National Court · AN - SAN 2996/2026
Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller.
Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates. The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value. On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as Articles 10 and 71 LOPDGDD. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law. The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities. Holding — The Court granted the appeal and annulled the DPA’s decision and the €2 million fine. First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum intervention and the prohibition of extensive interpretations against the alleged infringer. The Court distinguished between processing information concerning existing criminal convictions or offences and processing a certificate confirming that the person has no criminal record. In its view, Article 10 GDPR expressly covers personal data relating to criminal convictions and offences, but not information concerning their absence. The Court considered that a negative criminal record certificate contains favourable information regarding a person’s conduct. Therefore, processing such a certificate does not amount to processing specially protected criminal-offence data under Article 10 GDPR. As a result, the consent provided by candidates was not invalid merely because no Union or national law specifically authorised the processing under that provision. The Court distinguished the case from situations involving direct access to criminal-record databases or the creation of files containing adverse information. It also distinguished previous employment-law judgments concerning employers requesting criminal records. Although requiring such certificates could be unlawful or abusive under employment law, this did not necessarily mean that the conduct was sanctionable under data protection law. Nevertheless, the Court clarified that processing negative criminal record certificates remained subject to the general GDPR requirements, particularly the principles under Article 5 GDPR and the need for a valid legal basis under Article 6(1) GDPR. In this regard, the Court found the controller’s reasons sufficient to consider the processing legitimate. Amazon Flex drivers delivered packages to private homes and had access to customers’ contact details and information capable of revealing their habits. The Court therefore accepted that verifying candidates’ good standing served the security of the recruitment process and the protection of customers. Accordingly, the Court concluded that the processing was legitimate, granted the controller’s appeal and annulled the DPA’s decision without awarding costs.
How it connects
Related across sources
Full text 4 paragraphs
Date: 07/08/2026 Appeal No.: 844/2022 Decision No.: 359/2026 Procedure: Ordinary proceedings Presiding Judge: LUIS HELMUTH MOYA MEYER Type of Decision: Judgement NATIONAL COURT ADMINISTRATIVE LITIGATION CHAMBER 1ST Section MADRID JUDGMENT: 00359 / 2026 PASEO DE LA CASTELLANA 14 Phone: 914007284 Emailelectrónico:audiencianacional.salacontencioso.s1@justicia.es COMMON PROCESSING SERVICE Team/User: PDS Form: N40000 JUDGMENT FREE TEXT ART. 206.1.3 LEC N.I.G.: 28079 23 3 2022 0004965 Procedure: PO ORDINARY PROCEDURE 0000844 / 2022 / Subject: AT THE DATA PROTECTION AGENCY From: AMAZON ROAD TRANSPORT SPAIN, S.L. ATTORNEY: FERNANDO IRURZUN MONTORO SOLICITOR: ADELA CANO LANTERO Against: DATA PROTECTION AGENCY, SPANISH DATA PROTECTION AGENCY INSTITUTIONAL STATE LAWYER JUDGMENT PRESIDING JUDGE Mr. Fernando Luis Ruiz Piñeiro JUDGES Ms. Amalia Basanta Rodríguez Ms. Nieves Buisan García Mr. Helmuth Moya Meyer 1 CASE LAW Mr. Ricardo Fernández Carballo-Calero In MADRID, on the eighth of July, two thousand twenty-six. HAVING CONSIDERED, by the First Section of the Contentious-Administrative Chamber of the National Court, the present appeal filed on behalf of AMAZON ROAD TRANSPORT SPAIN, S.L., represented by Ms. Adela Cano Lantero, under the legal representation of Mr. Fernando Iruzun Montoro, with the General State Administration having appeared as the defendant, and Mr. Helmuth Moya Meyer serving as the reporting judge for this judgement. FACTS OF THE CASE FIRST. — The plaintiff filed an appeal on April 8, 2022. Once the appeal was admitted for consideration, the plaintiff filed a complaint requesting the administrative record. The appellant filed a complaint requesting the annulment of the contested decision, arguing that the requirement to submit a clean criminal record certificate in order to participate in the Amazon Flex package delivery program does not violate Article 10 of the GDPR. The AEPD processed cases in which it ultimately considered the requirement for a clean criminal record certificate for certain categories of workers to be justified. However, it changed its position following a ruling by the Labor Chamber of the National Court in resolving a collective dispute brought against a security enterprise. This judgement was upheld by the Supreme Court judgement of May 12, 2022, Labor Chamber, appeal No. 70/2020. SECOND. — The complaint was served on the defendant Administration, which filed a response opposing the plaintiff’s claims and ultimately requesting that the complaint be dismissed. Once the admitted evidence had been presented, the parties filed their respective briefs. THIRD. —By an order of February 17, 2023, the proceedings were declared closed. Following the postponement of an initial hearing, the deliberation and ruling on this matter took place on June 9, 2026. FOURTH. -The legal provisions governing the conduct of contentious- administrative proceedings have been observed. LEGAL GROUNDS FIRST. —The contentious-administrative appeal is filed against the decision of the Director of the AEPD, dated February 10, 2022, which resolves disciplinary proceeding No. 267/2020 and imposes a fine of 2,000,000 euros on the plaintiff for a very serious violation of Article 6.1, in conjunction with Article 10 of the GDPR, and Articles 10 and 71 of the LOPD. SECOND. - Data subjects interested in participating in the AMAZON FLEX program, which consists of delivering packages using