Opinion of the Advocate General — ECLI:EU:C:2025:670
Date: 2025-09-04
Language of the case: Swedish

Anonymised version 
Translation C-199/24 – 1 
Case C-199/24 
Request for a preliminary ruling 
Date lodged: 
13 March 2024 
Referring court: 
Attunda tingsrätt (Sweden) 
Date of the decision to refer: 
1 March 2024 
Applicant: 
ND 
Respondent: 
Garrapatica AB 
  
ATTUNDA TINGSRÄTT  … 
… 
PARTIES 
Applicant 
ND 
Respondent 
Garrapatica AB, …  
Stockholm 
… 
MATTER 
EN 
REQUEST FOR A PRELIMINARY RULING OF 1. 3. 2024 – CASE C-199/24 
 
2  
Anonymised version 
 
Damages [inter alia]; now whether to obtain a preliminary ruling from the Court 
of Justice of the European Union 
… 
The tingsrätten (‘District Court’) makes the following 
ORDER 
1 The District Court decides, on the basis of Article 267 of the Treaty on the 
Functioning of the European Union, to obtain a preliminary ruling from the Court 
of Justice …. 
2 The District Court declares that the case is to be stayed pending receipt of the 
preliminary ruling from the Court of Justice. 
… 
THE REQUEST FOR A PRELIMINARY RULING 
The dispute 
Garrapatica AB runs the database Lexbase and publishes on it the personal details 
of persons who have been involved in criminal proceedings. The Myndigheten för 
press, radio och tv (the Swedish Press and Broadcasting Authority) [now 
Mediemyndigheten; Swedish Agency for the Media] issued a so-called 
utgivningsbevis (certificate of no legal impediment to publication conferring 
constitutional protection; ‘publication certificate’) for Lexbase. On 17 January 
2011, ND was convicted of crime and the relevant sentencing decision was 
available on Lexbase until February 2024. The sentencing decision has been 
removed from the public register of criminal records. 
The dispute concerns whether Garrapatica AB is liable to pay damages for 
infringement of the European Union’s General Data Protection Regulation 
[Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing 
Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1); 
‘the GDPR’] and other regulatory provisions on the processing of personal data. 
ND has claimed that the company should be ordered to pay damages of 
SEK 300 000 together with interest thereon. Garrapatica AB has contested the 
claim, arguing that the GDPR does not apply since Lexbase is covered by a 
publication certificate. The company has, however, acknowledged that it refused 
to remove ND’s personal data in accordance with his request before the personal 
data were removed as part of the company’s routine internal data clean-up. 
GARRAPATICA 
 
