Reconciling data protection and ‘new media’: The judgment in Legal Newsdesk Sweden (Case C-199/24)

 

 

Lorna Woods, Professor Emerita, University of Essex

 

Photo credit: Océanos y dados, via Wikimedia commons

 

Introduction

This case deals with one of the perennial questions that has faced legal regimes which recognise special treatment for journalism and new media since the advent of “new media”, that is, how far are such exceptions and preferential treatment extended? While a question for individual States to balance the freedom of expression concerns with other rights and societal interests, for the EU there is also the fact that Member States seemingly take very different approaches.  The Swedish rules, the subject of this case, provide broad protections and exemptions from data protection rules; but are they compatible with the GDPR?

 

The Facts

The case originated when ND, who had been convicted a criminal offence, sought to have details of that offence removed from the database provided, for a fee, by Legal Newsdesk Sweden.  The database allows individuals and businesses to search for those who have been subject to criminal prosecution before a Swedish court. ND’s request for erasure of the data was not met and ND sought damages for failure to comply with data protection rules. Legal Newsdesk Sweden relied on a Swedish law exempting journalism from the GDPR, and the fact that the relevant authority had granted Legal Newsdesk Sweden a certificate confirming the protection applied (utgivningsbevis). Further this meant that the only remedies available to ND against Legal Newsdesk Sweden would be criminal prosecution or civil claims for defamation.

 

The Questions

The case revolved around the Swedish law’s compatibility with the GDPR and specifically whether the rules fell within the space created by Article 85. Article 85 provides:

 

(1) Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

 

(2) For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

 

The national court referred three questions around the scope of Article 85(1) and (2) and their relationship to one another:

 

Is the list in Article 85(2) exhaustive or does Article 85(1) allow member States to adopt legislative measures in relation to further categories of activity?

 

Does the Swedish approach of limiting the remedies available to a person to criminal proceedings or defamation find an appropriate balance between freedom of expression and data protection?

Can the making available of information based on public documents in a database for a fee  without any processing or editing constitute processing of personal data for the purposes identified in Article 85(2) (specifically journalistic purposes)?

 

Judgment

As regards the first question, the Court held that the right to derogation from data protection rules applies only in relation to the categories enumerated in Article 85(2). The Court noted that Article 85(1) establishes a general rule about reconciliation of freedom of expression and GDPR requirements, but Article 85(2) operationalises it.  Although the term "including" confirms that journalistic, academic, artistic, and literary processing are only part of that reconciliation, paragraph 1 in itself does not grant independent exemption authority; that is the role of Article 85(2). The requirement to provide exceptions only applies to those exceptions listed. Exceptions are interpreted narrowly, and taking this approach provides a “fair balance”, as required by the principle of proportionality, between Charter rights.

 

As regards the second question, Article 85(2) lists the rights that may be limited, and that list does not include the rights to remedies provided for in the GDPR.  While there is Member State procedural autonomy, the GDPR confers directly effective rights and they can only be limited by conditions found in the GDPR. This means limitations such as those found in the Swedish law are not compatible with the GDPR.

 

The third question concerned whether the provision of the database constituted processing of personal data for journalistic purposes.  The Court confirmed, first, that the making available of documents to the public constituted processing. That exemptions were to be provided if necessary to provide the balance specified in Article 85(1). Moreover, the definition of journalism from Article 9 Directive 95/46 was in principle transposable to inform the concept of journalistic purposes, which was not otherwise defined, for the GDPR.  The Court referred to the definition in Satskunnan Markkinaporsii and Satamedia (Case C-73/07):

 

“disclosure to the public of information, opinions or ideas, irrespective of the medium which is used to transmit them”.

 

The Court also referred to Recital 153 GDPR which emphasises that the term should be interpreted broadly. The Court, however, continued to say it

 

“cannot cover all forms of expression but must be understood in a way that takes into account what differentiates, from the point of view of the manner in which they are created, journalistic expression from other forms of expression” [para 64]

 

The Court then referred to the case law of the European Court of Human Rights on protection of journalism within freedom of expression (Article 10 ECHR). From this body of jurisprudence, the CJEU identified three aspects:

• carrying out the role of editing or adapting material, or publishing according to an editorial line or policy;
• verification of factual claims for reliability; and
• compliance with journalistic ethics.

 

The Court suggested that a service that simply makes criminal convictions available to anyone willing to pay, without editorial review or processing, is unlikely to satisfy those requirements.  The Court did emphasise that when the protections apply, they apply also to prior research as to publication.  So convictions can be useful raw material for journalists, but the processing is for  journalistic purposes only if those documents are used exclusively for such activity.

 

Commentary

This judgment is a strong defence of data protection and the coherence of the GDPR regime.  The main point of interest in this judgment is the Court’s approach to journalistic purposes. Before discussing that, it is also worth noting that in the Court’s approach to the relationship between Article 85(1) and 85(2), it has taken an approach with favours maximum harmonisation rather than allowing too much space for Member States to go their separate ways.  This re-emphasises the supremacy of EU law, and the narrowness of exceptions thereto, even when States’ individual constitutions are in issue. It is arguably a narrow interpretation of Article 85.  There is a question of how the balance that the Court has struck in Article 85(1) might impact other forms of data processing that impact the public information sphere – what for example, about search engines (already the subject of some jurisprudence: Case C-136/17 GC et al and Case C-460/20 TU and RE v Google), social media and – increasingly – chatbots?

 

Rights are a theme throughout this judgment but it is interesting to note that while the rights which the Swedish rules sought to limit were those relating to remedies, the Court did not rely on the right to a remedy as a fundamental right to support its argument. Rather, it relied on the fact that these were directly effective rights derived from the GDPR. The concern was the priority of EU legislative objectives over national concerns.

