The Court of Justice of the European Union ruled on 9 July 2026 that selling access to court judgments does not, in itself, make a company a publisher, and that no member state may switch off the regulation's remedies by invoking its own constitution.

The Fifth Chamber delivered its judgment in Case C-199/24, ND v Legal Newsdesk Sweden AB, on 9 July 2026 in Luxembourg. Three questions had been referred by the Attunda tingsrätt, a district court north of Stockholm. All three were answered against the operator of a commercial database of Swedish criminal convictions, and the reasoning reaches well beyond the company that lost.

At issue was Article 85 of the GDPR, the provision that instructs member states to reconcile data protection with freedom of expression. Sweden had read that instruction expansively. The court read it narrowly, and in doing so drew a line that any organisation monetising personal data will now have to locate itself against.

What the court decided

The judgment is short in its operative part and dense in its reasoning. Three rulings emerged.

First, Article 85(1) does not authorise member states to legislate beyond what Article 85(2) permits. National measures cannot introduce derogations from chapters of the regulation for processing carried out for purposes other than journalistic, academic, artistic or literary expression, even where a government argues that such measures are necessary to balance data protection against free expression.

Second, member states may not reduce a convicted person's legal remedies to defamation proceedings alone. Where personal data about criminal convictions are made available online for payment, the affected individual retains the remedies granted directly by the regulation.

Third, making public documents consisting of criminal convictions available online in return for payment cannot be treated as processing for journalistic purposes unless the activity meets a defined set of conditions: disclosure to the public of information, opinions or ideas, in compliance with the ethical rules and codes of conduct of the journalistic profession, following editing or adaptation or at least an editorial policy, and after verification of the factual allegations concerned.

According to the Court of Justice press release issued on 9 July 2026, the act of placing criminal convictions online for payment "does not appear" to satisfy those conditions, subject to verification by the national court.

From a 2011 conviction to Luxembourg

The facts are narrow. Legal Newsdesk Sweden AB, formerly Garrapatica AB, operates Lexbase, a database allowing searches on individuals and companies that have been party to criminal proceedings before Swedish courts. The applicant, identified in the proceedings as ND, was convicted of a criminal offence by a judgment dated 17 January 2011. That judgment was published on Lexbase and remained accessible until February 2024.

ND asked the company to erase his personal data. The data were not removed immediately. Erasure came later, and on the basis of the company's own internal data storage policy rather than in response to the request. ND then sued at the Attunda tingsrätt, seeking damages of 300,000 Swedish kronor, roughly 26,000 euros, plus interest.

The defence turned on a single Swedish instrument. Legal Newsdesk Sweden invoked its utgivningsbevis, a certificate of constitutional protection for freedom of expression issued by the Myndigheten för press, radio och tv, the Swedish Press and Broadcasting Authority. Under Swedish law, that certificate has a striking consequence: it removes the database from the reach of the GDPR altogether.

The Swedish constitutional architecture

Two laws of constitutional status govern the area. The Tryckfrihetsförordningen (1949:105) covers freedom of the press. The Yttrandefrihetsgrundlagen (1991:1469) covers freedom of expression, including certain categories of website where a certificate has been granted.

The bridge to European law sits in Chapter 1, Paragraph 7 of Law 2018:218 of 19 April 2018, which provides that the GDPR does not apply where its application would contravene either constitutional law. The practical effect for a certificate holder is that the only routes open to an aggrieved individual are criminal proceedings for defamation or a civil claim for defamation damages. Under the Yttrandefrihetsgrundlagen, identifying someone as having a criminal or culpable lifestyle can constitute defamation, but the act is not punishable where disclosure was justified and the information was true or reasonably believed to be true.

That is a materially higher bar than the regulation's own remedies, which require neither falsity nor reputational damage. The referring court, harbouring doubts about the compatibility of this arrangement with EU law, stayed proceedings and referred its questions by decision of 1 March 2024. The reference reached the Court of Justice on 13 March 2024 and was published in the Official Journal on 3 May 2024.

Article 85 read against its own wording

The court began with text. Article 85(1) requires member states to reconcile the two rights by law. It says nothing about exemptions or derogations. Article 85(2), by contrast, requires exemptions or derogations from Chapters II to VII and IX where necessary, and only for processing carried out for journalistic purposes or for academic, artistic or literary expression.

The judges characterised the first paragraph as a general obligation and the second as a special rule confined to those specific purposes. Recital 153 supports that division, describing the objective of Article 85 as enabling derogations solely in the context of those forms of expression. Because Article 85(2) defines its scope exhaustively, the exemptions it authorises must be construed strictly.

Advocate General Maciej Szpunar, whose opinion was delivered on 4 September 2025 in English, had noted that the word "including" in Article 85(1) shows that journalistic and expressive processing form only part of what may be reconciled under that paragraph. The court accepted the linguistic point and declined to draw the consequence Sweden wanted from it. Reconciliation under paragraph 1 may be broad. The power to derogate under paragraph 2 is not.

Remedies that cannot be switched off

The second ruling is the one with the widest practical reach, and it rests on an argument from omission.

