Does a press certificate exempt data brokers from GDPR?

Under Swedish constitutional law, any entity that holds a press certificate (Sw. utgivningsbevis) issued by the Swedish Press and Broadcasting Authority (MPRT) is treated as a protected media outlet. As a result, Swedish law generally excludes the GDPR for such entities, leaving individuals with few options but defamation claims as their only practical remedy for misuse of personal data. In practice, this framework has been exploited by commercial data brokers — companies that sell access to databases of personal information, including criminal records — to shield themselves from data-protection obligations by claiming press status. The resulting tension between EU data-protection law and Swedish press-freedom rules has been one of the most debated issues in the Nordic privacy community. On 9 July 2026, the EU Court of Justice delivered its long-awaited preliminary ruling in Case C-199/24, settling the key questions on where the boundary lies between protected journalism and commercial data brokerage.

The case concerned Lexbase, a company operating a paid online database of Swedish criminal records. When a data subject whose 2011 conviction appeared in the database requested erasure, Lexbase refused. This data subject brought a claim for SEK 300,000 (approx. EUR 26,000) in GDPR damages plus interest. The referring Swedish court stayed the proceedings and referred the matter to the CJEU for a preliminary ruling. The Court answered as follows.

A press certificate does not automatically exempt a company from GDPR. The exemption only applies where the underlying activity genuinely qualifies as journalism — or academic, artistic, or literary work. If it does not, GDPR applies in full. Running a commercial database that sells access to personal data without any real editorial process is not journalism, and a press certificate will not change that. In the Court’s words, Article 85(1) GDPR precludes measures that “introduce derogations from certain chapters of [GDPR] in respect of the processing of personal data for purposes other than journalistic purposes or the purposes of academic, artistic or literary expression.”

Even if a company’s press certificate gives it a valid journalism exemption, that does not leave individuals without rights. They can still file a complaint with the supervisory authority, take the company to court, and claim financial compensation for any GDPR breach. A legal framework that offers only a defamation claim does not meet EU law requirements. The Court ruled that Article 85(1) GDPR precludes national measures from providing that “the only legal remedies available” are “the possibility to bring criminal proceedings for defamation or to bring an action for compensation for the damage suffered as a result of having been defamed.”

To qualify as journalism under EU law, an activity needs a genuine public-interest purpose, real editorial decisions about what to publish and why, compliance with journalistic professional ethics, and fact-verification. Simply uploading court documents and charging for access does not come close. The Court ruled that Article 85(2) GDPR “must be interpreted as meaning that making available to the public on the internet, in return for payment, public documents consisting of criminal convictions cannot be regarded as processing of personal data carried out for ‘journalistic purposes’” — unless the activity has as its purpose the disclosure of information, opinions or ideas to the public, in compliance with journalistic ethics, after editing or adaptation or at least in accordance with an editorial policy, and after verification of the facts. Lexbase did not appear to meet those criteria.