AN - SAN 2996/2026

AN - SAN 2996/2026
Court:	AN (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 5 GDPR Article 6(1) GDPR Article 10 GDPR Article 10 LOPDGDD Article 71 LOPDGDD
Decided:	08.07.2026
Published:	29.07.2026
Parties:	Amazon Road Transport Spain, S.L. Unión General de Trabajadores, U.G.T.
National Case Number/Name:	SAN 2996/2026
European Case Law Identifier:	ECLI:ES:AN:2026:2996
Appeal from:	AEPD PS/00267/2020
Appeal to:	Unknown
Original Language(s):	Spanish; Castilian
Original Source:	Cendoj (in Spanish; Castilian)
Initial Contributor:	bms

The Court held that a certificate showing no criminal record does not contain data relating to criminal convictions under Article 10 GDPR and annulled a €2 million fine imposed on Amazon.

English Summary

Facts

Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates.

The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value.

On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as Articles 10 and 71 LOPDGDD. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law.

The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities.

Holding

The Court granted the appeal and annulled the DPA’s decision and the €2 million fine.

First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum intervention and the prohibition of extensive interpretations against the alleged infringer.

The Court distinguished between processing information concerning existing criminal convictions or offences and processing a certificate confirming that the person has no criminal record. In its view, Article 10 GDPR expressly covers personal data relating to criminal convictions and offences, but not information concerning their absence.

The Court considered that a negative criminal record certificate contains favourable information regarding a person’s conduct. Therefore, processing such a certificate does not amount to processing specially protected criminal-offence data under Article 10 GDPR. As a result, the consent provided by candidates was not invalid merely because no Union or national law specifically authorised the processing under that provision.

The Court distinguished the case from situations involving direct access to criminal-record databases or the creation of files containing adverse information. It also distinguished previous employment-law judgments concerning employers requesting criminal records. Although requiring such certificates could be unlawful or abusive under employment law, this did not necessarily mean that the conduct was sanctionable under data protection law.

Nevertheless, the Court clarified that processing negative criminal record certificates remained subject to the general GDPR requirements, particularly the principles under Article 5 GDPR and the need for a valid legal basis under Article 6(1) GDPR. In this regard, the Court found the controller’s reasons sufficient to consider the processing legitimate. Amazon Flex drivers delivered packages to private homes and had access to customers’ contact details and information capable of revealing their habits. The Court therefore accepted that verifying candidates’ good standing served the security of the recruitment process and the protection of customers.

Accordingly, the Court concluded that the processing was legitimate, granted the controller’s appeal and annulled the DPA’s decision without awarding costs.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish; Castilian original. Please refer to the Spanish; Castilian original for more details.

