Field Notes

concept

Journalistic purposes under Article 85 GDPR

StatusStableUpdatedStands on2 sourcesSupportsnotes

Article 85(2) of the GDPR requires Member States to provide exemptions or derogations from the Regulation’s ordinary rules where necessary to reconcile data protection with freedom of expression and information, including processing for journalistic purposes. Member States may not create derogations for purposes other than journalism, academic expression, artistic expression, or literary expression. An affected person must retain GDPR remedies; a national system cannot leave only defamation or similar claims.

The test is processing-specific, not publisher-specific. A single organization can perform some operations that are journalistic and others that are not, and each must be assessed on its own purpose and practice. The same four criteria apply, and they apply to the processing operation, not to the publisher’s overall character.

The four CJEU criteria

In Legal Newsdesk Sweden C-199-24, the CJEU set the test in four parts. An operation carried out for journalistic purposes must involve:

  1. A purpose of communicating information, opinions, or ideas to the public. Making material available to anyone who pays, without a public-interest communication purpose, does not qualify.

  2. Selection or editorial adaptation. Journalism requires discrimination about what to publish and some form of editorial judgment. Indiscriminate bulk availability is a database operation, not an editorial one.

  3. Factual verification. The publisher must take steps to confirm that the information is accurate, or at least to identify what is asserted and what is confirmed.

  4. Compliance with journalistic ethical rules or codes. Whether or not the publisher formally subscribes to a code, the operation must reflect the ordinary ethical practices of journalism, including standards for accuracy, fairness, opportunity to respond, and the treatment of identifying information.

These four criteria are indicators rather than an exhaustive definition. No single factor is dispositive, and the national court applies them to the facts.

What the test does not require

The Court was explicit about three things that do not disqualify an operation from being journalistic:

  • Payment. Charging for access does not by itself exclude the activity from the journalistic derogation.
  • Criminal-conviction subject matter. The sensitivity of the data, including data about criminal convictions, does not by itself prevent the operation from being journalism.
  • A publication certificate. Holding an utgivningsbevis or equivalent constitutional protection does not by itself make the processing journalistic, and the absence of one does not prevent it.

What falls below the floor

The judgment’s concrete holding draws a floor: selling access to public criminal judgments without editorial purpose, selection, verification, or ethical practice is not journalism within the meaning of Article 85. Usefulness to journalists is a property of the raw material, not of the distribution; indiscriminate public access has to qualify on its own terms.

The distinction is between an operation and the material it distributes. A database of criminal judgments may be useful to journalists without the database itself being a journalistic operation. The same material distributed through different operations — one curated, verified, and framed editorially, the other searchable in bulk for any paying user — can land on opposite sides of the test.

Each processing operation gets its own answer

Collection, storage, indexing, retrieval, and making personal data available are each separate processing operations under the GDPR. A single publication may involve several such operations, and Article 85 asks about each one separately, not about the publication as one act. A publisher that performs genuinely journalistic collection and editing but also hosts a bulk searchable archive with no editorial selection or purpose may have one operation that qualifies and another that does not, from the same underlying material.

Consequences of failing the test

When processing is not for journalistic purposes, the ordinary GDPR rules apply without the Article 85 derogation. The data-protection principles of purpose limitation, data minimization, storage limitation, and accuracy become operative, and affected people gain the full set of GDPR rights: access, rectification, erasure, restriction, and objection.

For criminal-offence data, Criminal-offence data under GDPR Article 10 adds a further requirement: processing is unlawful unless carried out under the control of official authority or authorized by Union or Member State law providing appropriate safeguards. A private controller operating a general public-facing conviction database without a journalistic purpose has few remaining routes to lawfulness.

Where the test is applied in this vault

Naming convicted people in Swedish media applies the processing-specific distinction to Swedish court reporting, separating journalistic articles from raw judgment distribution.

Utgivningsbevis and people-search services applies it to the constitutional shield claim: an utgivningsbevis cannot by itself convert every public-facing database operation into journalism.

Dumpen applies it to a specific publisher whose formats range from edited court reporting to thin named conviction posts and judgment copies, each of which requires its own assessment.

Unmasking pseudonymous public figures applies the same separation of journalistic purpose from journalistic form to a different legal system and subject: the Banksy unmasking dispute, where the publisher’s purpose and editorial practice, rather than the accuracy of the underlying facts, is what a public-interest defence of identification actually has to justify.

EU and Swedish data removal rights uses it to frame when a subject can assert GDPR rights against a publisher claiming journalistic purpose.

Swedish public-record privacy names it as the legal baseline that the 2024 inquiry and subsequent legislative work must satisfy.

Built on 2 sources (2 external).

Working out connections…