The Swedish Data Protection Authority ruled that national exemptions, even constitutional ones, cannot override the application of the GDPR for people search services, under the principle of primacy of Union law, especially when the activity does not pursue a journalistic purpose.

Facts and context

The Swedish Data Protection Authority (IMY) published four sanction decisions against the companies Legal Newsdesk Sweden AB (operating the Lexbase service), Fuplex AB (operating the Krimfup service), Nusvar AB (operating the MrKoll service) and Upplysning Checknode AB (operating the Upplysning service), including reprimands for breaches related to the processing of data concerning criminal convictions and the right to erasure.

The origin of the case lies in approximately 3,800 complaints received by the authority concerning the search services offered by these four companies.

Grounds of the decision

The authority first analyzed the conflict between Swedish national law and Union law. The four companies benefit in Sweden from constitutional protection through "voluntary publication certificates," which, according to Swedish regulation, exempt them from the application of the GDPR. However, IMY considered that these national exemptions went beyond what Union law permits. Noting that the search services are not operated for journalistic purposes and relying on recent case law from the Swedish Supreme Court and the Court of Justice of the European Union, the authority concluded that Union law must prevail and that the GDPR therefore applies.

• Obligation regarding the processing of personal data relating to criminal convictions and offences (Article 10 of the GDPR): The authority found that Legal Newsdesk Sweden AB and Fuplex AB processed data relating to criminal offences without an appropriate legal basis. Under the principle of primacy, IMY dismissed the national exemption and ruled that these processes, which allowed searches by name, personal identification number and address, violated the requirements of Article 10 of the GDPR.
• Obligation to respect the right to erasure (Article 17 of the GDPR): Regarding Nusvar AB and Upplysning Checknode AB, the authority determined that they did not respect the right to erasure of the data subjects. Applying the same reasoning on the primacy of Union law, IMY concluded that these companies were fully subject to the obligations of the GDPR and failed to comply with erasure requests.

Decision of the authority

Consequently, the authority issued reprimands against the four companies.

Furthermore, the authority ordered Legal Newsdesk Sweden AB and Fuplex AB to take the necessary measures so that users can no longer access data relating to criminal offences when searches are conducted based on name, personal identification number or address.

Lessons learned

This decision reminds that:

• The principle of primacy of European Union law opposes any national legislation, even constitutional in nature, establishing a general exemption to the GDPR that exceeds the authorized derogations, especially for activities that do not pursue journalistic purposes.
• The qualification of activity as "journalistic purposes" must be interpreted strictly and does not apply extensively to large-scale people search services, even if they benefit from a publication status under national law.
• Online services that compile and make accessible large sets of personal data, including sensitive data such as those relating to offences, are fully subject to the obligations of the GDPR, notably regarding the legal basis of processing and respect for data subjects' rights.