Article 10 GDPR : Criminal Data, Statutory Safeguards and Legal Newsdesk Sweden Ruling
Article 10 GDPR governs personal data relating to criminal convictions and offences through an autonomous regime: under the control of official authority or authorised by specific law providing appropriate safeguards. CJEU judgment C-199/24 excludes, in principle, the journalistic exception for raw commercial publication of criminal convictions.
The Autonomous Legal Regime for Criminal Data (Art. 10 GDPR)
Article 10 applies to personal data relating to criminal convictions and offences or related security measures. They do not fall under Article 9 special categories, but are governed by a distinct and particularly strict autonomous regime.
Their processing shall be carried out only under the control of official authority or when authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.
- Document the applicable legal enabling statute and safeguards implemented prior to any collection or reuse;
- Strictly limit access, dissemination, and retention periods to what is strictly necessary;
- Never infer from public court availability that criminal records data can be freely republished or commercialised.
CJEU C-199/24: Commercial Publication and Journalistic Exemption
In the Legal Newsdesk Sweden judgment of 9 July 2026, the CJEU held that the mere making available online, for remuneration, of decisions relating to criminal convictions does not, in principle, constitute processing for journalistic purposes within the meaning of Article 85 GDPR.
To establish a journalistic purpose, national courts must examine whether the activity aims to inform the public or disclose opinions and ideas, as well as the existence of editorial work, fact-checking, and adherence to ethical standards or an editorial policy.
- Derogations intended to reconcile data protection with freedom of expression do not automatically apply to a commercial database of criminal decisions;
- Legal remedies provided by the GDPR, including complaints, judicial remedies and compensation, cannot be circumvented solely in favour of defamation law.
The judgment interprets Articles 77 to 82 and 85 GDPR. It does not itself adjudicate the underlying national proceedings or an individual erasure request.
Verified Official Sources
General Data Protection Regulation — EU Reference Legal Framework
Consult official source →Mise à disposition en ligne, contre rémunération, de décisions relatives à des condamnations pénales : cette activité ne relève pas, en principe, de fins journalistiques (Art. 85) ; les voies de recours prévues par le RGPD demeurent applicables (Art. 77 à 82).
Consult official source →See Also in the Legal Framework
Article 9 GDPR : Prohibition Principle and Exceptions for Sensitive Data
Legal regime of Article 9 GDPR: general prohibition of processing sensitive data (health, biometric, political opinions)...
Article 17 GDPR : The Right to Erasure and Lawful Exceptions
Conditions for applying Article 17 GDPR: 6 legitimate grounds for erasure, 5 statutory exceptions (freedom of expression...
CJEU C-199/24 Legal Newsdesk Sweden: Criminal Convictions Data and Article 85 GDPR
CJEU judgment of 9 July 2026 (ECLI:EU:C:2026:564): commercial publication of criminal conviction records does not fall, ...