CJEU C‑199/24: the “journalism” derogation does not displace the GDPR

Verified point — On 9 July 2026, the CJEU (C‑199/24, Legal Newsdesk Sweden) held that simply putting criminal judgments online behind a paywall is not, in principle, a journalistic purpose under Article 85 GDPR. As a result, GDPR rights and remedies remain available (Arts. 77–79, 82).

The case

In Sweden, a company operated a paid database to search for individuals involved in criminal proceedings and to view conviction decisions. A person convicted in 2011 requested erasure; the operator invoked constitutional freedom of expression to disapply the GDPR and confine the claimant to defamation actions.

In its preliminary ruling, the CJEU clarified two key points:

• Member States must reconcile data protection and freedom of expression by law (Art. 85 GDPR) and cannot generally exclude the GDPR for processing that does not fall within journalistic, academic, artistic or literary purposes.
• Raw, monetised republication of criminal decisions is not “journalistic” in principle: there must be a genuine public‑information aim, ethics and editorial policy, and fact‑checking. Otherwise, GDPR rights and remedies (Arts. 77–79, 82) remain open.

Legal reasoning

1) GDPR framework — Article 85

Article 85(1)–(2) GDPR allows only necessary and proportionate exemptions to reconcile the rights at stake, to be interpreted strictly. The CJEU rejects any general exclusion of the GDPR. See also CNPD (Chapter IX): official page.

2) Defining “journalistic purposes”

A functional and exacting approach: informing the public, adherence to ethics, an editorial policy, and fact‑checking. Neither paywalls nor online hosting automatically negate journalism; here, the absence of verified editorial work is decisive. See EUR‑Lex (“concept of processing for journalistic purposes”): summary.

3) Preserved GDPR rights and remedies

Where Article 85 does not apply, GDPR avenues must remain: complaint to the authority (Art. 77), judicial remedies (Arts. 78–79), and compensation (Art. 82). See the CJEU press release, paras 25–31: CP 100/26.

4) Alignment with EDPB practice

The EDPB acknowledges a broad reading of “journalistic purposes” but conditioned, without erasing GDPR principles where activity is not genuinely journalistic. See Guidelines 5/2019 (right to be forgotten, search engines): document (fr). In Luxembourg, the CNPD points to the GDPR recitals (incl. recital 153): official page.

What changes in practice

• Luxembourg leaders (media, document databases, legaltech, B2B background‑check, archives aggregators): invoking a “press exception” is not enough. Without an editorial policy, fact‑checking and genuine journalistic processing, expect full GDPR compliance duties (Arts. 13/14 notice, Art. 6 legal basis, Art. 5(1)(e) storage limitation, Arts. 15–22 rights). Consider external DPO support to structure governance.
• Data subjects can exercise their GDPR rights, lodge a complaint with the authority (Art. 77) and go to court (Art. 79), and seek compensation (Art. 82). An internal policy cannot bar these avenues.
• Archive/judicial directory platforms must justify their legal basis (often legitimate interests, Art. 6(1)(f)) with a robust balancing test, backed by safeguards (minimisation, context, updates, delisting). For deeper understanding of the GDPR framework and Article 85, consult the official text.
• Cross‑border players (BE/FR/DE): beware national variations of Article 85. The ruling narrows discretion: no blanket GDPR exclusion; only necessary and proportionate exemptions. See also the French LIL “journalism” section: CNIL page, and guidance on GDPR compliance in Luxembourg.

Common pitfalls

1. Relying on a “press exception” without tangible editorial elements (charter, validation workflows, fact‑checking, editorial accountability). See CJEU C‑199/24.
2. Failing to provide notice (Arts. 13/14) and track requests (deadlines: one month, Art. 12(3)).
3. Equating “publicly accessible data” with “free‑to‑reuse data”. Mass republication does not erase GDPR duties. See principles: EDPB – Basic principles.
4. Skipping the Legitimate Interests Assessment and mitigations: clear purpose, necessity, balancing, minimisation, context, updates, delisting, and credible retention limits.
5. Forcing users into defamation‑only routes. The CJEU rejects this: GDPR complaint, judicial remedies and compensation must remain accessible if Art. 85 does not apply. See CJEU press release.

Official sources

• CJEU — Press release No 100/26 (9 July 2026): cp260100en.pdf
• EUR‑Lex — Case C‑199/24 summary and text: Summary and Text
• GDPR — Article 85 (processing and freedom of expression): Consolidated text
• CNPD (LU) — GDPR Chapter IX: page; Recitals: page
• EDPB — Guidelines 5/2019 (right to be forgotten): document
• CNIL — National framework (journalism, French LIL): page

In short, C‑199/24 closes the door on national regimes that would neutralise the GDPR behind an overly broad “press” label. Organisations republishing sensitive or judicial information must either document a genuine editorial approach under Article 85 or apply the GDPR in full.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.