A Narrow Reading of Article 85

The Court of Justice of the European Union (CJEU) has ruled that Sweden's broad exemption from GDPR rules, granted under Article 85 for journalistic purposes, does not stretch far enough to cover companies that sell access to personal data as a commercial product. The decision, handed down on 9 July 2026, blocks Sweden's attempt to shield certain data-handling practices from full GDPR scrutiny simply by labeling them journalistic or editorial in nature.

Article 85 of the GDPR allows member states to carve out exemptions for journalism, academic expression, and artistic or literary expression, recognizing that strict data protection rules can sometimes conflict with freedom of expression. Sweden had used this provision to justify a wide exemption that some companies relied on to avoid GDPR obligations. The CJEU's ruling draws a firmer line: the exemption exists to protect genuine journalism, not to give commercial data operations a free pass.

From Editorial Policy to Paywall

The case at the center of this ruling involved a company selling access to court judgments and related personal data, reportedly behind a paywall. The firm argued that its activity qualified as journalism under Sweden's national exemption, which would have placed it largely outside the reach of GDPR obligations. The CJEU disagreed, finding that reselling access to personal data as a subscription product does not automatically transform into protected journalistic activity, even if the company maintains something resembling an editorial policy.

This distinction matters because it revives a previously dismissed damages claim worth SEK 300,000. A person whose personal data was processed and sold under the disputed exemption can now pursue that claim, since the legal shield the company relied on has been narrowed by the court. The ruling does not eliminate Sweden's journalism exemption altogether, but it does mean the exemption can no longer be stretched to cover any business that packages personal data as searchable or purchasable content.

The underlying question the court had to answer was deceptively simple: does having an editorial policy, on its own, justify treating a data business as journalism? The CJEU's answer suggests the substance of the activity matters more than how a company chooses to describe itself.

Why This Matters Beyond Sweden

While the ruling directly concerns Swedish law, CJEU decisions interpreting GDPR provisions apply across the European Union. Any member state that has implemented a similarly broad journalism or editorial exemption under Article 85 will now need to reconsider how far that protection extends. Companies that sell aggregated personal data, court records, background checks, or similar paywalled products can no longer assume that framing their service as informational or editorial content will keep them outside GDPR's reach.

This fits into a broader pattern of European courts and regulators tightening enforcement around data brokers and secondary data markets. Personal information originally collected or published for one purpose, such as public court records, has increasingly been repackaged and resold by intermediaries. Regulators across Europe have shown growing willingness to test whether these business models comply with data protection law, rather than accepting exemptions at face value.

What This Means For You

For everyday users, this ruling reinforces a simple but important point: personal data does not lose its legal protections just because a company relabels its handling of that data as journalism or editorial work. If your personal information, whether from a court record, public registry, or another source, ends up being sold as part of a paid data product, you may have stronger legal grounds to challenge that processing and seek damages if it violates GDPR.

The ruling also signals to data brokers and aggregators operating in the EU that editorial framing alone will not satisfy regulators or courts going forward. Businesses relying on Article 85-style exemptions should expect closer scrutiny of whether their core activity is genuinely journalistic or simply commercial data resale wearing an editorial label.

Key Takeaways

  • The CJEU has narrowed Sweden's GDPR journalism exemption under Article 85, ruling it does not cover companies selling personal data behind a paywall.
  • A SEK 300,000 damages claim, previously blocked by the exemption, has been revived as a result.
  • Having an editorial policy is not enough on its own to qualify a commercial data operation as journalism.
  • The decision applies EU-wide reasoning, meaning other member states with similar exemptions may face comparable legal challenges.
  • If you believe your personal data has been resold or processed under a questionable exemption claim, this ruling strengthens the case for pursuing a GDPR complaint or damages claim.

As European courts continue refining where free expression protections end and commercial data exploitation begins, this ruling gives consumers a clearer, sharper tool to push back against companies that monetize personal information while hiding behind exemptions designed for something else entirely.