[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ3KtvbX9PS6H7UgFGIvR0UuvEknLs0kDCGLQAJNl-BI":3},{"article":4,"iocs":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"83204cf9-9b40-4126-9e2c-b9af68412d73","AN - SAN 2996\u002F2026","an-san-2996-2026-3e1612","← Older revision Revision as of 11:50, 4 August 2026 Line 14: Line 14: |Original_Source_Name_1=Cendoj |Original_Source_Name_1=Cendoj |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FindexAN.jsp |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002F92b1be87d8823209a0a8778d75e36f0d\u002F20260728 |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language__Code_1=ES |Original_Source_Language__Code_1=ES","A Spanish court has overturned a €2 million fine imposed on Amazon Road Transport Spain by the Spanish Data Protection Agency (AEPD). The fine was for processing criminal record certificates for Amazon Flex delivery drivers, which the AEPD deemed a violation of GDPR and LOPDGDD. The court ruled that a certificate confirming no criminal record does not constitute data relating to criminal convictions under Article 10 GDPR, thus annulling the penalty.","Spanish court annuls €2M fine against Amazon for processing criminal record certificates.","Help AN - SAN 2996\u002F2026: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 11:07, 4 August 2026 view sourceFm (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators102 editsm Tag: Visual edit← Older edit Latest revision as of 11:50, 4 August 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators240 editsTag: Visual edit Line 14: Line 14: |Original_Source_Name_1=Cendoj|Original_Source_Name_1=Cendoj |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FindexAN.jsp|Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002F92b1be87d8823209a0a8778d75e36f0d\u002F20260728 |Original_Source_Language_1=Spanish; Castilian|Original_Source_Language_1=Spanish; Castilian |Original_Source_Language__Code_1=ES|Original_Source_Language__Code_1=ES Latest revision as of 11:50, 4 August 2026 AN - SAN 2996\u002F2026 Court: AN (Spain) Jurisdiction: Spain Relevant Law: Article 5 GDPR Article 6(1) GDPR Article 10 GDPR Article 10 LOPDGDDArticle 71 LOPDGDD Decided: 08.07.2026 Published: 29.07.2026 Parties: Amazon Road Transport Spain, S.L. Unión General de Trabajadores, U.G.T. National Case Number\u002FName: SAN 2996\u002F2026 European Case Law Identifier: ECLI:ES:AN:2026:2996 Appeal from: AEPDPS\u002F00267\u002F2020 Appeal to: Unknown Original Language(s): Spanish; Castilian Original Source: Cendoj (in Spanish; Castilian) Initial Contributor: bms The Court held that a certificate showing no criminal record does not contain data relating to criminal convictions under Article 10 GDPR and annulled a €2 million fine imposed on Amazon. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates. The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value. On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as Articles 10 and 71 LOPDGDD. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law. The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities. Holding The Court granted the appeal and annulled the DPA’s decision and the €2 million fine. First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum intervention and the prohibition of extensive interpretations against the alleged infringer. The Court distinguished between processing information concerning existing criminal convictions or offences and processing a certificate confirming that the person has no criminal record. In its view, Article 10 GDPR expressly covers personal data relating to criminal convictions and offences, but not information concerning their absence. The Court considered that a negative criminal record certificate contains favourable information regarding a person’s conduct. Therefore, processing such a certificate does not amount to processing specially protected criminal-offence data under Article 10 GDPR. As a result, the consent provided by candidates was not invalid merely because no Union or national law specifically authorised the processing under that provision. The Court distinguished the case from situations involving direct access to criminal-record databases or the creation of files containing adverse information. It also distinguished previous employment-law judgments concerning employers requesting criminal records. Although requiring such certificates could be unlawful or abusive under employment law, this did not necessarily mean that the conduct was sanctionable under data protection law. Nevertheless, the Court clarified that processing negative criminal record certificates remained subject to the general GDPR requirements, particularly the principles under Article 5 GDPR and the need for a valid legal basis under Article 6(1) GDPR. In this regard, the Court found the controller’s reasons sufficient to consider the processing legitimate. Amazon Flex drivers delivered packages to private homes and had access to customers’ contact details and information capable of revealing their habits. The Court therefore accepted that verifying candidates’ good standing served the security of the recruitment process and the protection of customers. Accordingly, the Court concluded that the processing was legitimate, granted the controller’s appeal and annulled the DPA’s decision without awarding costs. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Spanish; Castilian original. Please refer to the Spanish; Castilian original for more details. Case No.: SAN 2996\u002F2026 - ECLI:ES:AN:2026:2996 Cendoj ID: 28079230012026100348 Court: National Court. Contentious-Administrative Chamber Location: Madrid Section: 1 Date: 07\u002F08\u002F2026 Appeal No.: 844\u002F2022 Decision No.: 359\u002F2026 Procedure: Ordinary proceedings Presiding Judge: LUIS HELMUTH MOYA MEYER Type of Decision: Judgement NATIONAL COURT ADMINISTRATIVE LITIGATION CHAMBER 1ST Section MADRID JUDGMENT: 00359 \u002F 2026 PASEO DE LA CASTELLANA 14 Phone: 914007284 Emailelectrónico:audiencianacional.salacontencioso.s1@justicia.es COMMON PROCESSING SERVICE Team\u002FUser: PDS Form: N40000 JUDGMENT FREE TEXT ART. 206.1.3 LEC N.I.G.: 28079 23 3 2022 0004965 Procedure: PO ORDINARY PROCEDURE 0000844 \u002F 2022 \u002F Subject: AT THE DATA PROTECTION AGENCY From: AMAZON ROAD TRANSPORT SPAIN, S.L. ATTORNEY: FERNANDO IRURZUN MONTORO SOLICITOR: ADELA CANO LANTERO Against: DATA PROTECTION AGENCY, SPANISH DATA PROTECTION AGENCY INSTITUTIONAL STATE LAWYER JUDGMENT PRESIDING JUDGE Mr. Fernando Luis Ruiz Piñeiro JUDGES Ms. Amalia Basanta Rodríguez Ms. Nieves Buisan García Mr. Helmuth Moya Meyer 1 CASE LAW Mr. Ricardo Fernández Carballo-Calero In MADRID, on the eighth of July, two thousand twenty-six. HAVING CONSIDERED, by the First Section of the Contentious-Administrative Chamber of the National Court, the present appeal filed on behalf of AMAZON ROAD TRANSPORT SPAIN, S.L., represented by Ms. Adela Cano Lantero, under the legal representation of Mr. Fernando Iruzun Montoro, with the General State Administration having appeared as the defendant, and Mr. Helmuth Moya Meyer serving as the reporting judge for this judgement. FACTS OF THE CASE FIRST. — The plaintiff filed an appeal on April 8, 2022. Once the appeal was admitted for consideration, the plaintiff filed a complaint requesting the administrative record. The appellant filed a complaint requesting the annulment of the contested d","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AN_-_SAN_2996\u002F2026&diff=52600&oldid=52593","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-08-04T11:50:30+00:00","2026-08-04T12:00:11.628671+00:00",7,[18,21],{"name":19,"type":20},"Amazon","vendor",{"name":22,"type":23},"Amazon Flex","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]