The Administrative Court's decision: The delineation between constitutional protection and GDPR sparks debate and impacts companies' ability to conduct background checks

The issue of voluntary publishing certificates has garnered attention in several rulings during the spring of 2024, including the Supreme Administrative Court's granting of leave to appeal and the Attunda District Court's request for a preliminary ruling from the EU Court of Justice. This could directly complicate the ability of companies providing background checks to obtain information about legal violations from authorities.

In March, the Administrative Court of Appeal in Stockholm ruled that a company holding a voluntary publishing certificate could not access information about legal violations, as it was assumed that the subsequent processing of the data would violate the General Data Protection Regulation (GDPR). The information was therefore deemed confidential.

In this case, a company requested personal data from the Prosecutor's Office, referencing a voluntary publishing certificate from the Swedish Press, Radio, and Television Authority (now the Media Authority), claiming that the personal data was intended for future journalistic activities. Previously, the company had indicated to the authority that it was conducting background checks and consulting services for recruitment. The Prosecutor's Office rejected the request, as it was not clearly evident that the journalistic purpose was primary, meaning that the Swedish exception from GDPR for journalistic activities was not applicable.

The Administrative Court of Appeal denied the company's appeal against the Prosecutor's Office's decision, ruling that the general exemption from GDPR under the Swedish Data Protection Act for holders of publishing certificates cannot always be applied as strictly as prescribed by law.

Going forward, it will be interesting to follow the developments regarding the delineation between the constitutionally protected principle of public access to information and EU law. Swedish courts have previously determined that constitutional protection takes precedence over the General Data Protection Regulation. If the Administrative Court of Appeal's ruling gains significant traction among Swedish authorities, it will represent a shift in previous court practices and will impact businesses that have relied on publishing certificates. This could, in turn, affect organizations that use search services for background checks.