 

The main significance is the establishment of a three stage test for “journalistic purposes” which had hitherto been undefined.  The previous position had been established in Satamedia, and further elaborated in Google Spain (Case C-131/12) and Buivids (Case C-345/17), all of which seemed to be orientated towards elaborating the idea of informing the public which is the base of the definition in Satamedia.  It is arguable, that Legal Newsdesk Sweden’s activities might not fall within the scope of this definition anyway – though the position was certainly unclear. In identifying further criteria, however, the Court has provided more clarity and likely narrowed the scope of the journalistic purposes exception.  It is interesting to note that the Court has taken cases about the level or protection awarded to journalists within the ECHR jurisprudence to identify qualifying criteria for being a journalist (of carrying out journalistic purposes) in the GDPR context- a shift from assessing how to identifying who. Whether this shift is significant in practical terms is rather uncertain – both Courts seem to be asking if the person is behaving according to relevant standards to gain the benefits of extra protection (and neither require institutional affiliation as a precondition of receiving the status).

 

While the focus in the case was just about resale of public information without any amendment, contextualisation or commentary (and possibly data brokerage generally including digital archives, research platforms, aggregators, and people-search services), the implications go further and impact “citizen journalists”, bloggers, gossip sites and other public communicators who might have assumed that they would benefit from protections, even though they might also not have bothered with fact checking and ethical considerations around news-gathering and publication. While they might have argued that they contributed to informing society, now there are more specific and arguably less vague requirements to satisfy – those around verification and ethics. Although this is a narrowing of their protections, it does not mean such speakers are off air – it means that they have to pay more attention to how they acquire and retell stories.  It is also important to note that the Court has not as a point of principle excluded private actors (rather than those earning a living from journalist) from the scope of state protections, and nor does the fact that such activities are done for money affect the assessment of whether they are done for journalistic purposes or not. And, of course, traditional journalism and media are not affected by this ruling.

 

One final point is also clear: the Swedish system will require significant overhaul if it is to comply with GDPR requirements.

From recognition to positive obligations: the ECJ’s judgment in Shipov (C-43/24)

 

 

By Marzia Genovese, Postdoctoral Lecturer and Researcher in Public Law at the European Documentation and Research Centre of the University of Pau (France).

Photo: Bulgaria Palace of Justice; photo credit Bim in Garten via Wikimedia Commons

      I.         Introduction

In K.M.H. v Obshtina Stara Zagora (Shipov, C-43/24), the Grand Chamber of the Court of Justice of the European Union (ECJ) held that Article 21 TFEU and Article 4(3) of Directive 2004/38, read in the light of Article 7 of the Charter of Fundamental Rights of the EU, preclude national legislation that does not permit a transgender Union citizen to amend certain data recorded in civil-status registers. The judgment builds upon the Court’s recent decision in Mirin and forms part of a broader line of case law concerning the relationship between free movement rights, personal status and gender identity.

The decision will likely be welcomed as a further step in the protection of transgender Union citizens exercising their free movement rights, yet the lines of reasoning adopted by both the Court and the Advocate General (AG) raise a number of conceptual and constitutional questions that remain insufficiently explored.

This contribution argues that Shipov marks a significant development in the evolution of Article 21 TFEU. Unlike Mirin, the case did not involve the recognition of a legal status previously acquired in another Member State. Instead, the Court used Article 21 TFEU to impose a positive obligation affecting the organisation of national civil-status law itself. At the same time, it does so through reasoning that leaves several conceptual and constitutional questions unresolved. In particular, the Court employs notions such as sex, gender and gender identity, without clearly identifying the legal category that Member States are required to recognise or modify. Additionally, the Court’s reasoning raises broader questions regarding the practical scope of Member State autonomy in matters of civil status.

The discussion proceeds in four steps. It first examines the conceptual uncertainty underlying the judgment. It then considers the shift from mutual recognition to self-standing positive obligations under Article 21 TFEU, before analysing the limitations of the AG’s reasoning as well. Finally, it reflects on the implications of Shipov for the relationship between Union citizenship and national competence in matters of civil status.

II. Conceptual ambiguity: what exactly must be changed?

One of the most striking features of Shipov is the conceptual ambiguity underlying the Court’s judgment. Throughout the proceedings, a number of distinct notions appear interchangeably, such as sex, gender and gender identity. Yet neither the Court nor the Advocate General clearly explain the legal relationship between these concepts or identify with precision which of them forms the object of the obligation imposed on Member States.

Such an obligation necessarily presupposes the identification of the legal category to be modified. Is EU law requiring the recognition of a person’s gender identity, the amendment of legal gender or the modification of civil-status records relating to sex? The judgment offers no clear answer.

The ambiguity culminates in the operative part of the judgment, where the Court refers to “data relating to gender, such as sex” (paras 36 and 56). This formulation is difficult to reconcile with a coherent conceptual framework. If sex and gender are distinct categories, as the Court itself appears to assume throughout the proceedings and it is also scientifically established, the judgment fails to explain why they can be treated as interchangeable for the purposes of civil-status registration. Conversely, if the two concepts are understood as functionally equivalent, the Court never justifies the use of separate terminology throughout its reasoning and moves fluidly between references to sex, gender identity and personal appearance without clarifying the legal significance of each concept.

This ambiguity is not merely semantic. It has direct implications for legal certainty. Member States remain, in principle, competent in matters of civil status. If EU law nevertheless requires them to modify certain entries contained in civil-status records, they must be able to determine with reasonable clarity and certainty which legal category is affected and what precisely must be recognised. By treating distinct dimensions as largely interchangeable, the Court risks obscuring the precise basis of the obligation imposed on Member States.

Moreover, the Court’s treatment of intersex and transgender persons illustrates the conceptual difficulties underlying the judgment (para 22). In assessing the Bulgarian legal framework, the Court appears to rely on the fact that national law permits the amendment of civil-status records in certain situations involving intersex persons whilst excluding such amendments for transgender persons. Yet the comparability of those situations is largely assumed rather than demonstrated.

