[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2pBhynXBsdrEbbplBNO0Xb1wTXGRHaVcZ1HUV5kQpAk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"a2cf0c68-cdef-4e74-a6a9-80ac87745f9e","amazon-wins-appeal-over-gdpr-fine-for-driver-criminal-record-checks","98dc8525-3b79-404b-9bd7-969cade13936","Amazon Wins Appeal Over GDPR Fine for Driver Criminal Record Checks","The Spanish Data Protection Agency fined Amazon €2 million for processing criminal record certificates of Flex drivers, citing GDPR Article 10, which restricts handling of data related to criminal convictions. A Spanish court overturned the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute criminal conviction data under a strict reading of Article 10. This case highlights the complexity and ambiguity inherent in GDPR interpretation, particularly around special category and sensitive data classifications. Organizations must conduct thorough legal analysis before assuming that tangentially related data triggers strict GDPR provisions, as misclassification can lead to either costly fines or unnecessary operational restrictions. The ruling underscores the importance of obtaining qualified legal counsel and maintaining documented rationale for data processing decisions.","**Immediate actions:**\n- Conduct a legal review of all current data processing activities involving sensitive or potentially special-category data to confirm correct GDPR classification.\n- Document the legal basis and internal reasoning for each category of personal data processed, especially for worker screening practices.\n\n**Policy & Governance improvements:**\n- Establish a Data Protection Impact Assessment (DPIA) process that includes legal sign-off before processing any data that could be interpreted as sensitive under GDPR Articles 9 or 10.\n- Engage qualified Data Protection Officers (DPOs) or external counsel to provide jurisdiction-specific guidance on ambiguous GDPR classifications.\n- Maintain an up-to-date Records of Processing Activities (RoPA) register that captures the legal basis and risk rationale for each processing activity.\n\n**Training & Awareness measures:**\n- Train HR, compliance, and procurement teams on the distinction between different categories of sensitive data under GDPR to prevent misclassification.\n- Implement regular regulatory update briefings so compliance teams stay current with evolving court rulings and supervisory authority guidance across EU member states.",[12,13,14,15,16,17,18,19,20],"GDPR Article 10 (Processing of criminal convictions and offences data)","GDPR Article 9 (Processing of special categories of personal data)","GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency principle","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 30 – Records of Processing Activities (RoPA)","NIST Privacy Framework PR.DS-P1 (Data processing policies)","ISO\u002FIEC 27701:2019 – Privacy Information Management","CIS Control 3 – Data Protection","CNIL\u002FAEPD Guidance on Article 10 data classification",{},"published","2026-09-16T09:22:07.843555+00:00","2026-09-16T09:22:07.773+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AN_-_SAN_2996\u002F2026&diff=53060&oldid=52604","an-san-2996-2026-586ed7","AN - SAN 2996\u002F2026",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]