AN - SAN 2996/2026
Spanish court annuls €2M fine against Amazon for GDPR violation related to criminal record certificates.
A Spanish court has overturned a €2 million fine imposed on Amazon Road Transport Spain by the Spanish Data Protection Agency (AEPD). The fine was for processing criminal record certificates for Amazon Flex drivers, which the AEPD deemed a violation of GDPR Article 10. The court ruled that a certificate showing no criminal record does not constitute data relating to criminal convictions and thus does not fall under the strict interpretation of Article 10 GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Amazon?
Get an email when a new story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Spanish Data Protection Agency fined Amazon €2 million for processing criminal record certificates of Flex drivers, citing GDPR Article 10, which restricts handling of data related to criminal convictions. A Spanish court overturned the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute criminal conviction data under a strict reading of Article 10. This case highlights the complexity and ambiguity inherent in GDPR interpretation, particularly around special category and sensitive data classifications. Organizations must conduct thorough legal analysis before assuming that tangentially related data triggers strict GDPR provisions, as misclassification can lead to either costly fines or unnecessary operational restrictions. The ruling underscores the importance of obtaining qualified legal counsel and maintaining documented rationale for data processing decisions.