AN - SAN 2996/2026
Spanish court annuls €2M fine against Amazon for processing criminal record certificates.
A Spanish court has overturned a €2 million fine imposed on Amazon Road Transport Spain by the Spanish Data Protection Agency (AEPD). The fine was for processing criminal record certificates for Amazon Flex delivery drivers, which the AEPD deemed a violation of GDPR and LOPDGDD. The court ruled that a certificate confirming no criminal record does not constitute data relating to criminal convictions under Article 10 GDPR, thus annulling the penalty.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Amazon?
Get an email when a new story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAmazon Road Transport Spain was fined €2 million by the AEPD for requiring delivery drivers to submit criminal record certificates, which regulators initially deemed a violation of GDPR Article 10 and Spain's LOPDGDD regarding special category data on criminal convictions. A Spanish court subsequently annulled the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute data relating to criminal convictions or offences under Article 10 GDPR. This case highlights the critical importance of obtaining precise legal interpretations before implementing HR or onboarding data processing practices, as ambiguity in regulatory definitions can expose organizations to significant financial and reputational risk. It also demonstrates that regulators and courts may interpret the same provision differently, making proactive legal due diligence essential. Organizations must not rely solely on internal assumptions about what constitutes 'special category' data.