Processing personal data relating to criminal convictions and offences is one of the areas in which the GDPR provides for a specific processing regime. Article 10 of the GDPR sets out specific conditions for the processing of such data, which in practice raises questions concerning the scope of this provision. In particular, the question arises as to whether this regime also applies where the data being processed does not indicate that an individual has been convicted, but rather confirms that no such conviction exists.

In this context, Audiencia Nacional, i.e. Spain’s National High Court, annulled the decision of the Spanish data protection supervisory authority (AEPD) imposing a €2 million administrative fine on Amazon Road Transport Spain S.L. for the processing of data contained in criminal record certificates. The Court held that such a certificate does not constitute personal data relating to criminal convictions and offences within the meaning of the GDPR.

The GDPR provides for a specific regime governing the processing of personal data relating to criminal convictions and offences, as well as related security measures. The processing of such data requires more than merely having an appropriate lawful basis for the processing of personal data; it may only be carried out under the control of official authority or where authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.

It was precisely the application of this provision that was at issue in the proceedings preceding the Court’s decision. Candidates seeking to work within the Amazon Flex programme were required to provide a certificate confirming that they had no criminal convictions. Amazon justified this requirement by reference to the nature of the work, given that delivery drivers had access to customers’ private addresses, contact details and other information, as well as packages that could be of significant value.

The AEPD took the view that such a certificate also constitutes data relating to criminal convictions and offences within the meaning of the GDPR. According to the AEPD, the fact that the certificate confirms that an individual has no criminal convictions was not sufficient to exclude such processing from the specific regime established by the GDPR. The AEPD therefore considered that the candidate’s consent, in itself, could not constitute a sufficient lawful basis for processing in the absence of specific authorisation under Union or Member State law.

The Court, however, took a different view.

Restrictive Interpretation of Article 10 of the GDPR

 Proceeding from the need for a restrictive interpretation of the provision, particularly in proceedings that may result in the imposition of an administrative fine, the Court distinguished between the processing of data relating to criminal convictions and offences and the processing of a certificate confirming that an individual has no criminal convictions.

A criminal record certificate does not contain information concerning the existence of a specific criminal conviction or the commission of a criminal offence; rather, it confirms their absence. Its content therefore serves to confirm that no such conviction exists. Accordingly, the Court concluded that such information cannot be brought within the specific regime applicable to data relating to criminal convictions and offences.

This interpretation was decisive for the outcome of the proceedings. Since the subject matter of the processing was not data concerning an existing criminal conviction or offence, there were no grounds for applying the specific requirements applicable to that category of data.

The Court also distinguished between a request for a candidate to provide a criminal record certificate and situations in which criminal record data are accessed directly or information concerning existing convictions is processed. It further pointed out that any unlawfulness or misuse of such a request under employment law does not necessarily amount to a GDPR infringement that may be subject to sanctions.

Lawfulness of the Specific Processing

The fact that a criminal record certificate does not fall within the specific regime does not, in itself, mean that its processing is lawful. The processing must still have an appropriate lawful basis for processing, and the general principles governing the processing of personal data under the GDPR must also be complied with.

In the specific case, the Court found that the request for the certificate was justified by the purpose of protecting customers and ensuring the security of the Amazon Flex programme, having regard to the nature of the activities carried out by the delivery drivers, as well as the extent of their access to customers’ information and property

Based on these circumstances, the Court concluded that the processing was lawful and that there were no grounds for imposing a sanction. The significance of the decision, however, lies not in the Court having declared the requirement to provide a criminal record certificate permissible as such, but rather in the fact that it assessed the justification for that requirement in light of the specific purpose and circumstances of the processing.

Criminal Record Certificates: Outside the Specific Regime, but Still Subject to GDPR Requirements

The significance of the Court’s decision lies not so much in confirming Amazon’s right to require a criminal record certificate, but rather in clarifying what constitutes personal data relating to criminal convictions and offences.

The Court distinguished between data concerning the existence of a criminal conviction and data confirming that no such conviction exists. In doing so, it drew a line between the specific data protection regime applicable to data relating to criminal convictions and offences and the general rules governing other types of personal data.

However, the question remains as to the extent to which this conclusion can be applied beyond the circumstances of the specific case. The mere fact that a criminal record certificate contains information confirming the absence of a criminal conviction does not mean that every request for such a certificate will be justified. It remains necessary to determine the purpose of the processing, the appropriate lawful basis for processing, and the relationship between the data requested and the objective pursued.

The decision therefore represents a clarification of the scope of application of Article 10 of the GDPR, but not a general rule that the collection of information concerning the absence of criminal convictions is permissible. It remains to be seen whether this approach will be accepted in other situations where individuals are required to provide proof of the absence of criminal convictions, particularly where the same security considerations that were present in the Amazon case do not apply.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.