Field Notes

concept

Utgivningsbevis and people-search services

StatusWorkingReviewdue UpdatedStands on8 sourcesSupportsnotes

A Swedish publication certificate, or utgivningsbevis, can give an eligible website or database constitutional protection under the Fundamental Law on Freedom of Expression (YGL). It places publication under an editor’s responsibility and provides safeguards similar to those of traditional media.

Traditional mass media receive constitutional protection automatically. A non-traditional database can apply voluntarily if it satisfies organizational, technical, and editorial-control requirements. The certificate currently lasts ten years.

The people-search use case

Personuppgifter och mediegrundlagarna SOU 2024-75 inspected 1,391 certificate-bearing databases. Only 61, about 4 percent, were classified as large personal-data search services. The privacy controversy concerns a minority use of the legal form, not every certificate holder.

The inquiry found services exposing combinations of:

  • name, birth date, age, and sometimes a complete personnummer;
  • telephone number, current and former addresses, apartment number, and a map or door location;
  • cohabitants, neighbours, marital status, and family relationships;
  • homes, assessed values, companies, vehicles, and dogs;
  • income indicators and credit information;
  • judgments, penalty orders, preliminary investigations, and probation reports;
  • how often a person has been searched for.

At least one service allowed a paying user to follow another person and receive alerts about moves, name or marital-status changes, and vehicles, without notifying the subject. The product is therefore more than document access: it is continuous, person-centred observability.

Why the constitutional shield became contentious

Swedish implementing law had been read to give certificate-bearing databases broad priority over ordinary data-protection rules. That made erasure, objection, purpose limitation, and regulatory supervision difficult even where the database performed little recognizable journalism.

The argument for protection is not fictional. Professional research databases help journalists find sources and investigate organized crime, corruption, money laundering, and tax fraud. The 2024 inquiry emphasized that smaller local newsrooms can depend on tools they could not reproduce internally.

The harder claim is that making an entire population searchable for any paying user is itself journalism. The constitutional form and a journalistic customer segment do not settle the purpose of each processing operation.

The regulator staked out its ground before the courts did. In its 2024 legal position IMY legal position on people-search services, IMY concluded that a publication certificate could not exclude a search service from data-protection supervision altogether, because EU law does not permit a blanket exemption on that basis. The overlapping decisions that followed tested how far that competence reaches:

Date Decision Practical significance
2024 HFD 2024 ref. 43 IMY could supervise a search service’s handling of sensitive personal data because YGL itself points to applicable GDPR restrictions.
2025 HD, GDPR and the criminal judgments I and II Bulk disclosure of criminal judgments could be restricted under OSL when the intended processing would breach GDPR.
June 2026 HD, Qura request Criminal-offence material was restricted; a journalistic component could receive it subject to a ban on further searchable distribution.
July 2026 CJEU, C-199/24 A Member State cannot displace GDPR for non-journalistic processing merely through its constitutional publication regime.

In Legal Newsdesk Sweden C-199-24, the CJEU held that making public criminal judgments available for payment cannot qualify as journalism merely because the documents are public or journalists might use them. The test for Journalistic purposes under Article 85 GDPR requires purpose, editorial selection or adaptation, fact checking, and journalistic ethics. Affected people must retain GDPR remedies.

The decision is decisive against a blanket certificate exemption, but narrower than “all Swedish directories are now illegal.” It arose from criminal judgments; the national court still applies the test; and other services may invoke different facts or genuine journalistic purpose. IMY is analyzing the ruling while investigating Lexbase, krimfup, Upplysning.se, and Mrkoll.

What can still be acquired and published

The HD decisions do not abolish publication certificates and do not make every copy of a requested judgment secret everywhere. They decide whether a particular authority may disclose material, in a particular form and volume, given the intended processing. A publisher may already possess a copy, obtain one from a party, or acquire it through another lawful channel.

An authority can also disclose material subject to a reservation that restricts further searchable distribution, as HD allowed for a journalistic component of the Qura request. That restriction binds the recipient under its terms; it is different from a universal prohibition on publication.

The later CJEU ruling operates at another layer. Under GDPR, collection, storage, indexing, and making personal data available are each processing operations. Changing the acquisition channel can overcome one authority’s refusal, but it does not decide whether the publisher’s own processing is lawful.

Publication remains possible when it is genuinely journalistic within the broad EU-law meaning, or when another applicable legal basis and safeguard permits it. The CJEU expressly said that payment and the subject matter of criminal convictions do not by themselves exclude journalism. What the certificate cannot do is transform every public-facing database operation into journalism without regard to its actual purpose and editorial practice.

Previously acquired Lexbase documents

The CJEU did not order Lexbase to close or decide the final facts in the Swedish dispute. Attunda District Court must apply the interpretation, and enforcement or an injunction requires a national decision.

There is nevertheless no exception in the ruling for documents acquired before 9 July 2026. Storage, indexing, retrieval, and continued online availability are ongoing processing. If the national court finds that Lexbase’s relevant processing is not for journalistic purposes, the certificate cannot by itself exclude GDPR from those operations.

Criminal-conviction data then encounters Article 10’s additional rule. For a private controller, Swedish general law permits processing in narrow cases, including necessary legal claims, legal or archival duties, or a category or individual authorization issued under the legislation. Those provisions do not obviously authorize a general public-facing commercial conviction database.

The precise consequence can vary by operation: continued public search, retention for a legal claim, and a genuinely journalistic archive need not receive the same answer. Lexbase may argue that its practices satisfy the CJEU test, change its service, or identify another authorization. Until the Swedish court and IMY act, “no longer allowed to publish anything” is stronger than the current holding.

Reform remains unsettled

The 2024 inquiry proposed a constitutional exception for searchable compilations posing a special risk of improper privacy intrusion, assessed by data nature, scale, and purpose. The government announced in November 2025 that it would not proceed with that amendment because the legal consequences were considered insufficiently clear. It instead indicated that a new inquiry should examine ordinary legislation.

The CJEU judgment now supplies a stronger minimum rule: non-journalistic processing cannot escape GDPR. Sweden must still determine workable boundaries for mixed databases, journalistic research tools, public-facing publication, and enforcement.

The national judgment, IMY’s four collective investigations, and any replacement legislation are tracked in the open question Will Swedish people-search services survive GDPR enforcement, which asks whether these fractures actually end indiscriminate people-search publishing.

Dumpen is a harder comparator. It creates and edits original public-interest reports, so journalistic purpose is more plausible than for Lexbase. Plausibility at the publication level still leaves each identification to answer for itself under data-protection and defamation law. Its court-reporting formats also vary from partially anonymized hearing schedules to short named conviction posts and judgment copies. Naming convicted people in Swedish media applies the processing-specific distinction to those formats.

These open proceedings are why this note remains working.

Unmasking pseudonymous public figures poses a comparable question in a different legal system: whether a publisher’s own belief that the public interest favors identifying a pseudonymous actor should be the operative constraint on publication, independent of whether the underlying facts are true.

Built on 8 sources (8 external).

Working out connections…