Utgivningsbevis and people-search services
A Swedish publication certificate, or utgivningsbevis,
can give an eligible website or database
constitutional protection under the Fundamental Law
on Freedom of Expression (YGL).
It places publication under an editor’s responsibility
and provides safeguards similar to those of traditional media.
Traditional mass media receive constitutional protection automatically. A non-traditional database can apply voluntarily if it satisfies organizational, technical, and editorial-control requirements. The certificate currently lasts ten years.
The people-search use case
Personuppgifter och mediegrundlagarna SOU 2024 75 inspected 1,391 certificate-bearing databases. Only 61, about 4 percent, were classified as large personal-data search services. The privacy controversy concerns a minority use of the legal form, not every certificate holder.
The inquiry found services exposing combinations of:
- name, birth date, age, and sometimes a complete personnummer;
- telephone number, current and former addresses, apartment number, and a map or door location;
- cohabitants, neighbours, marital status, and family relationships;
- homes, assessed values, companies, vehicles, and dogs;
- income indicators and credit information;
- judgments, penalty orders, preliminary investigations, and probation reports;
- how often a person has been searched for.
At least one service allowed a paying user to follow another person and receive alerts about moves, name or marital-status changes, and vehicles, without notifying the subject. The product is therefore more than document access: it is continuous, person-centred observability.
Why the constitutional shield became contentious
Swedish implementing law had been read to give certificate-bearing databases broad priority over ordinary data-protection rules. That made erasure, objection, purpose limitation, and regulatory supervision difficult even where the database performed little recognizable journalism.
The argument for protection is not fictional. Professional research databases help journalists find sources and investigate organized crime, corruption, money laundering, and tax fraud. The 2024 inquiry emphasized that smaller local newsrooms can depend on tools they could not reproduce internally.
The harder claim is that making an entire population searchable for any paying user is itself journalism. The constitutional form and a journalistic customer segment do not settle the purpose of each processing operation.
A legal shield with widening fractures
The law changed through several overlapping decisions:
| Date | Decision | Practical significance |
|---|---|---|
| 2024 | HFD 2024 ref. 43 | IMY could supervise a search service’s handling of sensitive personal data because YGL itself points to applicable GDPR restrictions. |
| 2025 | HD, GDPR and the criminal judgments I and II | Bulk disclosure of criminal judgments could be restricted under OSL when the intended processing would breach GDPR. |
| June 2026 | HD, Qura request | Criminal-offence material was restricted; a journalistic component could receive it subject to a ban on further searchable distribution. |
| July 2026 | CJEU, C-199/24 | A Member State cannot displace GDPR for non-journalistic processing merely through its constitutional publication regime. |
In Legal Newsdesk Sweden C-199 24, the CJEU held that making public criminal judgments available for payment cannot qualify as journalism merely because the documents are public or journalists might use them. The national court must examine purpose, editorial selection or adaptation, fact checking, and journalistic ethics. Affected people must retain GDPR remedies.
The decision is decisive against a blanket certificate exemption, but narrower than “all Swedish directories are now illegal.” It arose from criminal judgments; the national court still applies the test; and other services may invoke different facts or genuine journalistic purpose. IMY is analyzing the ruling while investigating Lexbase, krimfup, Upplysning.se, and Mrkoll.
What can still be acquired and published
The HD decisions do not abolish publication certificates and do not make every copy of a requested judgment secret everywhere. They decide whether a particular authority may disclose material, in a particular form and volume, given the intended processing. A publisher may already possess a copy, obtain one from a party, or acquire it through another lawful channel.
An authority can also disclose material subject to a reservation that restricts further searchable distribution, as HD allowed for a journalistic component of the Qura request. That restriction binds the recipient under its terms; it is different from a universal prohibition on publication.
The later CJEU ruling operates at another layer. Under GDPR, collection, storage, indexing, and making personal data available are each processing operations. Changing the acquisition channel can overcome one authority’s refusal, but it does not decide whether the publisher’s own processing is lawful.
Publication remains possible when it is genuinely journalistic within the broad EU-law meaning, or when another applicable legal basis and safeguard permits it. The CJEU expressly said that payment and the subject matter of criminal convictions do not by themselves exclude journalism. What the certificate cannot do is transform every public-facing database operation into journalism without regard to its actual purpose and editorial practice.
Previously acquired Lexbase documents
The CJEU did not order Lexbase to close or decide the final facts in the Swedish dispute. Attunda District Court must apply the interpretation, and enforcement or an injunction requires a national decision.
There is nevertheless no exception in the ruling for documents acquired before 9 July 2026. Storage, indexing, retrieval, and continued online availability are ongoing processing. If the national court finds that Lexbase’s relevant processing is not for journalistic purposes, the certificate cannot by itself exclude GDPR from those operations.
Criminal-conviction data then encounters Article 10’s additional rule. For a private controller, Swedish general law permits processing in narrow cases, including necessary legal claims, legal or archival duties, or a category or individual authorization issued under the legislation. Those provisions do not obviously authorize a general public-facing commercial conviction database.
The precise consequence can vary by operation: continued public search, retention for a legal claim, and a genuinely journalistic archive need not receive the same answer. Lexbase may argue that its practices satisfy the CJEU test, change its service, or identify another authorization. Until the Swedish court and IMY act, “no longer allowed to publish anything” is stronger than the current holding.
Reform remains unsettled
The 2024 inquiry proposed a constitutional exception for searchable compilations posing a special risk of improper privacy intrusion, assessed by data nature, scale, and purpose. The government announced in November 2025 that it would not proceed with that amendment because the legal consequences were considered insufficiently clear. It instead indicated that a new inquiry should examine ordinary legislation.
The CJEU judgment now supplies a stronger minimum rule: non-journalistic processing cannot escape GDPR. Sweden must still determine workable boundaries for mixed databases, journalistic research tools, public-facing publication, and enforcement.
- Track the national judgment applying C-199/24.
- Track IMY’s four collective investigations and resulting remedies.
- Track any new Swedish inquiry or legislation replacing the abandoned constitutional proposal.
Dumpen is a harder comparator. It creates and edits original public-interest reports, so journalistic purpose is more plausible than for Lexbase. That does not make every personal identification immune from data-protection or defamation scrutiny. Its court-reporting formats also vary from partially anonymized hearing schedules to short named conviction posts and judgment copies. Naming convicted people in Swedish media applies the processing-specific distinction to those formats.
These open proceedings are why this note remains working.