This omission is significant. Intersex variations and transgender identity raise distinct legal and factual questions. The former concern biological conditions that may affect the classification of sex at the time of birth and, consequently, the accuracy of the original civil-status registration. The latter concern the recognition of a gender identity emerging after birth and whose legal implications are conceptually different from the correction of an allegedly inaccurate birth record. The Court does not explain why these situations should be treated as comparable for the purposes of civil-status registration, nor why legal solutions developed in one context should necessarily apply in the other.

Whether the situations ought ultimately to be treated alike is therefore not the central issue. The difficulty lies in the absence of a clear comparability analysis. By moving between different categories without defining the legal relevance of each of them, the judgment further reinforces the conceptual ambiguity already present elsewhere in its reasoning.

This difficulty is compounded by a second and arguably more fundamental question: does Shipov fit within the logic of the Court’s earlier citizenship case law at all?

III. From recognition to self-standing positive obligations

The Court presents Shipov as part of a broader line of case law concerning the exercise of free movement rights by Union citizens. Yet a closer examination reveals that the judgment departs in a significant respect from the logic underlying the Court’s earlier decisions on civil status.

Cases such as Grunkin-Paul, Coman and, more recently, Mirin were all built around a common premise: a legal status had already been lawfully acquired in one Member State and another Member State refused to recognise it. The obstacle to free movement arose from the coexistence of conflicting legal situations within the Union. In those circumstances, the Court relied on Article 21 TFEU to prevent Union citizens from suffering disadvantages resulting from the exercise of their right to move and reside in another Member State.

In Mirin, for example, the applicant had obtained legal recognition of his gender identity in the United Kingdom and sought recognition of that status in Romania. The Court’s intervention therefore remained rooted in a logic of mutual recognition. Romania was not required to create a new legal status; it was required to recognise one already validly established elsewhere in the Union.

Shipov presents a fundamentally different situation. The applicant had not obtained legal recognition of her gender identity in Italy or in any other Member State. No foreign administrative act, judicial decision or civil-status record existed that could serve as the object of recognition. The case therefore lacked the transnational legal element that had justified the Court’s intervention in previous cases. This distinction is not merely factual. It alters the very nature of the obligation imposed by EU law.

In the absence of any status acquired elsewhere, Bulgaria was not asked to recognise an existing legal situation. Rather, it was required to provide a mechanism through which a new legal status could be established under Bulgarian law itself. Article 21 TFEU thus ceases to operate as a principle of recognition and becomes a source of self-standing positive obligations affecting the organisation of national civil-status systems.

The significance of this shift should not be underestimated. Mutual recognition has traditionally allowed the Court to balance free movement rights with Member State autonomy. Whilst Member States remained free to determine the substantive conditions governing civil status within their own legal systems, they could not disregard legal situations lawfully established elsewhere. This logic preserved a degree of constitutional pluralism by distinguishing between the creation of legal status and its recognition.

In Shipov, however, that distinction becomes increasingly difficult to maintain. Once Article 21 TFEU is capable of generating obligations independently of any foreign status requiring recognition, the Court’s review is no longer confined to ensuring the continuity of legal situations across borders. It extends to the substantive content of national rules governing civil status. The competence formally remains national, but the outcome is increasingly shaped by EU law.

IV. The Advocate General’s ‘functional’ solution and its limits

 

If Shipov cannot be really explained through the logic of mutual recognition, a different justification is required. The AG sought to provide one by focusing on the functional role of identity documents in facilitating the exercise of free movement rights. Since identity documents play a crucial role in enabling Union citizens to move and reside freely within the Union, the Member State of nationality could not, in his view, maintain a system that prevented such documents from reflecting a person's lived gender identity.

The most problematic aspect of the Opinion, however, lies elsewhere. In paragraph 94, the AG expressly states that the original indication of the applicant’s sex should not be regarded as erroneous and should not be treated as a mistake requiring rectification. Two paragraphs later, moreover, he recalls the ECtHR’s recognition of the “historical nature” of birth records and of the continuing relevance of the sex assigned at birth for establishing facts predating gender reassignment. Yet the solution advocated by the Opinion ultimately requires the creation of a legal mechanism through which the same birth certificates may be amended in order to reflect a subsequently recognised gender identity.

The resulting tension is difficult to ignore. If the original registration was accurate and birth certificates serve, at least in part, a historical function, the Opinion never adequately explains why EU law nevertheless requires their amendment.

This tension is reinforced by the AG’s own discussion of Article 3(2) of Regulation 2025/1208. There, he acknowledges that EU law does not require Member States to include a reference to sex or gender on national identity cards and permits them to omit such information altogether, unlike the International Civil Aviation Organisation (ICAO) standards applicable to passports and other travel documents (all Member States, but not the EU, are parties to the Convention establishing the ICAO). If the objective pursued is the removal of obstacles to free movement, the necessity of amending birth certificates becomes considerably less obvious. The Opinion does not explain why that objective cannot be achieved through less intrusive means. As paragraph 82 of the Opinion makes clear, the perceived necessity of amending the birth certificate stems largely from the fact that Bulgarian identity documents are based upon that record, yet this approach risks extending the reach of Article 21 TFEU into matters that traditionally fall within Member State competence.

The AG’s functional approach thus succeeds in identifying a practical difficulty faced by the applicant, but it never convincingly explains why a birth certificate whose original entries are acknowledged to be accurate must nevertheless be altered in order to comply with EU law.

V. EU citizenship and national autonomy in matters of civil status

The preceding discussion ultimately points towards a broader constitutional issue. If Article 21 TFEU (which sets out EU citizens’ rights to move and reside freely in the EU) can require the amendment of civil-status records in the absence of any foreign status requiring recognition, what remains of Member State autonomy in matters of civil status?

The Court has consistently recognised that matters such as civil status, family status, names and personal identity fall, in principle, within the competence of the Member States (e.g., Runevič-Vardyn). At the same time, however, it has repeatedly held that those competences must be exercised consistently with EU law whenever the exercise of free movement rights is affected. The tension between these two propositions lies at the heart of Shipov.