3 
Anonymised version 
Garrapatica AB has accepted that a payment of damages in the amount of 
SEK 20 000 is reasonable per se. 
The legal framework 
The yttrandefrihetsgrundlagen and the dataskyddslagen 
The yttrandefrihetsgrundlagen (1991:1469) (Constitutional Law (1991:1469) on 
freedom of expression; ‘the Law on freedom of expression’) is one of the so-
called mediegrundlagar (constitutional media laws) in Sweden and contains 
provisions on constitutional protection for, inter alia, radio and television 
broadcasts and certain websites. The purpose is to ensure freedom of expression in 
that regard. According to Chapter 1, Article 4, of the Law on freedom of 
expression, the constitutional provisions on programme transmission are to be 
applied to a certain type of databases if there is a publication certificate for the 
activity. In the present case, a publication certificate has been issued for Lexbase, 
which means that the database is subject to constitutional protection. 
In accordance with the first subparagraph of Chapter 1, Section 7, of the lagen 
(2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning 
(Law (2018:218) laying down supplementary provisions to the EU GDPR; the 
dataskyddslagen (‘Law on data protection’)), the GDPR is not to apply where it 
would contravene the tryckfrihetsförordningen (Constitutional Law on the 
freedom of the press; ‘Law on the freedom of the press’) or the Law on freedom 
of expression. Under the second subparagraph of the above provision, certain 
articles of the GDPR are not to apply to the processing of personal data carried out 
for, inter alia, journalistic purposes. 
It follows from Chapter 1, Article 14, of the Law on freedom of expression that no 
public body may, except by virtue of that Law, take action against a person who 
has abused the freedom of expression or contributed to such abuse in a 
programme or take action against the programme for such a reason. Further, it 
follows from Chapter 1, Article 11, thereof that it is not permitted for a public 
body to prohibit or obstruct the transmission, publication or dissemination to the 
public of a programme, on the ground of its content, unless that measure has 
support in that Law. 
Damages for abuse of the freedom of expression due to the content of a 
programme may – under Chapter 9, Article 1, of the Law on freedom of 
expression – be founded only on the fact that the programme which is the subject 
of the claim involves freedom of expression offences. Identifying someone as 
having a lifestyle which is criminal or culpable or otherwise providing 
information which is liable to expose another to the contempt of others constitutes 
the crime of defamation and is a violation of the freedom of expression under 
Chapter 5, Article 1, of the Law on freedom of expression and Chapter 7, 
Article 3, of the Ordinance on the freedom of the press (1949:105). However, it is 
not punishable if, having regard to the circumstances, it was justifiable to provide 
REQUEST FOR A PRELIMINARY RULING OF 1. 3. 2024 – CASE C-199/24 
 
4  
Anonymised version 
information on the matter and if the person who provided the information can 
show that it was true or that he or she had reasonable grounds for believing that it 
was true. 
The GDPR 
According to Article 10 of the GDPR, processing of personal data relating to 
criminal convictions and offences based on Article 6(1) is to be carried out only 
under the control of official authority or when the processing is authorised by EU 
or Member State law providing for appropriate safeguards for the rights and 
freedoms of data subjects. Any comprehensive register of criminal convictions is 
to be kept only under the control of official authority. 
According to Article 17 of the GDPR, the data subject has the right to obtain from 
the controller the erasure of personal data concerning him or her without undue 
delay inter alia if the personal data are no longer necessary in relation to the 
purposes for which they were collected or otherwise processed. 
Any person who has suffered material or non-material damage as a result of an 
infringement of the GDPR has the right, under Article 82 thereof, to receive 
compensation from the controller or processor for the damage suffered. 
It follows from Article 85(1) of the GDPR that Member States are by law to 
reconcile the right to the protection of personal data pursuant to that regulation 
with the right to freedom of expression and information, including processing for 
journalistic purposes and the purposes of academic, artistic or literary expression. 
Recital 153 states that Member States law should reconcile the rules governing 
freedom of expression and information, including journalistic, academic, artistic 
and or literary expression with the right to the protection of personal data pursuant 
to that regulation. Further, it follows that Member States should adopt legislative 
measures which lay down the exemptions and derogations necessary for the 
purpose of balancing those fundamental rights. 
For processing carried out for journalistic purposes or the purpose of academic 
artistic or literary expression, Member States are also to provide, in accordance 
with Article 85(2) of the GDPR, for exemptions or derogations from certain 
chapters of the regulation if they are necessary to reconcile the right to the 
protection of personal data with the freedom of expression and information. 
Need for a preliminary ruling 
Under Article 267 of the Treaty on the Functioning of the European Union, a 
national court may request a preliminary ruling from the Court of Justice of the 
European Union. The possibility of requesting a preliminary ruling presupposes 
that a question of interpretation of EU law relevant to the case has arisen and that 
clarification is necessary to be able to rule on the matter. 
GARRAPATICA 
 
