[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ3KtvbX9PS6H7UgFGIvR0UuvEknLs0kDCGLQAJNl-BI":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"83204cf9-9b40-4126-9e2c-b9af68412d73","AN - SAN 2996\u002F2026","an-san-2996-2026-3e1612","← Older revision Revision as of 11:50, 4 August 2026 Line 14: Line 14: |Original_Source_Name_1=Cendoj |Original_Source_Name_1=Cendoj |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FindexAN.jsp |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002F92b1be87d8823209a0a8778d75e36f0d\u002F20260728 |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language__Code_1=ES |Original_Source_Language__Code_1=ES","A Spanish court has overturned a €2 million fine imposed on Amazon Road Transport Spain by the Spanish Data Protection Agency (AEPD). The fine was for processing criminal record certificates for Amazon Flex delivery drivers, which the AEPD deemed a violation of GDPR and LOPDGDD. The court ruled that a certificate confirming no criminal record does not constitute data relating to criminal convictions under Article 10 GDPR, thus annulling the penalty.","Spanish court annuls €2M fine against Amazon for processing criminal record certificates.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AN_-_SAN_2996\u002F2026&diff=52600&oldid=52593","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-08-04T11:50:30+00:00","2026-08-04T12:00:11.628671+00:00",7,[17,20],{"name":18,"type":19},"Amazon","vendor",{"name":21,"type":22},"Amazon Flex","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":63},"spanish-court-overturns-2m-gdpr-fine-on-amazon-over-criminal-record-checks","Spanish Court Overturns €2M GDPR Fine on Amazon Over Criminal Record Checks","Amazon Road Transport Spain was fined €2 million by the AEPD for requiring delivery drivers to submit criminal record certificates, which regulators initially deemed a violation of GDPR Article 10 and Spain's LOPDGDD regarding special category data on criminal convictions. A Spanish court subsequently annulled the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute data relating to criminal convictions or offences under Article 10 GDPR. This case highlights the critical importance of obtaining precise legal interpretations before implementing HR or onboarding data processing practices, as ambiguity in regulatory definitions can expose organizations to significant financial and reputational risk. It also demonstrates that regulators and courts may interpret the same provision differently, making proactive legal due diligence essential. Organizations must not rely solely on internal assumptions about what constitutes 'special category' data.",[54,55,56,57,58,59,60,61,62],"GDPR Article 10 (Processing of criminal convictions data)","GDPR Article 5(2) (Accountability principle)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 6 (Lawfulness of processing)","Spain LOPDGDD (Ley Orgánica 3\u002F2018)","NIST Privacy Framework PR.PO-P1 (Policies, processes, and procedures for privacy)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 Section 6.2 (Conditions for processing PII)","ITIL Service Transition – Change Management (governance of new processing practices)",{}]