Here, the Court expressly acknowledges that the issuing of identity documents falls within the competence of the Member State of nationality (para 47), yet it immediately adds that such documents serve to enable the exercise of the rights conferred by Article 21 TFEU. Once that connection is established, national rules governing civil-status registration become subject to review in light of both free movement and the fundamental rights guaranteed by the Charter, such as Article 7 (respect for private and family life).

This dynamic is further illustrated by the ECJ’s treatment of the Bulgarian Constitutional Court’s reasoning. The latter had previously interpreted the concept of sex contained in the Bulgarian Constitution as referring exclusively to biological sex and justified its interpretative decision in light of broader moral and religious rules and principles “prevailing over the interests of transgender persons” (paras 21 and 46). The ECJ rejected those arguments as potential justifications for the restriction of free movement and ultimately reaffirmed that neither the Member State’s competence in matters of civil status nor moral and religious considerations could justify the obstacles encountered by the applicant (paras 47-48). This logic culminates in paragraph 60 of the judgment, where the ECJ reiterates that rules of national law, even of constitutional rank, cannot undermine the effectiveness of EU law.

From the perspective of EU law, this result is hardly surprising. The principle of primacy would be significantly weakened if Member States could rely upon domestic constitutional concepts to avoid obligations flowing from Union law. Nevertheless, Shipov illustrates how the progressive expansion of Article 21 TFEU may affect the practical scope of Member State autonomy in areas that formally remain within national competence. This point is particularly significant when considered alongside the preceding sections.

To raise this concern is not to suggest that constitutional autonomy should operate as a shield against Union law. Nor is it to deny the legitimacy of protecting Union citizens against discrimination and/or unjustified obstacles to free movement. However, the broader the concept of an obstacle to free movement becomes, the greater the potential reach of EU law into areas that the Treaties continue formally to reserve to the Member States.

In this respect, Shipov may ultimately prove significant not only for legal gender recognition, but also for the constitutional development of Union citizenship itself. The judgment suggests that once a matter can be connected, even indirectly, to the exercise of free movement rights, the scope for maintaining distinct national approaches becomes increasingly narrow. Whether that development represents a natural consequence of Union citizenship or a more profound transformation of the relationship between EU law and national competences remains open to debate.

VI. Conclusion

Shipov is likely to be remembered as an important step in the Court’s case law on the rights of transgender Union citizens, yet its significance extends beyond the specific context of legal gender recognition.

The judgment suffers from a degree of conceptual ambiguity that is difficult to ignore. Throughout its reasoning, the Court moves between references to sex, gender and gender identity without clearly identifying the precise legal category that Member States are required to recognise or modify. This uncertainty is compounded by the Court’s equal treatment of intersex and transgender situations, whose comparability is largely assumed rather than demonstrated.

More fundamentally, Shipov marks an important step beyond the logic that characterised previous case law. Unlike earlier cases, no foreign legal status required recognition here. In this instance, article 21 TFEU was used not to ensure the continuity of a legal situation already established elsewhere in the Union, but to generate a positive obligation affecting the organisation of national civil-status law in circumstances where the transnational element appeared particularly weak. The AG’s attempt to justify that result through the functional role of identity documents is ultimately unpersuasive, not least because it fails to explain why birth certificates whose original entries are acknowledged to be accurate must nevertheless be amended in order to facilitate free movement.

Ultimately, the most significant issue raised by Shipov may not concern legal gender recognition at all, but the limits of Article 21 TFEU itself. Once the latter is capable of generating substantive obligations in areas formally falling within Member State competence, the distinction between the recognition of legal status and its creation becomes increasingly difficult to maintain. Whether the Court has provided a sufficiently clear and principled justification for that evolution remains an open question.

The End of Immunity for Internet Service Providers? C-188/24 WebGroup Czech Republic and NKL Associates and C-190/24 Coyote System, judgment 16 June 2026

 

Lorna Woods, Professor Emerita, University of Essex

Photo credit: TodayTesting.com, via Wikimedia Commons   

This recent CJEU judgment has been flagged in some quarters as upholding the French rules requiring age verification for porn sites. In others, it has been seen as stripping intermediary immunity from social media sites. Based on the e-Commerce Directive, however, is this just a transient discussion, fading away as the Digital Services Act (DSA) becomes the relevant law?

 

The Facts

 

The national cases in Case C-188/24 concern French rules requiring porn operators to implement technical age verification mechanisms to prevent minors from accessing those sites.  The companies were each the subject of a formal notice pursuant to Decree No 2021/1306 implementing Law No 2020-936 and Article 227-24 of the Criminal Code which prohibits any person from broadcasting a pornographic message likely to be seen by a minor. The rules in Coyote System concern the restriction on the broadcasting of information to drivers about roadside checks (eg in relation to speed or drunk driving). The relevant implementing measures were also derived from the French criminal code. These measures were subject to judicial challenge before the French Conseil d’État. The companies in question were not established in France and questioned the applicability of the French rules.

 

The Issues

 

The first question the CJEU had to address was whether the measures fell within the coordinated field of the  e-Commerce Directive (Directive 2000/31) and would therefore be caught by Article 3, which provides for the country of origin principle (COOP). Recital 22 which states that ‘information society services should be supervised at the source of the activity’. This means that services in general comply with the domestic law of the State in which they are established and do not have to comply with the laws of the States in which their services are capable of being accessed.  Article 3(3) excludes certain areas from the coordinated field and Article 3(4) et seq provide for limited grounds of derogation from the COOP and provide conditions with which the receiving State must comply to access the derogation.   The COOP applies only to laws falling within the coordinated field. Here the relevant laws were not sector specific measures targeting information society services in particular, but the general criminal law. The referring court questioned whether the provisions in issue fell within the coordinated field and referred the issue to the CJEU.

