Sweden's data protection authority rules criminal record sites break the law

What the decisions say

On 8 January 2025, Sweden's data protection authority IMY issued two decisions ordering Lexbase and Krimfup to stop making criminal records searchable by name, personal identity number or address ^[1]. IMY found that both companies violate article 5.1(c) and (f) of the GDPR by collecting and publishing more personal data than necessary for their stated purpose, and by failing to protect the integrity of the individuals whose records they publish.

The sites in question gather criminal records from public court decisions and make them searchable online. IMY's complaint is not that the records are public, because court decisions are, but that the way the sites present them goes further than the law allows. Think of it like this: you can walk into a library and read court judgments, but if someone photocopies every case mentioning your name and pins them on a noticeboard outside your house, that crosses a line. The GDPR says personal data must be limited to what is necessary for the purpose, and IMY has decided these sites overstep that line.

According to Kollega, which reported the decisions, IMY's view is that allowing searches by name or personal identity number makes it too easy to compile a complete picture of an individual's criminal history, even when the underlying convictions are spent or the person has moved on ^[1]. The decisions are not yet final and can be appealed to the Administrative Court in Stockholm.

Why it matters

Criminal records are among the most sensitive pieces of information about a person. In Sweden, the legal principle is that convictions become spent after a certain time, meaning they no longer appear on criminal record extracts and, in many contexts, need not be disclosed. The idea is rehabilitation: once you have served your sentence and enough time has passed, society should not keep holding it against you.

Searchable databases undermine that. If an employer, a landlord or a neighbour can type your name into a search box and see every conviction from twenty years ago, the spent convictions policy is worth less in practice. That is the tension IMY is addressing. The GDPR requires that processing be limited to what is necessary, and IMY has decided that making records searchable by name is not.

The ruling also raises the evidence question for anyone running a searchable database of public records. If you are ordered to stop a particular processing activity, you will need to show what you did and when you stopped. That means being able to point to records of search functionality, database queries and access logs, in a form that holds up if the decision is appealed or if someone later claims you did not comply.

What the companies say

Neither Lexbase nor Krimfup has yet publicly stated whether they will appeal, according to Kollega's report ^[1]. If they do, the case will turn on whether the sites' stated purposes — transparency, public interest journalism and accountability — justify the level of detail they make available. The companies are likely to argue that their databases serve a legitimate public interest and that the information is already public. IMY's position is that even public information must be processed in line with the GDPR's principles, and that includes data minimisation and integrity protection.

The cases are not the first time searchable criminal record sites have been questioned. In 2021, the European Court of Justice ruled in a case involving a Latvian site that making old criminal records endlessly searchable could violate the right to be forgotten, even when the underlying decisions were public ^[2]. That case dealt with a request for delisting under article 17 of the GDPR; the Swedish decisions deal with the lawfulness of the processing itself under article 5.

What this means for you

If you run a site or a database that republishes public information, the question is no longer just whether the information is public, but whether the way you present it is proportionate. Ask yourself:

• Could someone use your site to compile a detailed profile of an individual?
• Does your search function let people search by name, personal identity number or address?
• Have you documented why that level of access is necessary for your stated purpose?
• Do you have records of what your site allowed people to search for, and when, in case someone later questions it?

The last question is where logs come in. If you are ordered to change your site, you will want to be able to show what it did before, what you changed and when. A log you keep yourself can be questioned; a sealed log is harder to dispute.

Sealing access logs and search queries

In a case like this, the thing to seal is the access log and a record of the search functionality: what fields were searchable, what queries were run and when the functionality was removed. Sealing takes a fingerprint of each log segment, not the content, so the logs stay with you. When IMY, a court or an auditor later asks what the site allowed, you can share the log and they can check that it has not been edited since it was sealed.

That check works because a sealed fingerprint acts like a postmark: change one character in the log and the fingerprint no longer matches. Anyone you share the log with can run the check without having to trust you. WitniumChain lets you seal log segments as they are written, through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free, and you can read the full documentation here.

What sealing does not do is settle whether the processing was lawful in the first place. That is IMY's call, and if they say stop, you stop. What it does is give you a record of compliance that nobody can quietly rewrite afterwards.

How it would work

1. Seal log segments every few minutes: timestamp, query type, search fields available and any configuration changes.
2. When asked to demonstrate compliance, share the logs and the witness IDs.
3. The recipient calculates the fingerprint and checks it against the sealed version.

What to watch

The decisions can be appealed to the Administrative Court in Stockholm within three weeks of the date the companies received them ^[3]. If they are appealed, the cases could clarify how Swedish courts interpret the GDPR's data minimisation and integrity principles when applied to databases of public records. That would matter for anyone republishing court decisions, company records, property registers or other public information in searchable form.

In the meantime, if you run a similar site, it is worth reviewing what your search function allows and whether you can justify it under article 5.1(c). And if you make changes, keep a record of what you changed and when, sealed in a way that holds up later.