a van provided by the applicant, are required to submit a certificate of no criminal record. This data is processed, along with other documents that must be provided by the data subjects, by external processors responsible for pre-selecting candidates for Amazon Road. The contested decision holds that the consent provided by candidates—who, when applying for the position, submit a certificate of no criminal record—is invalid because it violates the prohibition set forth in Article 10 of the GDPR, which requires a legal basis authorizing the processing of personal data relating to criminal convictions and offenses. This provision states the following: “The processing of personal data relating to criminal convictions and offenses or related security measures on the basis of Article 6(1) may be carried out only under the supervision of public authorities or where authorized by Union or Member State law providing for appropriate safeguards for the data subject rights and freedoms. A comprehensive register of criminal convictions may only be maintained under the control of public authorities.” The AEPD appears to interpret that the processing of data regarding the absence of such a criminal record also constitutes the processing of data relating to criminal convictions and offenses. For this reason, it considers the consent given by the applicants to be invalid, as it contravenes the requirement for a legal provision authorizing the processing of this type of data.
CASE LAW The extensive reasoning in the contested decision cites certain precedents that are not strictly relevant to the issue at hand. The issue here is whether the data contained in certificates of no criminal record may be processed. In the cases we will briefly cite, the discussion concerns access to records containing data relating to criminal convictions and offenses. These are distinct matters. For example, Constitutional Court Ruling 144/1999, dated July 22, found that the right to privacy had been violated by the Electoral Board, which accessed the Registry of Convicted and Delinquent Persons and obtained a certificate of no criminal record to verify that the elected official met the legal requirement. It is affirmed that, according to the law, Electoral Boards cannot access data from the Registry of Convicted and Delinquent Persons. The practical consequence of this judgement is that they must require elected officials to prove they have no criminal record by submitting a certificate of no criminal record. This judgement does not endorse the administrative action. The violation of the fundamental right arises from having allowed access to data from the Register of Convicted and Delinquent Persons by a party without legal standing. No violation occurs by requiring the elected official to submit a certificate of no criminal record. The CJEU judgment of June 21, 2021 (C-439/2019) examines whether national legislation complies with Article 10 of the GDPR by regulating the legal standing required to access a registry of administrative traffic violations. Once again, this concerns the regulation of access to registries that potentially contain adverse personal data. However, it is certainly relevant to cite the judgement regarding a collective dispute with a security enterprise that required a clean criminal record certificate from the workers it was required to take on pursuant to a business succession. The Supreme Court ruling of May 12, 2022, holds that the security enterprise has no need to collect such information for the performance of the employment contract, because security guards are subject to administrative licensing, which is obtained upon proof that they have no criminal record. And, secondly, it states the following: “The processing of criminal records for purposes other than the prevention, investigation, detection, or prosecution of criminal offenses or the enforcement of criminal sanctions may only take place when it is authorized by law. And in this case, we are not dealing with a situation in which the enterprise has a law that authorizes it to require employees to provide their criminal records.” Certain labor laws contain provisions on this matter; for example, the German Labor Code. It establishes restrictions on an employer’s ability to require an employee to provide a criminal record certificate. Such conduct may be considered abusive from a labor law perspective, especially if it occurs in a context where the employer was obligated to take on the workforce of the enterprise it is succeeding. Here, however, we are interested in determining whether this constitutes the processing of personal data relating to criminal convictions and offenses, such that the data subject’s consent does not authorize the processing of personal data if there is no law authorizing the processing of such data for a specific purpose. The conduct may be reprehensible from the standpoint of labor law, but it does not necessarily warrant sanctions from the perspective of personal data protection. THIRD.—First, it is worth recalling that we are in the realm of administrative law, where the principle of minimal intervention and the prohibition against broad interpretations apply, including in matters of personal data protection when sanctions are involved. Article 10 of the GDPR refers specifically to personal data relating to criminal convictions and offenses. It does not refer to data relating to the absence of a criminal record. While a lax standard for authorizing direct access by third parties to criminal records may indirectly imply—in the event that a certificate of no criminal record is not obtained—the existence of such a criminal record, this is not the case for an enterprise that only processes applications from candidates who submit a certificate of no criminal record. When it obtains the certificate of no criminal record, it is not processing personal data relating to criminal convictions or offenses—which are data classified as sensitive under the GDPR and subject to special protection—but rather personal data containing favorable references regarding a person’s conduct. This data is not subject to special protection.
