Public access to judgments serves open justice and public scrutiny. It is not, however, the same operation as taking a judgment from the competent court and republishing it indefinitely through a private service where anyone can search for a person by name and pay to retrieve an old criminal conviction.

That distinction is central to the judgment of the Court of Justice of the European Union (Fifth Chamber) in Case C-199/24, ND v Legal Newsdesk Sweden AB, delivered on 9 July 2026, ECLI:EU:C:2026:564 and CELEX:62024CJ0199. The Court did not ban legal databases. It explained when processing may be carried out for journalistic purposes and why freedom of expression cannot be used to remove the remedies provided by the GDPR.

On 30 August 2026, both CURIA and EUR-Lex still displayed the label “Provisional text”. The judgment has been delivered and InfoCuria records the EU case as closed. The label describes the status of the text currently published by the official services; it does not mean that the Court has not ruled. The referring Swedish court must still apply the interpretation to the facts and decide ND's claim.

1. The case and the Swedish court's questions

Legal Newsdesk Sweden operates Lexbase, a database through which users can search for natural and legal persons involved in criminal proceedings in Sweden. ND was convicted by a judgment of 17 January 2011. That judgment remained accessible in the database until February 2024. After ND requested erasure, the data were not removed immediately; they were removed later under the company's own retention policy.

ND asked the Attunda District Court to award SEK 300,000, approximately EUR 26,000, as compensation for an alleged GDPR infringement. The company argued that its service was covered by a Swedish certificate granting constitutional protection for freedom of expression. According to the referring court's description, that national regime left only criminal prosecution for defamation or a civil claim for defamation as possible avenues.

The Court of Justice was asked to interpret EU law. It did not establish whether every factual statement made about Lexbase was correct, whether Article 10 had been infringed, or whether ND had proved damage. Those matters remain for the national court.

2. Article 85 is not a second, unlimited exception

Article 85(1) GDPR requires Member States to reconcile by law the protection of personal data with freedom of expression and information. Article 85(2) permits necessary exemptions or derogations from specified chapters of the GDPR for processing carried out for journalistic purposes or for academic, artistic or literary expression.

The Court held that paragraph 1 is not an independent power to create general derogations beyond the framework set by paragraph 2. A Member State cannot expand the listed purposes or the chapters from which derogation is permitted simply by relying on a general balancing exercise. Because these are significant exceptions to GDPR safeguards, they require a strict reading and a fair balance between Articles 8 and 11 of the Charter of Fundamental Rights.

This does not diminish journalistic freedom. It protects its particular function: extensive derogations can be justified where the processing genuinely serves one of the purposes identified in Article 85(2), rather than merely carrying a journalistic label.

3. What demonstrates a genuine journalistic purpose

The concept of journalism is interpreted broadly. It is not confined to a traditional newspaper, a person holding a particular professional title, or material offered free of charge. The activity must aim to disclose information, opinions or ideas to the public. The medium may be digital and the service may be commercial.

A broad interpretation does not turn every public statement or every republication of a document into journalism. The Court identified practical indicators:

  • Selection and prioritisation: there should be real editorial decisions about what is published and why.
  • Processing or adaptation: material will commonly be placed in an informative context; at minimum, publication should follow a discernible editorial policy.
  • Verification: factual claims supporting the information provided to the public should be checked so that they are sufficiently reliable.
  • Ethics: the activity should be governed by professional rules and codes of conduct.
  • Informative aim: the processing should communicate information, opinions or ideas, rather than merely make a name-indexed archive available.

The test concerns purpose, not only the final act of publication. Gathering and reviewing material that is ultimately not selected may also be journalistic processing when it is necessary for editorial work.

4. Payment and conviction data do not decide the issue automatically

Two careful distinctions matter. First, charging the user does not by itself rule out a journalistic purpose. Quality journalism may be financed through subscriptions. Second, the fact that material concerns criminal convictions does not prevent journalistic processing in advance. Crime, the administration of justice and public accountability may all be matters of strong public interest.

In this case, however, the material before the Court indicated that anyone could obtain access to the judgments subject only to payment. There appeared to be no processing, adaptation or editorial policy, and no indication that the company was subject to journalistic standards of professional conduct. The national court must verify those circumstances.

The difficulty, therefore, is not a subscription as such. It is the difference between editorially curated reporting and the mechanical, paid supply of criminal judgments that remain searchable by a person's name.

5. A public judgment does not authorise unlimited new processing

A judicial document may be public under national law while its collection, organisation, storage, name indexing and fresh dissemination by a private operator remain separate processing of personal data. The Court stated this expressly: making public criminal judgments available online falls within the GDPR's broad definition of “processing”.

Official access to judgments serves transparency in the justice system within defined access rules. A private database can materially change the reach of the information. It can connect results to a name, aggregate different proceedings, support repeated searches and keep the result instantly available many years later. Those features do not make the service unlawful automatically, but they matter when assessing its purpose, necessity, proportionality and safeguards.

The judgment did not establish a general rule that every old conviction must disappear from the internet. It does reject the simplistic equation “public document equals unrestricted reuse without GDPR scrutiny”.

6. Article 10 and the special protection of criminal data

Article 10 GDPR provides that processing personal data relating to criminal convictions and offences or related security measures may be carried out only under the control of official authority, or when authorised by Union or Member State law providing appropriate safeguards. A comprehensive register of criminal convictions may be kept only under the control of official authority.

The Court did not decide whether the processing at issue complied with Article 10. It explained that this was unnecessary in order to answer the question concerning “journalistic purposes”. It nevertheless stressed that the nature of the data, the number of people with access and the method of access must be taken into account when considering whether a derogation, particularly one from Article 10, is justified.

