Sweden's IMY rules Lexbase and Krimfup processed crime data without legal grounds

When the legal basis isn't there

Lexbase and Krimfup are Swedish databases that publish information about crimes and legal proceedings. They are subscription services aimed at lawyers, journalists and others who need to follow legal developments.

On 3 November 2026, Sweden's data protection authority IMY announced that both companies had processed personal data about crimes without having legal grounds under GDPR Article 6 ^[1]. The companies had argued that they had a legitimate interest in publishing the information, but IMY disagreed.

The processing included names, photos and details of criminal proceedings. IMY found that the companies had not shown that their interest in publishing the data outweighed the data subjects' rights and freedoms ^[1].

It's like keeping a guest list at a party. You can write down who came, and you might have good reasons for doing so. But if someone later asks why their name is on your list and you can't point to a solid reason they agreed to or a law that lets you, the list becomes a problem.

What GDPR Article 6 requires

Article 6 of the GDPR sets out the lawful bases for processing personal data ^[2]. You must have at least one before you start processing, and you must be able to demonstrate it.

The bases are:

• consent,
• performance of a contract,
• compliance with a legal obligation,
• protection of vital interests,
• a task carried out in the public interest,
• legitimate interests (except for public authorities in their core tasks).

Legitimate interest is the most flexible, but also the one that demands the most from you. You must show three things: that you have a legitimate interest, that the processing is necessary for that interest, and that the data subject's interests or fundamental rights don't override yours ^[2].

For special categories of data, which include data about criminal convictions and offences under Article 10, the bar is higher ^[2]. You need explicit consent, or a basis in Union or Member State law, or the processing must concern data the data subject has made manifestly public.

Why Lexbase and Krimfup failed the test

IMY found that Lexbase and Krimfup had not demonstrated a lawful basis ^[1]. Both companies had argued legitimate interest, but IMY concluded that the processing was not necessary for a legitimate interest they could show, and that the data subjects' rights outweighed any interest the companies might have had.

The authority also found that the companies had not adequately informed data subjects about the processing, as required by Articles 13 and 14 of the GDPR ^[1].

In Sweden, the processing of personal data about crimes is further regulated by the Patient Data Act (Patientdatalagen) for health records and by sector-specific rules, but for general databases like these, GDPR Article 6 and Article 10 apply directly ^[2].

What this means for you

If you process personal data, especially sensitive categories, ask yourself:

• Can you point to a specific legal basis in Article 6 before you start processing?
• If you rely on legitimate interest, have you documented why the processing is necessary and why your interest outweighs the data subject's?
• Can you show that documentation to a supervisor if asked?
• Are you telling data subjects what you are doing with their data, and on what grounds?

The answer to all four should be yes. IMY's decision shows that claiming a basis is not the same as having one, and that when the authority asks for evidence, you need to be able to produce it.

For anyone building systems that process data, the evidence question is whether you can show what legal basis you relied on at the time, and what your assessment was. A sealed record of your data protection impact assessment, your legitimate interest test or your consent mechanism, at the time you made the decision, is harder to question later than a document you could have edited since.

A record you can check

This is where a digital witness fits. When you process personal data, you document your legal basis and your assessment of necessity and proportionality. Sealing that record when you make the decision gives you something concrete to point to later.

What you seal is a fingerprint of your data protection impact assessment, your legitimate interest test or your record of consent, at the time you carried it out. You seal it through WitniumChain using the REST API, the SDK or the MCP server. The assessment itself stays in your systems; only the fingerprint is sealed.

When IMY or an auditor asks, you share the document and the witness. They calculate the fingerprint and check it against the sealed one. If it matches, they know the document hasn't changed since you sealed it.

A witness doesn't show that your basis was lawful or your assessment correct. It shows that this was the assessment you made at the time, not something you adjusted when the question came up.

Anyone you share the record with can check it. The first 2,000 witnesses a month are free.

What to watch

IMY has not yet announced penalties for Lexbase and Krimfup ^[1]. GDPR allows administrative fines of up to €20 million, or 4% of total worldwide annual turnover, for infringements of Article 6, whichever is higher ^[2].

The decision is a reminder that processing criminal data, even from public sources, demands a clear legal basis and a documented assessment. For anyone running a database, a directory or a service that publishes information about people, it is worth asking now: if your data protection authority asked, could you show the legal basis you relied on at the time you started processing?