 

The ban on transmission in Coyote System was, according to the applicant, contravening the prohibition on general monitoring found in Article 15 e-Commerce Directive. This application of this article is dependent on the information society services in question falling within one of the categories of service found in Articles 12-14 e-Commerce Directive (mere conduit, caching services or hosting services respectively). The Court thus then had to consider whether the service in Coyote System was a hosting service within the meaning of Article 14 e-Commerce Directive. Article 14(1) provides:

 

Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:

 

(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or

(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.

 

Judgment

 

The Coordinated Field

 

The Court emphasised that the coordinated field

 

covers all requirements laid down by the legal systems of the Member States relating to the taking up or pursuit of the activity of an information society service, … that definition does not make the coordinated field subject to the condition that only matters harmonised by that directive are covered. [para 52]

 

Following the Advocate General (at para 56 of his Opinion), it remarked that Article 3 is of particular importance precisely for the areas of law not harmonised. The mere fact that the laws apply generally cannot remove them from the coordinated field. Moreover, the Directive excludes certain areas from the scope of the Directive, so the question of exclusion had been taken into account in the Directive. Taking a different approach would undermine the purpose of the Directive.

 

The Court confirmed that requiring age verification sets the conditions for access to the information society services and is a requirement concerning the pursuit of an activity within Article 2(h)(i) (see Case C-649/18 A (Advertising and sale of medicinal products online)). For the roadside broadcasts, the Court took the view that the prohibition constituted a requirement relating to the content of the service. Both sets of measures therefore fall within the coordinated field.

 

The COOP and Derogation

 

The key question for the application of the COOP was whether the measures restricted the free movement of the services. This question the Court answered in the affirmative before considering whether the derogation in Article 3(4) could be used.

 

The derogation has substantive and procedural conditions. Substantively, the measure must be necessary in the interests of one of more of: public policy; protection of public health; public security; or protection of consumers. Further, those measures should be taken against an information society service which actually prejudices those objectives or presents a serious and grave risk to those objectives. Finally, the measures must be proportionate to the objectives. In procedural terms, the recipient Member State must first have issued an unsuccessful request to the host Member State to fix the issue and, secondly, notified the Commission.  A failure to comply renders the obligations unenforceable (Case C-390/18 Airbnb Ireland – following long established case law).

 

General rules applying without distinction do not satisfy the second of the substantive conditions. The rules, however, provided for the issuing of individual notices which satisfy this requirement [para 90]. The third substantive element – that of proportionality – was satisfied in relation to the protection of human dignity and the rights of the child as regards the broadcasting of pornography [para 94] and, without much elaboration, the prohibition on rebroadcasting is also proportionate [para 96]. 

 

So in principle, the national rules could meet the substantive criteria but it was for the referring court to determine whether the procedural rules were satisfied.

 

General Monitoring

 

Hosting

 

As noted above, the possibility of relying on Article 15 depends on whether the service in issue – here the service in Coyote System - is a host within the scope of Article 14 [see para 105]. The Court noted that the definition of hosting did not automatically preclude a service which also has elements of broadcasting from being a host, referring to long-standing caselaw as well as more recent (Case C-360/10 SABAM; Case C-682/18 YouTube and Cyanado and Case C-401/19 Poland v Parliament and Council). Conversely, just because a service includes the storage of information does it mean that the service is a host for the purposes of Article 14. The Court reiterated the limitations arising from Recital 42 – that the services should be of a mere technical, automatic and passive nature. This implies, according to the Court’s case law (Case C-324/09 L’Oréal and Case C-682/18 YouTube and Cyanado), “the information society service provider has neither knowledge of nor control over the information which is transmitted or stored” [para 108].  The Court underlined that “those two conditions requiring knowledge and control should be understood as being alternative to and independent of each other” [para 110].  The Court then held that

 

if, beyond the mere categorisation and indexation of information for the purpose of improving its accessibility, the algorithm used determines, in the interest of the operator or its service, under what conditions, how and in which order of priority that information is or is not be broadcast, that operator exercises control over that information, with the result that the service it offers cannot be classified as an ‘information society service … that consists of the storage of information provided by a recipient of the service’ [para 112].

 

Impact on Article 14(3) and Article 15

 

If a service exercises control over content, it does not fall within Article 14 and therefore the restrictions imposed on Member States by Article 15 are not applicable to such are service. The questions were for the national court to determine.

 

On the assumption that the service were found to be neutral, the national court must decide whether the prohibition on rebroadcasting the information on roadside checks is permitted by Article 14(3) which concerns orders requiring a neutral host to terminate any infringement on the part of the recipient of the service due to, inter alia, the presence of illegal information stored on its website or on its platform by removing or blocking access to that information.

 

Considering Article 15, the Court referred to Recital 47 e-Commerce Directive, which clarifies that Article 15 does not apply to monitoring in specific cases. Referring to the test laid down in Glawischnig-Piesczek (Case C-18/18), paras 46 and 47, the Court noted in this case that the information targeted by the prohibitions “is circumscribed in such a way that its rebroadcasting may be automatically prevented by the operator concerned” [para 121].

 

 

Comment

 

Coordinated Field and COOP

 

The Court has taken a typical approach here, a broad approach to the areas covered: criminal law rules and public policy rules can fall within the scope of the directive, provided they impose requirements on the access or conduct of an information society service. Furthermore, none of the criminal law in general, public policy and public security measures appear on any of the exclusions from the scope of the directive. The Court’s ruling makes explicit that this absence from the exclusions is deliberate. This position is in the interests of ensuring that a service is not subject to multiple regulation, but it can lead to unevenness and gaps in protection from the viewpoint of a person expecting the rules of the member state in which they reside to apply to services providers providing services in that self-same Member State. This is especially the case when the aspect potentially taking the national rule outside the derogation regime is about its form, not its substance.  The COOP principle has long given rise to concerns about forum shopping and a race to the bottom (as can be seen also in the broadcasting sector and the Audiovisual Media Services Directive) but has been re-affirmed as a central tenet of the EU regime (see eg Case C-769/22 Commission v Hungary (Values of the European Union)). 