Case No.: SAN 2996/2026 - ECLI:ES:AN:2026:2996
Cendoj ID: 28079230012026100348
Court: National Court. Contentious-Administrative Chamber
Location: Madrid
Section: 1
Date: 07/08/2026
Appeal No.: 844/2022
Decision No.: 359/2026
Procedure: Ordinary proceedings
Presiding Judge: LUIS HELMUTH MOYA MEYER
Type of Decision: Judgement
NATIONAL COURT
ADMINISTRATIVE LITIGATION CHAMBER
1ST Section
MADRID
JUDGMENT: 00359 / 2026
PASEO DE LA CASTELLANA 14
Phone: 914007284
Emailelectrónico:audiencianacional.salacontencioso.s1@justicia.es
COMMON PROCESSING SERVICE
Team/User: PDS
Form: N40000 JUDGMENT FREE TEXT ART. 206.1.3 LEC
N.I.G.: 28079 23 3 2022 0004965
Procedure: PO ORDINARY PROCEDURE 0000844 / 2022 /
Subject: AT THE DATA PROTECTION AGENCY
From: AMAZON ROAD TRANSPORT SPAIN, S.L.
ATTORNEY: FERNANDO IRURZUN MONTORO
SOLICITOR: ADELA CANO LANTERO
Against: DATA PROTECTION AGENCY, SPANISH DATA PROTECTION AGENCY
INSTITUTIONAL
STATE LAWYER
JUDGMENT
PRESIDING JUDGE
Mr. Fernando Luis Ruiz Piñeiro
JUDGES
Ms. Amalia Basanta Rodríguez
Ms. Nieves Buisan García
Mr. Helmuth Moya Meyer
1
CASE LAW
Mr. Ricardo Fernández Carballo-Calero
In MADRID, on the eighth of July, two thousand twenty-six.
HAVING CONSIDERED, by the First Section of the Contentious-Administrative Chamber of the National Court, the present
appeal filed on behalf of AMAZON ROAD TRANSPORT SPAIN, S.L., represented by Ms. Adela
Cano Lantero, under the legal representation of Mr. Fernando Iruzun Montoro, with the General State Administration having appeared as the
defendant, and Mr. Helmuth Moya Meyer serving as the reporting judge for this judgement.
FACTS OF THE CASE
FIRST. — The plaintiff filed an appeal on April 8, 2022. Once the appeal was admitted for consideration, the plaintiff filed a complaint
requesting the administrative record.
The appellant filed a complaint requesting the annulment of the contested decision, arguing that
the requirement to submit a clean criminal record certificate in order to participate in the
Amazon Flex package delivery program does not violate Article 10 of the GDPR. The AEPD processed cases
in which it ultimately considered the requirement for a clean criminal record certificate
for certain categories of workers to be justified. However, it changed its position following a ruling by
the Labor Chamber of the National Court in resolving a collective dispute brought against a
security enterprise. This judgement was upheld by the Supreme Court judgement of May 12, 2022, Labor Chamber, appeal
No. 70/2020.
SECOND. — The complaint was served on the defendant Administration, which filed a response
opposing the plaintiff’s claims and ultimately requesting that the complaint be dismissed.
Once the admitted evidence had been presented, the parties filed their respective briefs.
THIRD. —By an order of February 17, 2023, the proceedings were declared closed.
Following the postponement of an initial hearing, the deliberation and ruling on this matter took place on June 9,
2026.
FOURTH. -The legal provisions governing the conduct of contentious-
administrative proceedings have been observed.
LEGAL GROUNDS
FIRST. —The contentious-administrative appeal is filed against the decision of the Director of the AEPD,
dated February 10, 2022, which resolves disciplinary proceeding No. 267/2020 and imposes a
fine of 2,000,000 euros on the plaintiff for a very serious violation of Article 6.1, in conjunction with
Article 10 of the GDPR, and Articles 10 and 71 of the LOPD.
SECOND. - Data subjects interested in participating in the AMAZON FLEX program, which consists of delivering
packages using a van provided by the applicant, are required to submit a certificate of no
criminal record. This data is processed, along with other documents that must be provided by the
data subjects, by external processors responsible for pre-selecting candidates
for Amazon Road.
The contested decision holds that the consent provided by candidates—who, when applying
for the position, submit a certificate of no criminal record—is invalid because it violates the
prohibition set forth in Article 10 of the GDPR, which requires a legal basis authorizing the processing of personal data
relating to criminal convictions and offenses.
This provision states the following:
“The processing of personal data relating to criminal convictions and offenses or related security measures
on the basis of Article 6(1) may be carried out only under the supervision of
public authorities or where authorized by Union or Member State law providing for
appropriate safeguards for the data subject rights and freedoms. A comprehensive register
of criminal convictions may only be maintained under the control of public authorities.”
The AEPD appears to interpret that the processing of data regarding the absence of such a criminal record
also constitutes the processing of data relating to criminal convictions and offenses. For this reason, it considers the
consent given by the applicants to be invalid, as it contravenes the requirement for a legal provision authorizing the
processing of this type of data.
2
CASE LAW
The extensive reasoning in the contested decision cites certain precedents that
are not strictly relevant to the issue at hand. The issue here is whether the data
