Amazon Wins Appeal Over GDPR Fine for Driver Criminal Record Checks

Written by AI from the linked story. Not reviewed by an editor. How this works

The Spanish Data Protection Agency fined Amazon €2 million for processing criminal record certificates of Flex drivers, citing GDPR Article 10, which restricts handling of data related to criminal convictions. A Spanish court overturned the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute criminal conviction data under a strict reading of Article 10. This case highlights the complexity and ambiguity inherent in GDPR interpretation, particularly around special category and sensitive data classifications. Organizations must conduct thorough legal analysis before assuming that tangentially related data triggers strict GDPR provisions, as misclassification can lead to either costly fines or unnecessary operational restrictions. The ruling underscores the importance of obtaining qualified legal counsel and maintaining documented rationale for data processing decisions.

Tactical Insight

Immediate actions

Conduct a legal review of all current data processing activities involving sensitive or potentially special-category data to confirm correct GDPR classification.
Document the legal basis and internal reasoning for each category of personal data processed, especially for worker screening practices.

Policy & Governance improvements

Establish a Data Protection Impact Assessment (DPIA) process that includes legal sign-off before processing any data that could be interpreted as sensitive under GDPR Articles 9 or 10.
Engage qualified Data Protection Officers (DPOs) or external counsel to provide jurisdiction-specific guidance on ambiguous GDPR classifications.
Maintain an up-to-date Records of Processing Activities (RoPA) register that captures the legal basis and risk rationale for each processing activity.

Training & Awareness measures

Train HR, compliance, and procurement teams on the distinction between different categories of sensitive data under GDPR to prevent misclassification.
Implement regular regulatory update briefings so compliance teams stay current with evolving court rulings and supervisory authority guidance across EU member states.