The European Union's top court has drawn a legal line between journalism and the commercial operation of paid criminal record databases, ruling that the two activities do not sit on the same footing under EU data protection law.

The decision, reported by Courthouse News, addresses a question that has grown increasingly urgent for media companies, data brokers and compliance teams across the bloc: who can claim the journalistic exemptions built into EU data protection rules, and where that protection stops when the underlying product is a subscription database of criminal records rather than reporting in the public interest.

What the court decided

At the core of the ruling is the distinction between activity carried out with a journalistic purpose — the collection and publication of information intended to inform the public on matters of public debate — and activity whose essential character is commercial, even where the data concerned touches on matters of public interest such as crime and convictions.

The court's holding matters because EU data protection law, including the General Data Protection Regulation, grants special treatment to journalistic activity. Processing carried out "solely for journalistic purposes" can be exempted from parts of the regulatory regime, provided safeguards balance the protection of personal data against freedom of expression. The question before the court was whether a paid database of criminal records — a product users pay to access — can shelter under that same umbrella.

The court's answer draws the boundary in favour of genuine journalism. The journalistic exemption, on this reading, is anchored in the purpose and nature of the activity: disclosure to the general public, editorial judgment, and a public-interest rationale. A database that monetises access to individuals' criminal records does not automatically acquire journalistic character simply because the underlying information relates to crime.

Why the distinction matters

Criminal record data sits among the most tightly regulated categories of personal information in the EU. The GDPR classifies data relating to criminal convictions and offences as special-category material that generally may be processed only under the authority of official bodies, or where member state law specifically authorises it. Companies that aggregate such records into searchable commercial products therefore face a high compliance bar, and the journalistic exemption has been one of the few argued routes around it.

By narrowing that route, the court signals that the exemption follows the function of the activity, not the subject matter of the data. Operators of paid databases containing conviction information will likely need to establish a lawful basis for processing under the ordinary rules — a difficult exercise for criminal record data — rather than relying on press-freedom arguments.

Practical consequences for practitioners

For media organisations, the ruling offers a measure of protection: traditional editorial work, including reporting on crime and convictions, remains within the sphere the exemption was designed to cover. For data-focused businesses, the decision narrows strategic options. Legal teams advising subscription data services, background-check platforms and reputation databases operating in the EU should review whether their processing models can survive scrutiny without journalistic cover, assess transfer and retention policies for conviction data, and consider whether restructuring toward genuine editorial publication is feasible or whether the EU market remains viable for the product at all.

Privacy practitioners, meanwhile, gain a clearer enforcement benchmark. National data protection authorities, which have pursued criminal-record databases in several member states, can now cite the EU-level ruling when assessing whether a commercial operator's press-freedom defence holds.

The decision also fits a broader pattern. EU courts have repeatedly been asked to define the perimeter of the journalistic exemption as media business models have shifted from publication to platform and database services. Each ruling has refined the test: the exemption protects the transmission of information to the public, not the commercial exploitation of information about individuals.

For companies caught on the wrong side of the line, the consequences are concrete. Processing criminal record data without a lawful basis exposes operators to regulatory action, orders to delete datasets, and fines calculated on group turnover under the GDPR's penalty framework.

The judgment now stands as the reference point for that boundary across all member states.