Chapter VIII of the regulation, headed remedies, liability and penalties, contains Article 77(1) on complaints to a supervisory authority, Article 78(1) and (2) on judicial remedies against supervisory authorities, Article 79(1) on judicial remedies against controllers and processors, and Article 82(1) on compensation for material and non-material damage. Chapter VIII does not appear in the list of chapters from which Article 85(2) permits derogation.

The court drew the inference directly. If Article 85(1) cannot authorise the derogations contemplated by Article 85(2) for non-qualifying purposes, it cannot authorise derogation from Chapter VIII either. Those provisions are directly applicable and confer rights that member states may not subject to substantive conditions of their own devising.

Procedural autonomy survives, within limits. Member states set the detailed procedural rules for exercising the remedies, provided those rules are no less favourable than those applying to comparable domestic situations and do not make the exercise of EU rights impossible in practice or excessively difficult. The distinction the judgment draws is between procedure, which remains national, and substance, which does not.

A three-part test for journalism

The third question forced the court to say what journalism is for the purposes of European data protection law, a definition the regulation itself never supplies.

The Bulgarian government argued the question was inadmissible, on the basis that the referring court's account did not permit the purpose of the processing to be identified or its compliance with Article 10 to be assessed. The court disagreed: interpreting the term does not require knowledge of the specific purpose, and questions referred by national courts enjoy a presumption of relevance.

On substance, the judges assembled a test from case law of the European Court of Human Rights, imported through Article 52(3) of the Charter. Three elements emerged. Journalistic activity presupposes editing or adaptation of the material disclosed, carried out on a regular or professional basis, or at minimum publication in accordance with editorial decisions. It presupposes that factual allegations have been verified to a sufficient standard of reliability. And it presupposes compliance with the profession's ethical rules and codes of conduct.

The court also read the word "purposes" to extend the scope of Article 85(2) backwards through the production process. Processing necessary for publication qualifies, not merely the act of publication itself. Because journalistic work involves selection and prioritisation, the reasoning covers operations on personal data contained in material that was gathered and ultimately not used. That point protects newsroom pipelines rather than restricting them.

Applied to Lexbase, the test produced a negative answer. Making conviction documents available online for a fee does not appear to require editing or adaptation, nor to follow an editorial policy, and nothing before the court indicated the company was subject to journalistic ethical rules. The judges added a further condition: documents of that kind may be genuinely useful to journalists, but processing them counts as journalistic only where they are intended exclusively for such activity. Where anyone can retrieve a conviction on the sole condition of payment, that exclusivity is absent.

Verification of each of these points falls to the Attunda tingsrätt.

What does not disqualify a publisher

The judgment is careful about what it does not decide. Two features of the Lexbase model were expressly held to be irrelevant to the classification question.

Operating online and charging for access do not preclude journalistic purposes. The court cited its own 2008 ruling in Satakunnan Markkinapörssi and Satamedia, which had reached the same conclusion about commercial data services. Nor does the fact that processing concerns criminal convictions rule out journalistic purposes at the classification stage, even though Article 10 subjects such data to special protection and reserves comprehensive registers of convictions to official authority.

Sensitivity of the data, the number of people with access and the arrangements for that access remain relevant, but at a later stage: when assessing whether a derogation from a particular provision is justified, not when deciding whether the activity is journalism at all. The sequence matters for anyone building a compliance argument.

Why this matters for the marketing community

The commercial reading of this judgment has little to do with Swedish court records and a great deal to do with the structure of Article 85.

Any business that processes personal data and has been relying on a national freedom-of-expression carve-out now knows the outer boundary of that shelter. The list in Article 85(2) is exhaustive and to be read strictly, and Chapter VIII sits outside it. Data subject complaints, judicial remedies and Article 82 compensation claims survive whatever a member state has legislated. For firms in identity resolution, people search, business data enrichment and lead generation, the exposure is a direct damages claim rather than a regulatory conversation.

That exposure is not theoretical. German courts have been awarding Article 82 damages in tracking cases, with a Leipzig court granting 5,000 euros in July 2025 and a Thuringian Higher Regional Court awarding 3,000 euros in March 2026, the fourth Higher Regional Court in Germany to find for claimants in Meta Business Tools proceedings. Private litigation is where the boundaries drawn on 9 July 2026 will be tested first.

The three-part journalism test also lands at an awkward moment for a media industry restructuring around automated content. Editing or adaptation, an editorial policy, verified facts and adherence to professional ethical codes are now the criteria that separate a publisher from a data vendor under European data protection law. Sites that aggregate and republish without an editorial layer sit on the wrong side of that line, whatever their masthead says.

Enforcement context sharpens the point. National authorities issued 1,145,760,374 euros in GDPR fines during 2025 according to the EDPB's annual report, published on 9 April 2026, while an analysis published in May 2026 found that close to 40 percent of 7.1 billion euros in cumulative fines has been annulled or is under challenge. Administrative penalties are contested and often reduced. Individual claims under Chapter VIII are harder to neutralise, which is precisely why a ruling protecting them carries weight.

