to Swedish data brokers attempting to bypass privacy laws using press credentials, according to a new report by Courthouse News.
The Court of Justice of the European Union (CJEU) ruled that holding a Swedish publication certificate is not enough to automatically shield a publisher from the General Data Protection Regulation (GDPR). The landmark decision significantly narrows the "journalism exemption," establishing that simply republishing public data for profit does not qualify as journalism.
Defining 'Journalism' Under EU Privacy Law
As detailed by Courthouse News reporter Eunseo Hong, the judges determined that while charging users or handling criminal conviction data doesn't explicitly disqualify a platform from journalistic status, the platform must prove it genuinely serves a journalistic purpose.
To qualify for the GDPR exemption, the court stated that an organization must disclose information "in compliance with ethical rules and codes of conduct, following editing or adaptation... and after verification of the factual allegations concerned."
Lorna Woods, an internet law professor at the University of Essex, told the publication that the ruling draws a firm boundary between actual journalism and raw data distribution.
Maximilian Gerhold, a media law specialist, echoed this sentiment to Courthouse News, noting that the "mere publication of personal data can no longer be regarded as privileged." Gerhold added that Sweden will now be forced to rethink how it balances its long-standing tradition of government transparency with strict EU privacy standards.
A "Webshop for Criminal Convictions"
The ruling is expected to have sweeping implications for Sweden's data-broker industry. According to the report, companies in Sweden have long utilized state-issued constitutional protections for freedom of expression to legally distribute personal data. This loophole effectively shut down GDPR remedies for affected individuals, leaving them with limited options like defamation lawsuits.
Joakim Söderberg, a data protection lawyer at the European Center for Digital Rights (Noyb), welcomed the decision.
“Being a webshop for criminal convictions isn’t really the same thing as being a journalist,” Söderberg told Courthouse News. He called the judgment a "wake-up call" for Swedish lawmakers, arguing that public authorities should stop selling personal data to commercial brokers who then hide behind media permits.
Jan Södergren, the human rights lawyer who represented the plaintiff (identified as "ND") before the CJEU, emphasized to the publication that businesses republishing public court records for a fee without editorial oversight are now directly subject to standard GDPR compensation claims.
The Immediate Fallout
According to the report, the immediate legal test will fall to Sweden's Attunda District Court. The local court is now tasked with evaluating whether Lexbase—the specific database at the center of the dispute—actually performed editorial work and followed the journalistic ethics outlined by the EU judges.
If the court finds that Lexbase operated strictly as a data broker rather than a news organization, the company will lose its constitutional shield and face full GDPR enforcement.
(Legal Newsdesk Sweden did not respond to requests for comment from Courthouse News.)