 

It is also worth noting that the Court in principle accepted that both sets of rules in the cases referred were aimed at achieving legitimate aims and were proportionate. The Court drew on the fact that the AVMSD requires age verification in relation to pornography to reach this latter assessment. In so doing, the Court engaged in a joining up the dots activity between different piece of EU digital legislation. 

 

In this ruling, the Court underlined both the importance of the right to human dignity and the rights of the child.

 

Impact on Article 14

 

The headline news from this ruling is the impact on Article 14 and the test for neutral intermediary. The hosting safe harbour in Article 14 was always meant for neutral, passive intermediaries – entities whose activity is “purely technical, automatic and passive”, implying that the provider “has no knowledge of or control over” the information stored (Recital 42 e-Commerce Directive). This has been the standard position since the early case law – for example L’Oreal.  What this means, and in particular the impact of automated tools, has been the subject of some discussion. In a different context (copyright infringement), the Court even if an operator automatically indexes infringing content to recommended videos based on each users’ use did not necessarily mean that the host had specific knowledge of the infringing content, and the Court determined that this sort of specific knowledge was what was required. This could be seen as quite a generous view towards the hosting services and the scope of immunity. It might almost be said that there was an assumption that platforms would benefit from Article 14 (provided they responded to notices). In Coyote there is a shift of focus.

 

The first point to note is the Court’s statement that hosting services do not automatically benefit from Article 14. While this is not new – and, indeed, can be seen the Court’s previous jurisprudence – the reminder feels significant, especially in the light of the rest of the ruling. The Court here confirmed that a service has to satisfy both the knowledge and the control tests, a point not laboured in previous judgments. The Court (at para 110) makes this really clear: if a service exercises control, even if it has no knowledge, it will fall outside the intermediary immunity provision.

 

Whereas Cyanado dealt with knowledge, System Coyote looks at control. Significantly, the Court held that algorithmic curation constitutes “control”.  The Court (following its Advocate General) held (para 111):

 

it is, inter alia, by means of the algorithm used that such an operator exercises control over the information stored. So long as it has predetermined, by means of that algorithm, the conditions under which such information may or may not be broadcast, it is irrelevant that that operator does not itself carry out additional interventions which have the effect of promoting, modifying or deleting information stored with a view to it being broadcast.

 

In other words, when a service which stores information uses an algorithm to determine – in its own interest or that of its service – under what conditions, in what manner, and in what order of priority information is or is not disseminated it has control (see para 112). It does not matter that this is automatic. So creating the algorithmic system is exercising control.  In focussing on control, the Court avoids outright conflict with its earlier position (for example in Cyanado), but it certainly signals a change in emphasis and (in line with thinking underpinning parts of the DSA) a recognition that the algorithm is not necessarily neutral.

 

Not all categorisation or prioritising satisfies the control test. Simple categorisation and indexing of information to improve its accessibility do not on their own constitute control. Essentially, the Court is trying to draw the line between a neutral index, or chronological feed, and something more editorial (and it is telling to remember that the services themselves have claimed first amendment rights – is relating to their speech – in relation to how results are provided). 

 

Nonetheless, this ruling will affect a wide range of services based on curating user generated content, from social networks, video-sharing services and – of course – services that rebroadcast user reports (eg about police checks), as well as recommended products on a marketplace. The judgment could be read as stripping most (if not all) of the large social media platforms of their immunity (though this does not mean they will automatically be liable in all cases – that will depend on national law and the facts in individual cases). It could also be said to follow a similar path to the Russmedia decision (Case C-492/23), discussed here, which also took a narrow view of immunity (hosting defence does not apply to liability under the GDPR).

 

Impact on Article 15

 

The prohibition on general monitoring only relates to those services covered by intermediary immunity. Although this follows the language of Article 15(1) there had been some dispute as to who could claim the protection of Article 15. The answer is now clear: fall outside Article 14 (or 12 or 13) and Article 15 does not apply. 

 

The Court also reiterates its position on the distinction between general and specific monitoring and highlighting the possibility of using automated techniques to identify particular types of content. This could be relevant for Member States’ ability to impose monitoring or filtering obligations (in services of some public interest) – these (in relation to copyright infringements, e.g. SABAM, above) had been thought problematic in the relatively early days of the e-Commerce Directive, and platforms have often challenged such obligations as constituting general monitoring. The Court’s discussion here is focussed tightly on content; it does not discuss behavioural monitoring or profiling (which might be techniques by services to reduce the incidence of illegal content or behaviour across their services). It will be interesting to see how this line of case law joins up with the jurisprudence under the e-Privacy directive on collection of metadata and intrusions into communications privacy (see eg Case C-746/18 Prokurator).

 

Impact on DSA

 

Article 6 DSA, which replaces Article 14 e-Commerce Directive, provides that hosting providers are not liable for information stored at the request of a recipient of the service, provided that they do not have actual knowledge of illegal activity or content, unless the recipient acts under the authority  “or control” of the provider. It has been assumed given the similarity in the text, that the case law on Article 14 is relevant for understanding Article 6 DSA, including as regards the threshold condition of neutral. The wording of the relevant recitals in the DSA differ, however, from the text in the e-Commerce Directive (noted above) – and the Court has relied heavily on that text in its interpretation of Article 14.  Indeed, Article 14 itself does not refer to control. Recital 22 DSA specifies:

[i]n order to benefit from the exemption from liability for hosting services, the provider should, upon obtaining actual knowledge or awareness of illegal activities or illegal content, act expeditiously to remove or to disable access to that content. … The provider can obtain such actual knowledge or awareness of the illegal nature of the content, inter alia, through its own-initiative investigations or through notices submitted to it by individuals or entities in accordance with this Regulation in so far as such notices are sufficiently substantiated to allow a diligent economic operator to reasonably identify, assess and, where appropriate, act against the illegal content. However, such actual knowledge or awareness cannot be considered to be obtained solely on the ground that the provider is aware, in a general sense, of the fact that its service is also used to store illegal content. Furthermore, the fact that the provider automatically indexes information uploaded to its service, that it has a search function or that it recommends information on the basis of profiles or preferences of the recipients of the service is not a sufficient ground for considering that provider to have ‘specific’ knowledge of illegal activities carried out on that platform or of illegal content stored on it. [emphasis added]