Sweden's supervisory authority has already been active in adjacent territory. IMY issued a reprimand to Flightradar24 in June 2025 over its handling of erasure requests and identity verification demands, and fined Apoteket and Apohem 45 million kronor in 2024 for transferring sensitive customer data to Meta through the pixel. Neither case involved a publishing certificate. After 9 July 2026, the certificate is a weaker answer than it was.

The wider legislative picture is unsettled. The European Commission's Digital Omnibus, published on 19 November 2025, proposes amendments to the definition of personal data, the legitimate interest basis, the special categories regime and the impact assessment framework, and would have inserted a machine-readable consent signal as Article 88b. The Council removed that provision in June 2026 after lobbying in which Google played a central part, and the EDPB and EDPS had already objected to the package in a joint opinion of 10 February 2026. None of the documented proposals reopens Article 85. The interpretation handed down on 9 July 2026 therefore stands whatever the simplification negotiations produce.

For publishers specifically, the judgment cuts in two directions. It confirms that preparatory processing, including data that never reaches publication, falls within the journalistic shelter, which is a genuine protection for investigative work. It also confirms that the shelter is conditional on professional practice that can be demonstrated to a court. Swedish and Norwegian publishers currently defending pay-or-okay consent structures are learning the same lesson from a different angle: constitutional and commercial framing does not substitute for compliance with the regulation as written.

Timeline

  • 24 October 1995: Directive 95/46/EC adopted, with Article 9 requiring member states to provide exemptions for processing carried out solely for journalistic, artistic or literary purposes
  • 16 December 2008: Court of Justice rules in Satakunnan Markkinapörssi and Satamedia that commercial and online distribution does not preclude journalistic activity
  • 17 January 2011: ND convicted of a criminal offence by a Swedish court judgment later published on the Lexbase database
  • 27 April 2016: Regulation (EU) 2016/679 adopted, replacing Directive 95/46/EC with effect from 25 May 2018
  • 19 April 2018: Sweden adopts Law 2018:218, providing that the GDPR does not apply where application would contravene its constitutional laws on press and expression freedom
  • February 2024: ND's conviction judgment ceases to be accessible on Lexbase, following erasure under the company's internal data storage policy
  • 1 March 2024: Attunda tingsrätt decides to refer three questions to the Court of Justice
  • 13 March 2024: Reference received at the Court of Justice as Case C-199/24
  • 3 May 2024: Application published in the Official Journal
  • 4 October 2024: Court of Justice rules that Meta must minimise personal data used for targeted advertising
  • 14 May 2025: Hearing held before the Fifth Chamber
  • 4 September 2025: Advocate General Szpunar delivers his opinion, in English
  • 19 November 2025: European Commission publishes the Digital Omnibus package, proposing substantial GDPR amendments
  • 10 February 2026: EDPB and EDPS adopt a joint opinion rejecting key elements of the proposal
  • 9 April 2026: EDPB publishes its 2025 annual report, recording 1,145,760,374 euros in GDPR fines for the year
  • 18 June 2026: EU Council publishes a compromise text removing Article 88b from the Digital Omnibus
  • 9 July 2026: Fifth Chamber delivers judgment in Case C-199/24, with the abstract published the same day

Summary

Who: The Fifth Chamber of the Court of Justice of the European Union, composed of M. L. Arastey Sahún as President of the Chamber, J. Passer, E. Regan as Rapporteur, D. Gratsias and B. Smulders, with Advocate General Maciej Szpunar and Registrar C. Strömholm. The parties were ND, an individual convicted in 2011, and Legal Newsdesk Sweden AB, formerly Garrapatica AB, operator of the Lexbase database. The Swedish, Bulgarian and Finnish governments and the European Commission submitted observations.

What: A preliminary ruling in Case C-199/24 holding that Article 85(1) of the GDPR does not permit member states to derogate from the regulation for processing outside journalistic, academic, artistic or literary purposes; that national law may not reduce an affected person's remedies to defamation proceedings; and that publishing criminal conviction documents online for payment is not processing for journalistic purposes unless it involves editing or adaptation or an editorial policy, verification of facts, and compliance with journalistic ethical codes.

When: The judgment was delivered on 9 July 2026. The reference was made by decision of 1 March 2024 and received on 13 March 2024, the hearing was held on 14 May 2025, and the Advocate General's opinion was delivered on 4 September 2025.

Where: The Court of Justice in Luxembourg, on a reference from the Attunda tingsrätt in Sweden. The interpretation binds courts across all 27 member states and applies throughout the European Economic Area.

Why: Sweden had used constitutional protections for freedom of expression, activated by a publishing certificate, to remove a commercial conviction database from the GDPR's scope entirely, leaving affected individuals only defamation remedies. The court held that Article 85(2) defines the available derogations exhaustively and that Chapter VIII remedies, including the Article 82 right to compensation, cannot be displaced by national law. The ruling narrows the freedom-of-expression shelter for any organisation that monetises personal data and sets out, for the first time in Court of Justice case law, the criteria that distinguish journalism from data distribution under European data protection law.