contained in certificates of no criminal record may be processed. In the cases we will briefly cite,
the discussion concerns access to records containing data relating to criminal convictions and offenses.
These are distinct matters.
For example, Constitutional Court Ruling 144/1999, dated July 22, found that the right to privacy had been violated by the Electoral Board, which
accessed the Registry of Convicted and Delinquent Persons and obtained a certificate of no criminal record to
verify that the elected official met the legal requirement. It is affirmed that, according to the law, Electoral Boards
cannot access data from the Registry of Convicted and Delinquent Persons. The practical consequence of this judgement
is that they must require elected officials to prove they have no criminal record by submitting
a certificate of no criminal record. This judgement does not endorse the administrative action. The violation of the
fundamental right arises from having allowed access to data from the
Register of Convicted and Delinquent Persons by a party without legal standing. No violation occurs by requiring the elected official to submit a
certificate of no criminal record.
The CJEU judgment of June 21, 2021 (C-439/2019) examines whether national legislation complies with Article 10
of the GDPR by regulating the legal standing required to access a registry of administrative traffic violations.
Once again, this concerns the regulation of access to registries that potentially contain
adverse personal data.
However, it is certainly relevant to cite the judgement regarding a collective dispute with a
security enterprise that required a clean criminal record certificate from the workers it
was required to take on pursuant to a business succession.
The Supreme Court ruling of May 12, 2022, holds that the security enterprise has no need to collect such
information for the performance of the employment contract, because security guards are subject to
administrative licensing, which is obtained upon proof that they have no criminal record. And, secondly,
it states the following:
“The processing of criminal records for purposes other than the prevention, investigation, detection, or
prosecution of criminal offenses or the enforcement of criminal sanctions may only take place when
it is authorized by law. And in this case, we are not dealing with a situation in which the enterprise has a law
that authorizes it to require employees to provide their criminal records.”
Certain labor laws contain provisions on this matter; for example, the
German Labor Code. It establishes restrictions on an employer’s ability to require an employee to
provide a criminal record certificate.
Such conduct may be considered abusive from a labor law perspective, especially if it
occurs in a context where the employer was obligated to take on the workforce of the
enterprise it is succeeding.
Here, however, we are interested in determining whether this constitutes the processing of personal data relating to
criminal convictions and offenses, such that the data subject’s consent does not authorize the processing
of personal data if there is no law authorizing the processing of such data for a
specific purpose. The conduct may be reprehensible from the standpoint of labor law, but it does not
necessarily warrant sanctions from the perspective of personal data protection.
THIRD.—First, it is worth recalling that we are in the realm of administrative law, where
the principle of minimal intervention and the prohibition against broad interpretations apply, including in matters of
personal data protection when sanctions are involved.
Article 10 of the GDPR refers specifically to personal data relating to criminal convictions and offenses.
It does not refer to data relating to the absence of a criminal record.
While a lax standard for authorizing direct access by third parties to criminal records
may indirectly imply—in the event that a certificate of no criminal record is not obtained—the
existence of such a criminal record, this is not the case for an enterprise that only processes applications from
candidates who submit a certificate of no criminal record. When it obtains the
certificate of no criminal record, it is not processing personal data relating to criminal convictions or offenses—which are
data classified as sensitive under the GDPR and subject to special protection—but rather personal data
containing favorable references regarding a person’s conduct. This data is not subject to
special protection. 
3
CASE LAW
What is prohibited is the creation of filing systems containing unfavorable information about individuals. It also requires
strict regulation of the authority to access records that may contain unfavorable information
about a specific individual. However, in our view—and without prejudice to the perspective
of labor law—it does not prohibit the processing of personal data favorable to applicants for a specific position,
provided that such processing meets the requirements set forth in the principles governing data processing listed in
article 5 of the GDPR.
There are certain laws, such as Organic Law 8/2021 of June 4 on the comprehensive protection of children and
adolescents against violence, which establishes the obligation for those working with minors
