Har lagstiftaren mist koll på EU:s dataskyddskrav? - En analys av artikel 85 GDPR och dess konsekvenser i förhållande till den svenska regleringen av digitala söktjänster med utgivningsbevis

Sammanfattning

In Sweden, there are several companies that, relying on the principle of public access to official documents, gather personal data and publish this information in online search services. Through use of these services, it is possible to access a detailed profile of a specific individual. The search services have generally been granted a so-called certificate of publication and are consequently protected under the Fundamental Law on Freedom of Expression (YGL). The commonly accepted view in Sweden has been that search services with a certificate of publication are exempt from the GDPR, based on Chapter 1, Section 7 of the Swedish Data Protection Act. This provision is based on Article 85 GDPR, which states that the right to protection of personal data shall be reconciled with the right to freedom of expression and information. The Swedish legislator has interpreted Article 85 broadly and concluded that it allows YGL to take precedence over the GDPR. This despite the fact that EU law takes precedence over Member States’ law according to the CJEU’s established case law. An alternative interpretation of Article 85 GDPR suggests that exceptions or derogations are only permitted for the purposes listed in Article 85(2). The question then becomes whether the search services fall within the scope of exceptions or derogations for “journalistic purposes” under Article 85(2) GDPR and, if not, whether Article 85(1) permits exceptions or derogations for additional purposes. The purpose of this essay is to interpret Article 85 GDPR and to analyse what requirements EU law imposes on the Swedish Authority for Privacy Protection (IMY) upon receipt of complaints against search services with a publishing certificate. A legal dogmatic method is applied to achieve this aim. This essay adopts an EU law perspective and applies the textual, systematic, and teleological methods of interpretation commonly used by the CJEU. This essay concludes that a proper interpretation of Article 85 GDPR limits Member States’ mandate to introduce exceptions or derogations from the GDPR to the specific purposes in Article 85(2). Article 85(1) GDPR does not allow exceptions or derogations for additional purposes. Regarding Article 85(2), this essay concludes that “journalistic purposes” entails dissemination to the public of information, opinions or ideas that are of interest to the public debate. It is unlikely that the search services in question would qualify as processing personal data for journalistic purposes. Exceptions or derogations from the GDPR must also be necessary and proportionate in relation to their objective. This requires a proportionality assessment in each individual case. It is clear based on these conclusions that the Swedish regulation of search services with a publishing certificate is not compatible with EU law. When complaints are made against such services, IMY must therefore, to comply with the requirements of EU law, set aside the Swedish provisions and give full effect to the GDPR.