CJEU C-199/24 Legal Newsdesk Sweden: Criminal Convictions Data and Article 85 GDPR
Article 10 GDPR governs data relating to criminal convictions and offences under a strict autonomous regime requiring official authority control or specific statutory authorization. The CJEU ruling C-199/24 excludes, in principle, the journalistic exemption for the commercial publication of criminal court records.
The Autonomous Legal Regime of Criminal Data (Art. 10)
Article 10 GDPR covers personal data relating to criminal convictions and offences or related security measures. They do not fall under the special categories of Article 9, but are subject to a separate and particularly stringent autonomous regime.
Processing of such data shall be carried out only under the control of official authority or when the processing is authorized by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.
- Document the statutory legal authorization and implemented safeguards prior to any collection or reuse;
- Strictly limit access, dissemination, and retention periods to what is strictly necessary;
- Do not infer from public availability that criminal record data may be freely republished or commercialized.
CJEU C-199/24: Commercial Publication and Journalistic Exemption
In its judgment Legal Newsdesk Sweden of 9 July 2026, the CJEU held that the mere making available online, against payment, of court decisions concerning criminal convictions does not constitute, in principle, processing for journalistic purposes within the meaning of Article 85 GDPR.
To recognize a journalistic purpose, the national court must examine in particular whether the objective is to inform the public or debate ideas, and verify the existence of genuine editorial processing, factual verification, and compliance with ethical standards.
- Exemptions designed to reconcile data protection with freedom of expression do not apply automatically to a raw commercial database of criminal decisions;
- Legal remedies provided for by the GDPR, including complaints to supervisory authorities, judicial remedies, and compensation, cannot be circumvented in favor of sole national defamation actions.
The ruling interprets Articles 77 to 82 and 85 of the GDPR. It does not determine the national dispute itself nor individual erasure requests.
Verified Official Sources
Mise à disposition en ligne, contre rémunération, de décisions relatives à des condamnations pénales : cette activité ne relève pas, en principe, de fins journalistiques (Art. 85) ; les voies de recours prévues par le RGPD demeurent applicables (Art. 77 à 82).
Consult official source →General Data Protection Regulation — EU Reference Legal Framework
Consult official source →See Also in the Legal Framework
Article 10 GDPR : Criminal Data, Statutory Safeguards and Legal Newsdesk Sweden Ruling
Regime of Article 10 GDPR applicable to criminal convictions, offences and security measures: legal basis, safeguards an...
Article 17 GDPR : The Right to Erasure and Lawful Exceptions
Conditions for applying Article 17 GDPR: 6 legitimate grounds for erasure, 5 statutory exceptions (freedom of expression...