[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTykAxZRPgDaKAKLYrfDwAb0KP_y6PyR0XjWkaDQjjnc":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"98dc8525-3b79-404b-9bd7-969cade13936","AN - SAN 2996\u002F2026","an-san-2996-2026-586ed7","Fixed links ← Older revision Revision as of 07:10, 16 September 2026 Line 15: Line 15: |Original_Source_Name_1=Cendoj |Original_Source_Name_1=Cendoj |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002F92b1be87d8823209a0a8778d75e36f0d\u002F20260728 |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002F92b1be87d8823209a0a8778d75e36f0d\u002F20260728 |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Language__Code_1=ES Line 94: Line 94: |Appeal_From_Body=AEPD |Appeal_From_Body=AEPD (Spain) |Appeal_From_Case_Number_Name=PS\u002F00267\u002F2020 |Appeal_From_Case_Number_Name=PS\u002F00267\u002F2020 |Appeal_From_Status= |Appeal_From_Status=","A Spanish court has overturned a €2 million fine imposed on Amazon Road Transport Spain by the Spanish Data Protection Agency (AEPD). The fine was for processing criminal record certificates for Amazon Flex drivers, which the AEPD deemed a violation of GDPR Article 10. The court ruled that a certificate showing no criminal record does not constitute data relating to criminal convictions and thus does not fall under the strict interpretation of Article 10 GDPR.","Spanish court annuls €2M fine against Amazon for GDPR violation related to criminal record certificates.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AN_-_SAN_2996\u002F2026&diff=53060&oldid=52604","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-16T07:10:41+00:00","2026-09-16T08:00:14.726099+00:00",7,[17,20],{"name":18,"type":19},"Amazon Flex","product",{"name":21,"type":22},"Amazon","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[21,18],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":65},"amazon-wins-appeal-over-gdpr-fine-for-driver-criminal-record-checks","Amazon Wins Appeal Over GDPR Fine for Driver Criminal Record Checks","The Spanish Data Protection Agency fined Amazon €2 million for processing criminal record certificates of Flex drivers, citing GDPR Article 10, which restricts handling of data related to criminal convictions. A Spanish court overturned the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute criminal conviction data under a strict reading of Article 10. This case highlights the complexity and ambiguity inherent in GDPR interpretation, particularly around special category and sensitive data classifications. Organizations must conduct thorough legal analysis before assuming that tangentially related data triggers strict GDPR provisions, as misclassification can lead to either costly fines or unnecessary operational restrictions. The ruling underscores the importance of obtaining qualified legal counsel and maintaining documented rationale for data processing decisions.",[56,57,58,59,60,61,62,63,64],"GDPR Article 10 (Processing of criminal convictions and offences data)","GDPR Article 9 (Processing of special categories of personal data)","GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency principle","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 30 – Records of Processing Activities (RoPA)","NIST Privacy Framework PR.DS-P1 (Data processing policies)","ISO\u002FIEC 27701:2019 – Privacy Information Management","CIS Control 3 – Data Protection","CNIL\u002FAEPD Guidance on Article 10 data classification",{}]