Sweden's IMY says people-search sites must honour the GDPR

Sweden's IMY says people-search sites must honour the GDPR

3 November 2026: Sweden's data protection authority, IMY, has ruled that four of the country's people-search services must follow the GDPR despite holding constitutional press protection, and has reprimanded all four. Lexbase and Krimfup were found to process criminal-offence data without a legal basis; MrKoll and Upplysning failed to honour people's right to have data erased.

Not yet independently verified. The decisions are reprimands and orders without fines, and the IMY announcement gives no deadline for complying; we have not read the four decision documents in full. We will update this when it can be confirmed, and remove this note.

The four decisions

• Legal Newsdesk Sweden AB (Lexbase) and Fuplex AB (Krimfup): reprimanded under Article 10 of the GDPR for processing data about criminal offences without legal support, and ordered to make sure users can no longer see such data when searching by name, personal identity number or address.
• Nusvar AB (MrKoll) and Upplysning Checknode AB (Upplysning): reprimanded under Article 17 for not meeting individuals' right to erasure.

IMY says it has received about 3,800 complaints against the four companies.

Why a publishing certificate no longer shields them

All four services hold a voluntary publishing certificate (frivilligt utgivningsbevis), which under Swedish law extends constitutional freedom-of-expression protection to a website and, in the Swedish reading, switched off the GDPR's protections for individuals. IMY now finds that the Swedish exemption goes further than EU law allows, that EU law prevails where the two conflict, and that the services are not run for journalistic purposes, so Articles 10 and 17 apply.

"When the system of voluntary publishing certificates was introduced, it was never the intention that it would lead to this kind of extensive search service for personal data," said director-general Eric Leijonram, who pointed to recent rulings from Sweden's Supreme Court and the EU Court of Justice as the reason for the change. Of the searchable collections covering large parts of the population, he said: "Anyone can easily map us, for any purpose."

Who else should read the decisions

The rulings reach beyond the four sites. A business in Sweden that buys background checks, tenant screening or address lookups from a people-search service is now buying from a supplier IMY says is bound by the GDPR, and should expect erasure requests to take effect and criminal-record results to disappear from name searches. IMY separately grants some companies permission to process criminal-offence data for background checks; those hold the legal basis the two reprimanded services lacked.

Leijonram's own words set the scope: services "of the kind we have reviewed" must apply the right to erasure and the rules on criminal-offence data.

Sources

• IMY: Söktjänster behandlar personuppgifter på otillåtet sätt (Swedish), 3 November 2026