For a publisher or database operator, invoking journalism therefore does not replace an Article 10 analysis. The operator needs an identified legal authorisation, appropriate safeguards and a documented assessment of the chosen access model.

7. Articles 77 to 79 and Article 82 remain available

Chapter VIII of the GDPR contains remedies, liability and penalties. Article 77 provides the right to lodge a complaint with a supervisory authority. Article 78 provides an effective judicial remedy against a binding decision or inaction of that authority. Article 79 provides an effective judicial remedy against a controller or processor. Article 82 establishes a right to compensation for material or non-material damage caused by a GDPR infringement.

Chapter VIII is not among the chapters from which Article 85(2) permits derogations. A Member State therefore cannot make defamation the only route and exclude the GDPR's autonomous remedies. National procedural rules may organise how those remedies are exercised, but they cannot make their exercise practically impossible or excessively difficult, or add substantive conditions that the GDPR does not contain.

Case C-199/24 did not award compensation to ND. The Court did not find that damage had been proved and did not set an amount. The Swedish court must assess the alleged infringement, any damage, causation and the remaining conditions of the claim.

8. The comparison with Article 28 of Law 4624/2019

In Greece, Article 28 of Law 4624/2019 governs processing in relation to freedom of expression and information. Paragraph 1 refers, among other matters, to explicit consent, data manifestly made public by the data subject, and cases in which freedom of expression and information takes precedence. It also requires processing to be limited to what is necessary, especially for special categories of data, criminal prosecutions, convictions and security measures, with account taken of private and family life.

Paragraph 2 lists the GDPR chapters that do not apply, to the extent necessary, for the protected purposes. Chapter VIII is not on that list. This structure has direct practical significance after C-199/24: even where a journalistic derogation lawfully applies, the rights to complain, seek judicial protection and claim compensation do not disappear.

The Court did not review Greek Article 28 and did not rule on any particular Greek website or case-law database. Applying the Greek rule requires an assessment of the specific purpose, public interest, need to identify the individual, passage of time, accuracy, access conditions and safeguards.

9. Practical checklist for a person who finds an old conviction online

A judgment appearing in a name search does not create an automatic right to erasure, but neither does it mean that the individual has no rights. A structured first review should cover the following:

  1. Record the exact URL, date, search result and access method, without spreading the information further than necessary.
  2. Identify the controller, privacy notice and channel for exercising data protection rights.
  3. Check whether the document is accurate, concerns the correct person, reflects a later judgment or development, and describes the case as final only when that is true.
  4. Make a specific request for information, rectification, erasure, restriction or objection, as the facts warrant, rather than sending an undefined complaint.
  5. Ask about the purpose, legal basis, retention period, editorial policy, recipients and Article 10 safeguards.
  6. Keep the response and evidence of any actual material or non-material harm.
  7. Consider a complaint to the competent data protection authority or a judicial remedy, paying attention to jurisdiction and time limits.

The appropriate request and procedure depend on the country, operator, legal basis, nature of the publication and stage of the proceedings. C-199/24 does not replace that individual assessment.

10. Practical checklist for a publisher or legal database operator

  • Purpose and audience: record whether the service informs the public, supports research, or merely supplies name-indexed records.
  • Editorial selection: document selection criteria, public interest, context, headlines, updates and the reason for identifying a person.
  • Verification: check the official source, date, court, case number, procedural stage, appeals, corrections and any provisional-text label.
  • Proportionality: assess whether a full name, full text, open indexing, unlimited retention or access for every user is necessary.
  • Article 10: identify the legal authorisation and appropriate safeguards for conviction data; a general reference to journalism is not enough.
  • Ethics: apply a published editorial policy and clear rules on correction, updating, retention and the handling of requests.
  • Technical design: consider controls on name searches, bulk extraction, search-engine indexing and account abuse.
  • Remedies: maintain an accessible contact channel and do not present defamation as the only possible route.
  • Decision trail: retain a record of the legal and editorial balancing exercise, changes made and the answer to each substantiated request.

A serious case-law database does not establish its journalistic character by applying a label. It demonstrates that character through how it selects, verifies, explains, limits, updates and corrects its material.

11. What the Court did not decide

  • It did not ban Lexbase or paid legal databases.
  • It did not order the general erasure of criminal judgments or names from the internet.
  • It did not hold that payment or conviction data always preclude journalism.
  • It did not hold that every public judgment may be republished without GDPR scrutiny.
  • It did not decide whether Article 10 was infringed on the particular facts.
  • It did not award ND damages or determine an amount.
  • It did not review the compatibility of Greek Law 4624/2019 or any particular Greek service.

12. Frequently asked questions

Can a commercial database of judgments continue to operate?

The judgment does not impose a general closure. Lawfulness depends on the purpose, legal basis, nature of the data, audience, search design, editorial treatment, verification, safeguards and applicable national law.

Does the GDPR stop applying because the judgment is public?

No. Collection, storage, indexing and renewed online dissemination are processing. The public source is a relevant factor, not a general exemption.

Does C-199/24 create an automatic right to erasure?

No. It clarifies the limits of the journalistic derogation and preserves GDPR remedies. Whether erasure or another measure is required depends on the particular request and applicable law.

Does “Provisional text” mean that the judgment has no effect?

No. The Court delivered the judgment on 9 July 2026 and InfoCuria shows the case as closed. The label remains attached to the currently published version and should be reported accurately until the official sources change it.

13. Official sources

Legal information: The official sources were checked on 30 August 2026. This article provides general legal and practical information. It does not assess the lawfulness of a particular database or publication and is not personalised legal advice.