 

At first glance, the recital seems to contradict the ruling in Coyote System. The wording of the recital seems to follow the approach the Court adopted in Cyanado and like that judgment deals with the question of knowledge. We have noted earlier, the Court’s sidestep in this case, to talk about control. The recital says nothing about control and is therefore not inconsistent with the approach in Coyote System.  Of course, this means that there is no reference to “control” in the text of the DSA because Article 6, like its predecessor Article 14, is silent on the point. It is far from clear, however, that the change in wording in the recital was intended to mark a change in meaning from Article 14 resulting in an expansion of the scope of immunity. Rather it seems an intention to align the DSA with the case law on Article 14 e-Commerce Directive. Presumably, there will be much litigation on this point as well as the linked question as to where the boundary between control and “mere categorisation and indexation of information” [para 112].

EU values, LGBTQI+ rights and the future of democracy in Hungary and beyond: On the wider significance of case C-769/22

 

Benedetta Lobina* and Esther Martínez**

* re:constitution fellow and lecturer at the UCD Sutherland School of Law

** Co-founder and director of RECLAIM, a human rights NGO that campaigned for Member States to join in the proceedings in this case against Hungary

Photo credit: Budapest Pride march 2025, photo by bannedpride via Wikimedia Commons

 

In what has been a momentous 10 days for Hungary, after the elections that ousted Orban as Prime Minister after 16 years, the Court of Justice of the European Union delivered its much-anticipated judgment in the Hungarian “anti-LGBT propaganda” case. This case is remarkable for a number of reasons: for the first time, the Court found a breach of Article 2 TEU as a stand-alone plea in law; it expanded upon the protection of LGBTQI+ rights under the scope of EU law; and it saw an unprecedented number of interventions in support of the Commission, namely from the European Parliament and 16 Member States. Additionally, the timing of the Court’s delivery makes this the first opportunity for the new Magyar government to turn a new leaf for the country, after pledging its commitment to Europe during the course of the electoral campaign. In this blogpost, we will break down the wider significance of this judgment, beyond the undoubtedly groundbreaking use of Article 2 (and related doctrinal debates), especially with regards to the implementation of LGBTQI+-related CJEU judgments in Hungary and in the rest of the EU, and as pertains to what it signals for future litigation efforts.

Background of the case

The case was triggered by Orban’s far-reaching reforms seeking to restrict access to LGBTQI+ content (see here for an accessible breakdown). According to the arguments presented by the Commission (which the Court found well-founded in their entirety), the laws infringed a wide range of EU instruments related to the provision of services and the internal market, several rights protected by the Charter (Articles 1, 7, 11, 21), and lastly but most crucially, Article 2 TEU. This was the first use of Article 2 TEU on its own merits, underscoring the gravity of the departure from EU values witnessed in Hungary.

In its ruling, the CJEU sitting as a full court agreed with the Commission on all the pleas in law, specifically finding for the first time an infringement of Article 2 TEU, based on the nature of the legislative provisions at issue as a coordinated series of discriminatory measures, amounting to a manifest and particularly serious curtailment of LGBTQI+ rights. Consequently, it found that the Hungarian law is “contrary to the very identity of the Union as a common legal order in a society in which pluralism prevails” (counterarguments based on national identity notwithstanding).

This approach seems to crystallise a test whereby the sheer scale and seriousness of violations of relevant EU law – for instance several rights of the Charter embodying Article 2 TEU values – is enough to demonstrate a departure from shared values and therefore lead to a breach of Article 2 as a whole (para 548). Moreover, in order to remain within the limits and scope of EU law, the CJEU underlined “only manifest and particularly serious breaches of one or more values common to the Member States may give rise to a finding [of Article 2 violations, which are] incompatible with the very identity of the Union as a common legal order of a society in which pluralism prevails.” This reasoning would suggest that systemic stigmatisation of the LGBTQI+ community in and of itself (i.e. without any link to other provisions of the acquis) would give rise to an Article 2 breach – although in practice, the offending behaviour at issue is more than likely to also infringe upon several directives or regulations (as it did in this case), which may or may not raise questions over the logical soundness of the Court’s argument (see here and here). As such, this judgment sets the stage for stronger and more systemic infringement proceedings in the future, which can use multiple severe violations to prove a pattern that ultimately triggers an Article 2 violation.  

What happens next?

Such an emphatic decision is bound to have consequences beyond the black letter of the law, both in Hungary – especially after a dramatic shift in its political landscape – and in the rest of the Union. After winning a super majority in Parliament on a pro-EU platform, newly elected Prime Minister Peter Magyar will have his first chance to prove his commitment to EU values and the EU legal order by swiftly implementing this judgment. After being sworn in (presumably in the next month), repealing the offending legislation should be high up on his priority list.  Considering that the legislation at issue was blatantly lifted from Putin’s autocratic playbook, there would be a great amount of symbolic significance in using this as one of the first olive branches extended to Hungary’s European partners.

Whether this is likely to happen, however, remains up to question. Magyar was conspicuously silent on LGBTQI+ rights during the campaign and did not mention the issue in his victory speech, beyond pledging to rule for all Hungarians. When directly asked, he remained vague by simply emphasising that the general right to freedom of assembly should be enjoyed by everyone. At the same time, there are significant incentives for compliance which inspire hope for a change of course in Hungary on this front (including not only the somewhat distant threat of financial penalties for non-implementation, but also horizontal enabling conditions that tie LGBTQI+ rights restoration to €700M worth of frozen EU cohesion funds). Nonetheless, the offending legislation is just the tip of the iceberg when it comes to the state of LGBTQI+ rights in the country.