CASE LAW What is prohibited is the creation of filing systems containing unfavorable information about individuals. It also requires strict regulation of the authority to access records that may contain unfavorable information about a specific individual. However, in our view—and without prejudice to the perspective of labor law—it does not prohibit the processing of personal data favorable to applicants for a specific position, provided that such processing meets the requirements set forth in the principles governing data processing listed in article 5 of the GDPR. There are certain laws, such as Organic Law 8/2021 of June 4 on the comprehensive protection of children and adolescents against violence, which establishes the obligation for those working with minors must provide certificates of no criminal record from the Central Registry of Sex Offenders and Human Trafficking. However, this should not be viewed as a regulation enacted in light of Article 10 of the GDPR. It is an obligation imposed on those who hire employees or recruit volunteers to care for minors, from the perspective of child protection. What the law regulates is data protection for minors. Clean criminal record certificates are considered solely from the standpoint of ensuring the safety of hiring educators or volunteers who work with minors. The contested decision makes no reference to the administrative precedent cited by the complainant—the dismissal of case No. E/00037/2013 concerning a financial services agency that marketed credit cards, a case in which the AEPD considered the requirement for a clean criminal record certificate to be justified. Note that here the AEPD is not considering the connection between the matter and the prohibition in Article 10 of the GDPR or the requirement for an enabling legal provision. It is examining the issue in light of the principles regarding processing set forth in Article 5 of the GDPR. Hence, it concludes that the purposes of the processing are legitimate. In light of the considerations we have set forth, guided by a strict interpretation of Article 10 of the GDPR—which does not contradict the purposes of data protection nor infringe upon the right to privacy—we conclude that the consent given for the processing of personal data resulting from a clean criminal record check is not invalidated by a violation of the prohibition set forth in Article 10 of the GDPR. FOURTH. —From the perspective of the principles of personal data processing set forth in Article 5 GDPR, the reasons for requiring a clean criminal record certificate from applicants to participate in the Amazon Flex program, as put forward by Amazon Road, appear to us to be sufficient to affirm that the processing of this personal data is legitimate to ensure the security of hiring personnel for the program. The Land Transportation Regulation Act governs the good character requirement for obtaining administrative authorization for transportation activities. It does so to ensure road safety, as it requires the absence of penalties for criminal or administrative offenses related to traffic matters and involving vehicles other than those used in the Amazon Flex program. However, this does not mean that the processing of personal data regarding the good character of applicants—when not focused on road safety issues—is not a legitimate form of personal data processing. The Amazon Flex program involves the transportation of packages to the final recipient, with deliveries often made to private residences. It does not involve transportation between warehouses. Personal data such as addresses and phone numbers are provided to delivery drivers, which could put Amazon Road customers at serious risk Amazon Road if it falls into the hands of unscrupulous individuals. Even the packages, regardless of their value, may contain intimate information about the recipients’ habits, which could be put at risk if they fall into the hands of unscrupulous individuals. Therefore, we consider it legitimate for Amazon Road to seek to collect a minimum amount of information regarding the reputation of the individual and to ensure that they have no adverse history. This constitutes legitimate processing of personal data. FIFTH. —We will make no specific ruling on costs, in accordance with the provisions of Article 139.1 of the Law on Contentious-Administrative Jurisdiction, given the complexity of the issues addressed and the existence of a judicial ruling that upholds a different standard from the one we defend here. In view of the cited articles and other provisions of general application, the Contentious-Administrative Chamber of the National Court, First Section, has issued the following DECISION
CASE LAW WE GRANT the contentious-administrative appeal No. 844/2022 and annul the contested decision, without awarding costs. In due course, the administrative file shall be returned to the originating body with a certified copy of this judgement, and another copy shall be attached to the original case file. This judgement is subject to an appeal to the Court of Cassation, which must be filed with this Chamber within 30 days from the day following its notification; the brief preparing the appeal must demonstrate compliance with the requirements established in Article 89.2 of the Jurisdiction Act, justifying the objective interest in filing a cassation appeal. Thus, by this judgement, a certified copy of which shall be attached to the case file, we hereby pronounce, order, and sign. The dissemination of the text of this decision to data subjects not involved in the proceedings in which it was rendered may only take place after the removal of any personal data it may contain and with full respect for the right to privacy, the rights of data subjects requiring special protection, protection, or the guarantee of anonymity for victims or those who have suffered harm, where applicable. The personal data included in this ruling may not be transferred or disclosed for purposes contrary to the law.