must provide certificates of no criminal record from the Central Registry of Sex Offenders and Human Trafficking.
However, this should not be viewed as a regulation enacted in light of Article 10 of the GDPR. It is an obligation
imposed on those who hire employees or recruit volunteers to care for minors, from
the perspective of child protection. What the law regulates is data protection for minors. Clean criminal record certificates are considered solely from the standpoint
of ensuring the safety of hiring educators or volunteers who work with minors.
The contested decision makes no reference to the administrative precedent cited by the complainant—the dismissal
of case No. E/00037/2013 concerning a financial services agency that marketed
credit cards, a case in which the AEPD considered the requirement for a clean
criminal record certificate to be justified.
Note that here the AEPD is not considering the connection between the matter and the prohibition in Article 10 of the GDPR
or the requirement for an enabling legal provision. It is examining the issue in light of the principles regarding
processing set forth in Article 5 of the GDPR. Hence, it concludes that the purposes of the processing are legitimate.
In light of the considerations we have set forth, guided by a strict interpretation of Article
10 of the GDPR—which does not contradict the purposes of data protection nor infringe upon the right
to privacy—we conclude that the consent given for the processing of personal data
resulting from a clean criminal record check is not invalidated by a violation of the
prohibition set forth in Article 10 of the GDPR.
FOURTH. —From the perspective of the principles of personal data processing set forth in Article 5
GDPR, the reasons for requiring a clean criminal record certificate from applicants to participate in
the Amazon Flex program, as put forward by Amazon Road, appear to us to be sufficient to affirm that the processing
of this personal data is legitimate to ensure the security of hiring personnel for the
program.
The Land Transportation Regulation Act governs the good character requirement for obtaining
administrative authorization for transportation activities. It does so to ensure road safety,
as it requires the absence of penalties for criminal or administrative offenses related to
traffic matters and involving vehicles other than those used in the Amazon
Flex program. However, this does not mean that the processing of personal data regarding the good character of
applicants—when not focused on road safety issues—is not a legitimate form of personal data processing.
The Amazon Flex program involves the transportation of packages to the final recipient, with deliveries
often made to private residences. It does not involve transportation between warehouses. Personal data such as
addresses and phone numbers are provided to delivery drivers, which could put Amazon Road customers at
serious risk
Amazon Road if it falls into the hands of unscrupulous individuals. Even the packages, regardless
of their value, may contain intimate information about the recipients’ habits, which could be put
at risk if they fall into the hands of unscrupulous individuals.
Therefore, we consider it legitimate for Amazon Road to seek to collect a minimum amount of information regarding the
reputation of the individual and to ensure that they have no adverse history. This constitutes legitimate
processing of personal data.
FIFTH. —We will make no specific ruling on costs, in accordance with the provisions of
Article 139.1 of the Law on Contentious-Administrative Jurisdiction, given the complexity of the
issues addressed and the existence of a judicial ruling that upholds a different standard from the one
we defend here.
In view of the cited articles and other provisions of general application, the Contentious-Administrative Chamber of the
National Court, First Section, has issued the following
DECISION
4
CASE LAW
WE GRANT the contentious-administrative appeal No. 844/2022 and annul the contested decision, without
awarding costs.
In due course, the administrative file shall be returned to the originating body with a certified copy of this
judgement, and another copy shall be attached to the original case file.
This judgement is subject to an appeal to the Court of Cassation, which must be filed with this Chamber within
30 days from the day following its notification; the brief preparing the appeal must
demonstrate compliance with the requirements established in Article 89.2 of the Jurisdiction Act,
justifying the objective interest in filing a cassation appeal.
Thus, by this judgement, a certified copy of which shall be attached to the case file, we hereby pronounce, order, and sign.
The dissemination of the text of this decision to data subjects not involved in the proceedings in which it was rendered may only
take place after the removal of any personal data it may contain and with
full respect for the right to privacy, the rights of data subjects requiring special protection,
protection, or the guarantee of anonymity for victims or those who have suffered harm, where applicable.
The personal data included in this ruling may not be transferred or disclosed for purposes contrary
to the law.