IMY reprimands four Swedish people-search services and rules GDPR overrides their constitutional shield
Sweden's data protection authority says Lexbase, Krimfup, MrKoll and Upplysning must follow GDPR rules on criminal-offence data and erasure, despite holding voluntary publishing certificates.
Sweden’s data protection authority, IMY, has issued reprimands to four companies running people-search services after supervisions under the GDPR. Legal Newsdesk Sweden AB (Lexbase) and Fuplex AB (Krimfup) processed personal data about crimes without a legal basis and are ordered to stop users seeing such data when searching by name, personal identity number or address. Nusvar AB (MrKoll) and Upplysning Checknode AB (Upplysning) failed to honour individuals’ right to erasure.
All four hold constitutional protection through voluntary publishing certificates, which under Swedish rules disapply GDPR protections. IMY found these national exemptions go further than EU law allows, that EU law prevails, and that the services do not serve a journalistic purpose. It therefore applied Article 10 and Article 17 GDPR.
IMY says it has received around 3,800 complaints against the companies, and cites new case law from Sweden’s Supreme Court and the CJEU.
Why it matters
The decisions reject the Swedish publishing-certificate route by which these services disapplied GDPR protections, so organisations relying on publishing certificates or similar national exemptions can no longer assume they are outside the GDPR. People-search operators, data brokers and firms that buy from them should expect erasure requests and criminal-offence data to be assessed under Articles 17 and 10. Teams sourcing Swedish personal data from such services should review the provenance and lawful basis of what they hold.
Status: Decision. Reprimands and orders issued; appeal position not stated
What to check
- Check whether any data your organisation sources from Swedish search services such as Lexbase, Krimfup, MrKoll or Upplysning includes criminal-offence data that now lacks a lawful basis under Article 10 GDPR.
- Check whether your organisation relies on a national exemption, such as a publishing certificate, to refuse erasure requests, and reassess it against IMY's finding that EU law takes precedence.
- Check that searches by name, identity number or address in any person-lookup tool you operate cannot surface criminal-offence data.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Order
- Authority
- IMY (Swedish Authority for Privacy Protection)
- Concerning
- Legal Newsdesk Sweden AB (Lexbase) and Fuplex AB (Krimfup), ordered and reprimanded; Nusvar AB (MrKoll) and Upplysning Checknode AB (Upplysning), reprimanded
- Law
- GDPR Article 10 (criminal offence data) and Article 17 (right to erasure)
Case status: Open
Enforcement trackerInstitutions
Who should care
- DPO
- Legal & compliance
- Data stewards
- CDO