The Court of Justice of the European Union has clarified the relationship between the GDPR and freedom of expression, ruling that national legislation cannot exclude the application of the regulation for a database of criminal convictions that does not pursue a journalistic purpose.
The case arises from a Swedish company operating a paid database of criminal convictions. A data subject, having obtained the erasure of their data belatedly, claimed damages under the GDPR. The company invoked national law which, in the name of freedom of expression, excludes the application of the GDPR and limits remedies to a defamation action. The Court recalled that while Member States must reconcile data protection and freedom of expression, they can only provide derogations to the GDPR if necessary and for specific purposes, such as journalistic ones. They cannot deprive the data subject of the remedies guaranteed by the regulation. The Court specified that the qualification of "journalistic purposes" implies processing aimed at informing the public according to ethical rules and after verification, which does not seem to be the case for the mere paid online publication of convictions, subject to the assessment of the national court.