Field Notes

question

Will Swedish people-search services survive GDPR enforcement?

StatusWorkingReviewdue UpdatedStands on3 sourcesSupportsnotes

Legal Newsdesk Sweden C-199-24 removed the blanket rule that a Swedish publication certificate displaces the GDPR: non-journalistic processing must keep GDPR remedies. What the judgment did not decide is the outcome that matters: whether Swedish courts, IMY, and the legislature now actually end indiscriminate people-search publishing and give affected people working removal remedies, or whether the services survive through journalism claims, re-scoped offerings, slow enforcement, or a weak national judgment.

Why it matters

The answer decides the practical advice in Swedish public-record privacy and EU and Swedish data removal rights: whether removal from Lexbase-class services becomes an ordinary GDPR request or stays a specialized escalation. It shapes the personal escalation path in Challenging name-search indexing of criminal coverage, and it sizes the utgivningsbevis triage niche in Privacy business proposals, which exists only while removal remains difficult. Utgivningsbevis and people-search services holds the doctrinal detail and stays working until this question resolves.

Where it stands, 28 July 2026

So far the services survive, and the mechanism is the one the question listed last: slow enforcement. Nineteen days after the judgment, every channel that could deliver a remedy is parked, and two of them were parked deliberately.

Channel State on 28 July 2026
CJEU ruling Delivered 9 July 2026
National application (Attunda tingsrätt) Remitted, undecided
IMY supervision, four services All open; none decided
IMY individual complaints Suspended since March 2026
Legislation New inquiry reports March 2027

This is not evidence that enforcement has failed. It is evidence that the question cannot resolve quickly, and it puts a floor under the earliest plausible resolution.

What is already known

  • The CJEU held on 9 July 2026 that selling searchable access to public criminal judgments falls below the journalistic derogation, and that affected people must retain GDPR remedies; Attunda tingsrätt, which referred the question, must still apply the test to Lexbase and has not yet done so.
  • IMY said the same day that it would analyse the judgment against its four open supervisions.1 None has been decided; the mrkoll.se case was still at the investigation stage at its last status update.
  • Those four supervisions divide into two different questions. Lexbase and krimfup are examined for the publication itself; Upplysning.se and Mrkoll for refusing erasure on request. Only the first line would decide whether the services can exist, and a clean win on the second would leave the databases standing.
  • Since 13 March 2026 IMY has declined to investigate individual complaints against any of the four while the collective review runs, closing them without action subject to appeal. IMY suspension of search-service complaints preserves that position.
  • The government did abandon the SOU 2024:75 constitutional amendment, but the replacement inquiry has been launched and is to report by March 2027, covering background checks and the regulation of search services.2 An earlier reading of this note held that no inquiry existed; that is superseded. Legislative resolution therefore cannot arrive before 2027, and a proposition and passage would follow that.
  • Dumpen is the boundary case: edited public-interest reporting with a plausible journalistic purpose, whose thinnest named judgment posts are the closest comparators to a conviction database.

What would settle it

  • Obtain the national judgment applying C-199/24 in the Lexbase dispute, and record the remedy actually ordered.
  • Track IMY’s four collective investigations and record whether they end in deletion orders, fines, re-scoping, or closure without remedy.
  • Track whether a court or IMY applies C-199/24 to mixed editorial databases, including Dumpen’s named judgment posts.
  • Track whether the promised ordinary-law inquiry or replacement legislation materializes. It has: the inquiry is running and reports by March 2027. What boundary it draws for searchable compilations is still unknown and is the next thing to watch.
  • Test whether an ordinary affected person can obtain removal from a certificate-holding service in practice. Not through IMY, and not at present: complaints against all four services are closed without investigation. The remaining routes are an appeal against that closure, a direct erasure request to the service, and a civil claim of the kind C-199/24 concerned.
  • Test those three remaining routes, since the doctrinal change is a proxy for whether any of them works.

  1. IMY, “Dom från EU-domstolen om söktjänst med utgivningsbevis”, 9 July 2026, quoting legal director David Törngren: “Vi ska nu analysera domen och se vad den innebär för våra pågående tillsyner mot söktjänster med utgivningsbevis.” ↩

  2. Konstitutionsutskottets betänkande 2025/26:KU18, Tryck- och yttrandefrihet, massmediefrågor, preserved as a local snapshot. The committee debate records that the government will not proceed with the SOU 2024:75 proposals and will “utreda frågan på nytt,” with the new inquiry to be completed by March 2027. ↩

Built on 3 sources (3 external).

Working out connections…