The Court of Justice of the European Union rejected a broad interpretation of journalistic privilege under the General Data Protection Regulation, ruling that companies operating paid criminal record databases cannot shield themselves from GDPR compliance by invoking press exemptions.
The case centered on whether database operators who compile and sell access to criminal records qualify for the journalism exception in GDPR Article 85. That provision allows member states to create exemptions from certain data protection rules for journalistic purposes. The CJEU determined that commercial operation of criminal databases does not automatically qualify as journalism simply because the information relates to public figures or matters of public interest.
The court established that journalistic status requires genuine editorial judgment and intent to inform the public about matters of legitimate concern. Merely republishing or aggregating publicly available criminal records for profit falls outside this protection. The ruling draws a practical distinction between news organizations serving the public interest and data brokers exploiting sensitive personal information for commercial gain.
This decision carries serious implications for companies operating criminal background check services, mugshot databases, and similar repositories across Europe. These operators face heightened GDPR obligations including stricter consent requirements, expanded data subject rights, and potential liability for processing outdated or inaccurate criminal information. Individuals subject to these databases gain stronger legal grounds to demand deletion and restrict distribution of their criminal histories.
Member states must now carefully define their journalistic exemptions to avoid inadvertently shielding profit-driven data operations from GDPR requirements. Publishers claiming legitimate journalistic purposes will face scrutiny regarding their actual business model and editorial function. The ruling establishes that form cannot substitute for substance. A database operator cannot simply label itself a publisher and expect GDPR protections designed for traditional media to apply.
The decision reflects growing EU skepticism toward blanket corporate claims of journalistic status as legal cover for unregulated data practices. Companies must demonstrate genuine public service journalism rather than relying on categorical exem