Spanish Court Overturns €2M GDPR Fine on Amazon Over Criminal Record Checks
Written by AI from the linked story. Not reviewed by an editor. How this works
Amazon Road Transport Spain was fined €2 million by the AEPD for requiring delivery drivers to submit criminal record certificates, which regulators initially deemed a violation of GDPR Article 10 and Spain's LOPDGDD regarding special category data on criminal convictions. A Spanish court subsequently annulled the fine, ruling that a certificate confirming the *absence* of a criminal record does not constitute data relating to criminal convictions or offences under Article 10 GDPR. This case highlights the critical importance of obtaining precise legal interpretations before implementing HR or onboarding data processing practices, as ambiguity in regulatory definitions can expose organizations to significant financial and reputational risk. It also demonstrates that regulators and courts may interpret the same provision differently, making proactive legal due diligence essential. Organizations must not rely solely on internal assumptions about what constitutes 'special category' data.
Tactical Insight
Immediate actions
- Conduct a Data Protection Impact Assessment (DPIA) before processing any employee or contractor data that could fall under special or sensitive categories.
- Engage qualified legal counsel to obtain a written opinion on the lawfulness of processing criminal record data in every jurisdiction where you operate.
Policy & Governance improvements
- Establish a formal data classification policy that clearly maps each data type to the relevant GDPR article and lawful basis, reviewed annually or when regulations change.
- Create a cross-functional review board (Legal, HR, Privacy) to approve any new HR data processing activities before deployment.
- Document all lawful basis decisions and retain them as evidence of accountability under GDPR Article 5(2).
Long-term compliance measures
- Subscribe to regulatory guidance updates from national supervisory authorities (e.g., AEPD, ICO) to stay current on evolving interpretations of special category data.
- Implement a Records of Processing Activities (RoPA) registry that flags high-risk processing activities for periodic legal review.
- Train HR and procurement teams on the distinctions between standard personal data and special category/criminal data under GDPR Articles 9 and 10.