EU ruling on Lexbase: what it means for Ratsit and MrKoll

Published 6 October 2026 Checked 6 October 2026

Läs på svenska

Ratsit, Hitta, MrKoll and similar sites hold publishing certificates (utgivningsbevis), and have therefore said the GDPR doesn’t apply to what they publish. On 9 July 2026, the EU Court of Justice delivered a ruling that changes the picture. Here’s what it says, and what it means for you.

What the ruling says

The case is C-199/24 and concerned Lexbase, a search service that shows criminal judgments for a fee. The Attunda District Court asked the EU Court to interpret the GDPR. The Court concluded three things:

• The publishing certificate isn’t enough. A country may only make exemptions from the GDPR for journalism and for academic, artistic or literary work. So a publishing certificate doesn’t by itself exempt a site from the GDPR.
• Defamation isn’t the only route. People in such a database must be able to do more than report defamation or claim damages for defamation.
• Journalism requires editorial work. A database of judgments can only count as journalism if the material is processed before publication, the publishing follows press ethics or at least an editorial line, and the facts are checked before publication.

The case now goes back to the Attunda District Court, which will decide whether Lexbase’s activity is journalism. The ruling at the EU Court.

What does it mean for Ratsit, Hitta and MrKoll?

The ruling was about a site with criminal judgments. Whether the same applies to sites that show addresses and phone numbers hasn’t been tested yet. But the sites can no longer rely on the publishing certificate alone. They need to be able to show that what they do is journalism.

IMY is reviewing four sites

The Swedish Authority for Privacy Protection (IMY) is reviewing Lexbase, Krimfup, Upplysning.se and MrKoll. For Lexbase and Krimfup, the question is whether they break the GDPR by publishing data about crimes. For Upplysning.se and MrKoll, it’s whether they break the GDPR by not deleting data on request.

The reviews are ongoing, and IMY says it is analysing what the ruling means for them. IMY hasn’t given a date for its decisions. Meanwhile, it isn’t investigating individual complaints about those four sites. In September 2026, IMY also asked the European Data Protection Board (EDPB) to clarify which data about crimes is covered by the GDPR’s stronger protection. IMY on the review (in Swedish).

No constitutional change for now

A government inquiry proposed limiting the sites’ constitutional protection. The government has said it isn’t going ahead with the proposal for now. Instead, it will look into regulating the sites through ordinary law.

What can you do?

1. Use the sites’ own removal routes. They already work, they’re free and they’re usually fastest. How to do it on every site.
2. Request erasure under the GDPR. The site has to reply within a month. If it says no, consider replying with a reference to the EU Court’s ruling C-199/24. Kolla själv writes the email for you.
3. Keep every reply. A no is also worth keeping, in case you want to complain later.
4. Ask Google to remove the results. Google can remove results that show your address or phone number, even when the site says no. Here’s how.

We’re following the issue and will update the law page when IMY or the courts have spoken.

A simplified explanation, not legal advice.

Questions