The sites hold a publishing certificate (utgivningsbevis), which gives them the same constitutional protection as a newspaper. That is why they have claimed the GDPR does not apply to what they publish.

On 9 July 2026 the Court of Justice of the EU ruled (case C‑199/24) that putting court judgments online for payment is not in itself journalism, and that a publishing certificate is not enough to escape the GDPR. The case concerned Lexbase. Whether the same applies to sites that show addresses and phone numbers has not been tested yet.

Since June 2025, the Swedish data protection authority (IMY) has been reviewing whether MrKoll and Upplysning delete data when people ask, and is not investigating individual complaints in the meantime. The government is not moving ahead with changing the constitution for now and wants to look into regulating the sites through ordinary law instead. Until then, you remove yourself, site by site.

Your details remain with the Swedish Tax Agency and anyone can request them, but the agency does not publish them online.

Sources: IMY's review, IMY on complaints, Riksdag report 2025/26:KU26, CJEU case C‑199/24.