5 
Anonymised version 
The present case concerns the relationship between the freedom of expression and 
information and the right to the protection of personal data. The GDPR gives 
Member States a degree of legislative discretion in that regard. The Swedish rules 
mean that the GDPR is not applicable and that the right to the protection of 
personal data is catered for by the rules in the Law on freedom of expression and 
the Law on freedom of the press. The rules in the Law on freedom of expression 
on the processing of personal data in Chapter 1, Article 20, thereof do not apply to 
personal data such as those at issue in the present case. The right to the protection 
of personal data as regards the dissemination of personal data such as those at 
issue in the present case is catered for only through criminal responsibility for 
defamation and the possibility of seeking damages for defamation. 
With regard to the balance between the freedom of expression and the right to the 
protection of personal data, the Court of Justice, interpreting the Data Protection 
Directive (Directive 95/46[/EC of the European Parliament and of the Council of 
24 October 1995 on the protection of individuals with regard to the processing of 
personal data and on the free movement of such data (OJ 1995 L 281, p. 31)], has 
ruled that a correct balance between those rights and interests is to be assessed on 
application of the provisions implemented in the national legislation on the basis 
of the directive. It is for the referring court to interpret the national legislation in a 
manner consistent with the directive and to ensure that the interpretation does not 
contravene the fundamental rights protected by the [EU] legal order or with the 
other general principles of [EU] law, such as, inter alia, the principle of 
proportionality (see judgment of the Court of Justice, Bodil Lindqvist[,] 
C-101/01[, paragraph 87])[.] 
In the view of the District Court, there is room for interpretation with regard to the 
question of the extent to which and for what purpose the GDPR allows the 
Member States to take legislative measures with regard to the processing of 
personal data and the requirements laid down by the GDPR for the national 
legislation adopted on the basis of that regulation. Since EU law takes precedence 
over national legislation, clarification in that regard is necessary to be able to rule 
on the matter. 
The GDPR expressly allows the Member States to provide for exemptions and 
derogations for the processing of personal data carried out for, inter alia, 
journalistic purposes. The GDPR does not define what constitutes journalistic 
purposes. The Court of Justice has stated that the expression is to be interpreted 
broadly and that activities the object of which is to disclose information, opinions 
or ideas to the public are to be regarded as being carried out for journalistic 
purposes, irrespective of the medium which is used to transmit them (see 
judgment of the Court of Justice, Satakunnan Markkinapörssi Oy and Satamedia 
Oy[,] C-73/07[, paragraph 61]). The Court of Justice further ruled that that is also 
the case of data from documents which are in the public domain under national 
legislation. However, it has not been further clarified whether the dissemination of 
information, opinions or ideas to the public also requires there to be some form of 
editing or processing of what is made available to the public. 
REQUEST FOR A PRELIMINARY RULING OF 1. 3. 2024 – CASE C-199/24 
 
6  
Anonymised version 
The District Court is of the view that it is unclear how the GDPR is to be 
interpreted in that regard. There are therefore grounds to request a preliminary 
ruling from the Court of Justice. 
Request for a preliminary ruling 
The District Court requests a preliminary ruling from the Court of Justice of the 
European Union on the following questions. 
1. Does Article 85(1) of the GDPR make it possible for the Member 
States to adopt legislative measures in addition to those which they 
must adopt under Article 85(2) of the regulation relating to the 
processing of personal data for purposes other than journalistic ones or 
the purposes of academic, artistic or literary expression? 
2. If the previous question is answered in the affirmative: Does 
Article 85(1) of the GDPR allow a reconciliation of the right to the 
protection of personal data pursuant to that regulation with the freedom 
of expression and of information which means that the only legal 
remedy available to a person whose personal data are processed by 
making criminal convictions involving that person available to the 
public on the internet in return for payment is the initiation of criminal 
proceedings for defamation or the claiming of damages for 
defamation? 
3. If the first question is answered in the negative or the second question 
is answered in the negative: Can an activity which consists of making 
available to the public on the internet in return for payment, without 
any processing or editing, public documents in the form of criminal 
convictions constitute processing of personal data for the purposes set 
out in Article 85(2) of the GDPR?