The Swedish Supreme Court previously addressed bulk access to criminal judgments in NJA 2025 s. 123 I and II. Those decisions concerned the relationship between Swedish constitutional rules on public access and freedom of expression and the GDPR. Please see our previous article here.
The Supreme Court has now issued a new decision on a related issue in case Ä 9385-25. The case concerned an operator of a legal database service with a certificate of publication under Swedish constitutional law. Such certificates have historically limited the application of GDPR rules in Sweden.
The operator had requested a large number of judgments and other decisions from a Swedish court. The court of appeal granted access but imposed broad conditions on the use of the material. It did so against the background of NJA 2025 s. 123 I and II. In practice, the conditions effectively prohibited the use of the material for commercial purposes.
The operator appealed and argued that the restrictions should not apply to all judgments and decisions. The Supreme Court agreed in substance and limited the restrictions to material containing criminal offence data linked to an identifiable person (i.e., primarily criminal judgements).
The Supreme Court drew the following distinction:
- Criminal offence data (article 10 GDPR): Documents containing information relating to criminal offences, including criminal judgments, may be disclosed subject to conditions effectively restricting them from being used for commercial purposes as large-scale processing of such data is at risk of being in conflict with GDPR.
- Special categories of personal data (article 9 GDPR): Documents containing data such as health information must be assessed separately. In this case, the Supreme Court found no basis for assuming that the operator would process such data in breach of the GDPR. Such documents were therefore not subject to the above-mentioned conditions. However, this does not mean that the data may be freely used for commercial purposes. Any subsequent processing must still comply with the GDPR, including the restrictions applicable under article 9 GDPR.
- “Other” personal data: Ordinary personal data does not justify restrictions merely because the documents are requested in bulk (e.g., “standard” civil court cases).
The decision adds important nuance to NJA 2025 s. 123 I and II. The restrictive approach in those cases does not automatically apply to all court decisions requested in bulk. Swedish courts must distinguish between criminal offence data, special categories of personal data and other personal data when applying Swedish constitutional law alongside the GDPR.
