Criminal Data

Legal Framework

Article 10 GDPR governs the processing of personal data relating to criminal convictions and offences. Unlike the special categories under Article 9, criminal data is not absolutely prohibited but is subject to dual conditions: a valid Article 6(1) lawful basis must exist, and processing must additionally satisfy one of two Article 10 pathways.

The provision permits processing only where it occurs under official authority control or is authorised by Union or Member State law with appropriate safeguards:

"shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects"
— GDPR Art. 10

Comprehensive criminal conviction registers are reserved exclusively to official authority control. Additionally, Article 37(1)(c) mandates DPO designation where core activities involve large-scale criminal data processing:

"processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10"
— GDPR Art. 37

Key Developments

The CJEU has consistently affirmed that Article 10 imposes restrictions beyond the general Article 6 framework. In Endemol Shine Finland, the Court confirmed that criminal data triggers additional safeguards:

"Article 10 of the GDPR makes their processing subject to additional restrictions"
— Endemol Shine Finland Oy ¶47

This reinforces that a lawful basis under Article 6(1) is necessary but not sufficient — controllers must independently satisfy Article 10's official-authority or national-law conditions.

The Spanish DPA's Mercadona decision illustrates enforcement thresholds. The controller deployed facial recognition in retail stores to track persons with criminal convictions:

"The controller had installed facial recognition systems in Mercadona stores for the purpose of tracking individuals with criminal convictions or restraining orders."
— Mercadona S.A. §1

The €2.52 million fine reflected failures across multiple dimensions: data minimisation, necessity and proportionality, and a deficient DPIA. Processing criminal data through blanket biometric capture of all store visitors — including minors — failed the appropriateness test at every level.

Status of the Debate

This area is actively contested in court. While the CJEU has repeatedly confirmed Article 10's two-pathway structure, Member State implementing laws vary significantly in scope and safeguards, and courts are wrestling with boundary questions — particularly where private entities process criminal data under national law authorisations rather than under direct official authority control. The Latvijas Republikas Saeima and Endemol Shine lines of authority are being distinguished and extended in ongoing litigation. No definitive court split is on record, but the precise threshold for what constitutes "control of official authority" versus mere national-law authorisation, and what safeguards satisfy the "appropriate" standard, remains unresolved. Clarification will likely require a preliminary reference testing private-sector criminal data processing against both pathways simultaneously.

Practical Guidance

• Establish dual compliance: Secure an Article 6(1) lawful basis and independently verify Article 10 conditions — either direct official-authority control or specific Union/Member State law authorisation with documented safeguards.

• Designate a DPO when threshold is met: If criminal data processing is a core activity conducted on a large scale, Article 37(1)(c) mandates DPO appointment without discretion.

• Conduct a DPIA: Criminal data processing inherently carries high risk under Article 35; a deficient or generic DPIA was a standalone violation in Mercadona.

• Apply strict minimisation: Blanket collection of criminal data across untargeted populations — as in Mercadona's store-wide facial recognition — fails necessity and proportionality. Limit collection to specific, justified individuals.

• Verify national law basis: Where relying on Member State law authorisation, confirm the law specifies appropriate safeguards; a general legal permission without built-in data subject protections will not satisfy Article 10.