Sweden's privacy regulator, Integritetsskyddsmyndigheten (IMY), has concluded that the companies behind the Lexbase and Krimfup search services handled personal data about criminal offences without a lawful basis, according to Dagens Nyheter. The finding follows an audit of the two services, run by Legal Newsdesk Sweden AB and Fuplex AB respectively. IMY has ordered both companies to make sure users can no longer access such information by searching for a person's name, national identity number or address.
The authority also issued reprimands to two other operators. Nusvar AB, which runs MrKoll, and Upplysning Checknode AB, which operates Upplysning, were criticised because they had not honoured the right to erasure that individuals are entitled to under the law, Dagens Nyheter reports.
Why it matters
The decisions touch on a long-running debate in Sweden about searchable databases that compile information on large parts of the population. IMY's director-general, Eric Leijonram, framed the issue in broad terms in a press statement carried in the reporting.
– We have a situation in Sweden with searchable collections of information about large parts of the population. Anyone can easily map us out, for any purpose whatsoever. Now it becomes clear, however, that search services of the kind we have reviewed need to apply the right to erasure and follow the requirements that exist for processing information about crimes, he said, according to the statement.
In other words, the regulator is not only examining individual complaints but signalling that the business model of these services must change. The ability to look up a neighbour, a prospective employee or a former partner by name and see references to criminal cases has been a persistent privacy concern, and IMY's assessment gives that concern a formal legal footing.
What the companies must change
The core of the order against Legal Newsdesk Sweden AB and Fuplex AB concerns how their services let people find information. IMY requires the companies to ensure that users cannot take part in data about criminal offences by searching on a person's name, personal identity number or address. The authority's finding is that the processing of such data has lacked legal support.
The reprimands against Nusvar AB and Upplysning Checknode AB address a different obligation. Under the law, private individuals have a right to have their data erased, and IMY found that the two companies had not met that right. A reprimand is a formal criticism rather than the more direct intervention of an order, but it places the companies on notice about their handling of erasure requests.
The reporting does not detail the specific legal provisions IMY relied on, nor the deadlines attached to the orders. It also does not say whether any of the companies have responded to the decisions or indicated whether they will appeal.
A sector under scrutiny
The four companies named in the reporting sit in the same corner of the Swedish internet: services that aggregate court judgments, public records and other official data and make them searchable by members of the public. Lexbase and Krimfup focus on criminal cases, while MrKoll and Upplysning cast a wider net over personal information.
IMY's review places the emphasis on two distinct principles. The first is that information about criminal offences is treated as a sensitive category requiring a proper legal foundation before it can be processed. The second is that people must be able to exercise their right to have data removed. The regulator's message, as summarised by Leijonram, is that services of this type must apply erasure rights and comply with the rules for handling crime-related data.
The decisions were reported by Dagens Nyheter and picked up by several other Swedish outlets, including TV4 Nyheterna, Sydsvenskan, SVT Nyheter and Sveriges Radio, reflecting the public interest in how these databases operate.
What to watch next is whether the companies comply with the orders or challenge them, and whether IMY's assessment prompts further scrutiny of other searchable record services in Sweden.
