Requiring a certificate attesting to the absence of a criminal record does not necessarily, in itself, entail the processing of personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR.

This is the conclusion emerging from Judgment No. 359/2026 of the Spanish Audiencia Nacional, which annulled the EUR 2 million fine imposed in 2022 by the Agencia Española de Protección de Datos (AEPD) on Amazon Road Transport Spain in connection with the Amazon Flex programme.

The proceedings concerned a requirement imposed on drivers wishing to carry out delivery services through the programme to provide a certificate confirming that they had no criminal record. The Spanish supervisory authority had taken the view that the collection of such a document fell within the scope of Article 10 GDPR and that the data subject’s consent was insufficient to provide a lawful basis for the processing. Article 10 subjects personal data relating to criminal convictions and offences to a particularly stringent regime, permitting their processing only under the conditions laid down by Union or Member State law and subject to appropriate safeguards.

The Audiencia Nacional, by contrast, focused on the actual content of the information collected. According to the Spanish court, a document which merely certifies that an individual has no criminal record does not disclose information concerning a specific conviction, criminal offence or infringement. Rather, the information being processed concerns precisely the absence of any such circumstances.

This distinction is particularly significant given that the dispute arose in the context of enforcement proceedings resulting in an administrative fine. In that context, the Court held that the scope of Article 10 GDPR could not be extended beyond the proper meaning of the categories of data expressly covered by that provision.

The judgment does not, however, mean that companies are free to request criminal record certificates from job applicants, employees or other individuals engaged to provide services.

Indeed, the fact that Article 10 may not apply does not, in itself, render the processing lawful. The other requirements and principles of the GDPR remain applicable, including lawfulness, fairness, transparency, purpose limitation, data minimisation, necessity and proportionality.

It is therefore necessary to assess, in the circumstances of each case, why the company intends to obtain such information, the connection between that information and the activities to be performed by the individual concerned, and whether the same purpose could be achieved through less intrusive means. In the Amazon Flex case, the Audiencia Nacional attached particular importance to the specific characteristics of the delivery activities concerned. Drivers may, in fact, have access to customers’ personal data, including names, addresses and contact details, as well as direct access to their homes. The content or nature of the goods delivered may also indirectly reveal information about recipients’ habits and private lives. In light of those factors, verification of the absence of a criminal record was considered consistent with the need to assess the trustworthiness of individuals entrusted with delivery activities and proportionate to the risks associated with those activities.

The decision is also particularly relevant to corporate processes concerning staff recruitment, induction into the organisation and preliminary assessments of candidates’ trustworthiness. For the purposes of the legal classification of the processing, the relevant factor is not merely the source of the document, but, above all, the content of the information actually collected and used by the controller.

At the same time, the judgment calls for caution when assessing its broader implications. It does not amount to a general authorisation to conduct criminal record checks. Rather, it recognises the need to distinguish between information disclosing criminal convictions or offences and information merely confirming their absence. Companies must therefore continue to assess, in advance, the applicable legal basis for the processing, whether the check is genuinely necessary in relation to the duties concerned, whether it is proportionate, and whether any specific provisions of national law apply.

The case may also be subject to further judicial review, as an appeal may be brought before the Spanish Tribunal Supremo.