EU court says paid criminal records online breach GDPR

The European Union's top court said Thursday that putting criminal conviction records online for payment does not in principle count as journalism and can violate data protection rights.

The Court of Justice of the European Union gave the guidance after a Swedish district court asked about a case involving Lexbase, a database that allowed users to search whether someone had criminal convictions and then access the records.

The case was brought by a person convicted in 2011 who asked for his personal data to be removed from the database. The data was removed much later under the company's internal data storage policy, and the man sued in Sweden seeking damages under the EU's General Data Protection Regulation.

The company argued that, as a publisher, its database was protected under Sweden's constitutional protection of freedom of expression. The EU court said Swedish law can prevent GDPR from applying in such cases, leaving defamation proceedings as the only way for a person to assert data protection rights.

The court said GDPR requires states to reconcile personal data protection with freedom of expression and information, including journalism. It said journalistic processing is linked to informing the public or disclosing opinions or ideas through content prepared under ethical rules, codes of conduct or an editorial policy.

Merely placing criminal convictions online in return for payment does not appear to meet those conditions, the court said.

Lexbase has been popular in Sweden but has also faced debate over personal integrity. Public broadcaster SVT said three parliamentary inquiries had examined limiting such services, but none had led to new legislation.