In the present judgment, the Court was particularly vocal, in its finding of several violations of the Charter, in stressing that laws of this kind reinforce stigmatisation of sexual identity and orientation in the public sphere, leading to hateful behaviour and fostering social “invisibility” for the marginalised communities targeted, contrary to the value of human dignity. Additionally, it also reaffirmed, in light of its previous jurisprudence, that MS have “a positive obligation to ensure respect for everyone’s right to develop a sexual identity” (at 447). Conversely, and in line with the aforementioned reasoning as to what constitutes a freestanding breach of Article 2 TEU, the Court ruled that the Hungarian law violates said Article because it seriously and manifestly breaches LGBTQI+ rights, such as respect for human dignity, equality and respect for human rights, including the rights of persons belonging to minorities (at 556).

This is of huge importance, as it can serve as the basis to consider the broader body of anti-LGBTQI+ laws as contrary to EU law. Indeed, it is crucial to note that the case at hand is not comprehensive of all the restrictions imposed by the Orbán government on LGBTQI+ rights, and that efforts must therefore not be limited to repealing the legislation at issue. For instance, in 2018, the Fidesz government banned gender studies from state-accredited university programmes; in 2020 it banned legal gender recognition and adoptions for rainbow families. These measures, by the logic of the CJEU, fit within the pattern of persistent stigmatisation of non-cisgender and non-heterosexual persons, as well as breaching the principle of non-regression by lowering the protection of LGBTQI+ rights over time. Therefore, in order to truly comply with the spirit of the judgment, the new government should go further and repeal these discriminatory pieces of legislation as well.

Secondly, there is a long and growing list of landmark CJEU rulings that do not necessarily originate from Hungary, but are nonetheless not complied with by national authorities here, including judgments on freedom of movement and family life (Coman, V.M.A.; Cupriak-Trojan; Rzecznik Praw Obywatelskich), on legal recognition of transgender identity (Mirin; Deldits; Shipov), and on protection of human dignity for LGBTIQ+ people (Makeleio and Zougla). Without respect for these precedents, even after the repeal of the legislation at issue, the situation of LGBTQI+ people in Hungary would remain acutely precarious.

Thus, the Commission and Member States must insist on full implementation of all outstanding jurisprudence, in line with the principle of sincere cooperation, free movement, and the internal market. Generally speaking, the aforementioned line of jurisprudence – which remains mostly unimplemented also in the respective countries of origin – highlights that more is to be done to preserve not only equality, but also a harmonious legal order where all EU citizens can enjoy their EU-derived rights. This new judgment’s emphasis on human dignity sets a strong precedent, and should spur better monitoring and enforcement efforts across the Union.

Lastly, beyond Hungary, there are several member states that have emulated Orban’s so-called “LGBT propaganda” laws. Similar measures to the ones found foul of EU law in this judgment are in force in Bulgaria and Slovakia, and are currently being discussed in other MS, such as Portugal and Lithuania. This judgment should shift scrutiny in their direction, to make sure Hungary is not simply replaced by an exponentially larger number of Member States freely pursuing the same (unlawful) anti-LGBTQI+ agenda.

What to learn from this: a new standard we should be proud of and build on

This case marks a significant breakthrough in how the EU approaches violations of its founding values, and one that should serve as a template for future litigation. Firstly, this is a massive improvement from the initial line taken by the Commission at the dawn of backsliding in Hungary, moving closer to the idea of systemic infringement proceedings that clearly show a pattern of departure from the commitments at the very basis of the integration process. As argued by AG Capeta, it is important to frame these sort of violations, especially those that affect a marginalised group, as a violation of a value like human dignity, which “constitutes the actual Grundnorm (basic norm) of post-World War Two European constitutionalism against the horrors of totalitarianism which denied any value of the human person.”

Equally significant is the unprecedented show of solidarity from Member States and the European Parliament. A total of 16 MS intervened before the Court, together with the EU’s democratic body par excellence, which further underlines the widespread commitment to shared values and adds a layer of democratic legitimacy and accountability to the legal process. This is an effective way to bolster the Commission’s case, while also diffusing (bad faith) arguments as to EU priorities being dictated by a detached technocratic “Brussels elite”, instead proving that values matter to the vast majority of the Union

The combination of a strong response from the Member States, the EP and the CJEU should thus inspire confidence in the Commission to bring similarly framed cases on these salient issues in the future, especially in the face of the aforementioned Member States currently enforcing anti-LGBT propaganda laws. Taking Slovakia for example, it is clear that the regression of LGBTQI+ rights operated under Fico since 2023 can satisfy the test for manifest and serious curtailment of rights amounting to an Article 2 TEU infringement – as the reforms have included halting funding for comprehensive sex-ed initiatives, removing guidelines banning forced sterilisation for transgender persons, mandating parental consent for any teaching on sexuality, denying same-sex couples from legal recognition as parents, and entirely banning legal gender recognition for non-cisgender individuals. In this sense, the judgment at hand is timely and its impact should be felt beyond Budapest, at least by giving the Commission leverage to pursue cases against any government operating such deliberate curtailment of values.

As for Hungary, the first test will be whether the Magyar government will be willing to repeal the legislation which bans the Budapest Pride. This is a very time-sensitive issue, since unless the law is off the books by May 28^th, the organisers will not be able to obtain the necessary permits within the required 1-month window.

Ultimately, this judgment is to be welcomed as a seminal piece of EU jurisprudence, and one that expands both the justiciability of EU values, and the protection of LGBTQI+ rights. Moreover, it should be seen as the future of values-related litigation, promoting wider accountability and clearly demarking the Union’s commitment to democratic values in the face of aspiring autocrats. At a time in which fundamental values and specifically minority rights are under attack globally, this is a powerful signal. However, it is paramount that the momentum remains strong, lest yet another powerful values-related decision remains merely a paper tiger.