Criminal background checks in recruitment processes continue to raise significant data protection and employment law concerns. While there are positions for which legislation expressly requires candidates to demonstrate the absence of certain criminal convictions, in other cases employers must carefully justify why such information is necessary and proportionate for the specific role.
The recent Judgment No. 359/2026 of the Spanish National High Court (Audiencia Nacional), dated 8 July 2026, which annulled a €2 million fine imposed on Amazon Road Transport Spain, S.L., provides relevant guidance on this issue. However, its scope is closely linked to the specific circumstances of a home delivery service and should not be interpreted as allowing all employers to systematically require criminal record certificates from job applicants.
THE LEGAL FRAMEWORK: WHAT THE LAW PROTECTS
Article 10 of the GDPR establishes a stricter regime for the processing of personal data relating to criminal convictions and offences. In Spain, Article 10 of Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights provides that, outside the criminal justice purposes expressly provided for by law, such data may only be processed where authorised by a provision of European Union law, the Organic Law itself, or another legal provision with the force of law.
Accordingly, where an employer becomes aware of, receives, or retains information relating to criminal convictions, criminal proceedings, or associated security or precautionary measures, a general justification based on trust or security is not sufficient. The employer must ensure that there is an appropriate legal basis authorising the processing and that all applicable safeguards are observed.
The situation is different where the individual provides a certificate confirming the absence of a criminal record. This distinction proved decisive in the above-mentioned judgment of the Spanish National High Court
THE AMAZON FLEX JUDGMENT: A USEFUL BENCHMARK FOR ASSESSING RISK
The Spanish Data Protection Authority (AEPD) found that Amazon had infringed Article 10 of the GDPR by requiring applicants to the Amazon Flex programme to provide a certificate confirming the absence of a criminal record. In the Authority’s view, the applicants’ consent could not compensate for the lack of a statutory legal basis authorising such processing.
The Spanish National High Court overturned the fine. According to the Court, a certificate confirming the absence of a criminal record does not contain data relating to criminal convictions or offences; rather, it constitutes favourable information certifying that no such convictions or offences exist. The Court also emphasised that Amazon did not access the Central Criminal Records Register directly but instead relied on the certificate voluntarily submitted by each applicant.
In addition, the Court recognised that Amazon had a legitimate purpose in the specific circumstances of the case. Amazon Flex drivers delivered parcels to private residences and handled addresses, telephone numbers and shipment details that could reveal information about recipients’ private lives. In light of these circumstances, the Court considered that a limited verification of applicants’ integrity could be regarded as proportionate when assessed against the general principles of the GDPR.
WHAT SHOULD EMPLOYERS CONSIDER BEFORE REQUESTING A CRIMINAL RECORD CERTIFICATE?
Before making a certificate confirming the absence of a criminal record a recruitment requirement, employers should consider and document, at a minimum, the following questions:
- Is there an explicit legal requirement? In certain sectors, particularly where employees work with children, the law may require individuals to demonstrate the absence of specific criminal convictions. Where such an obligation exists, it must be applied strictly within its legal scope.
- If there is no legal requirement, what specific risk is the employer seeking to mitigate? Mere convenience, a general corporate policy, or a broad desire to recruit “trustworthy” individuals will rarely be sufficient to justify requesting a criminal record certificate.
- Does the role involve a heightened level of exposure or responsibility? Employers should assess the connection between the position and the risks relied upon, such as regular access to private homes, contact with vulnerable individuals, responsibility for particularly sensitive assets, or access to significant amounts of personal information.
- Is the request necessary and proportionate? Employers should consider whether less intrusive measures could adequately address the identified risk and whether the certificate is requested only from candidates who will actually perform the relevant duties.
- What information is genuinely required? Employers should avoid requesting information that goes beyond what is strictly necessary. They should not seek criminal record certificates or broader criminal history information where they merely need to verify compliance with a specific legal requirement.
- What is the legal basis for the processing, and how are candidates informed? Employers should identify and document the applicable legal basis for the processing and provide candidates with clear information about the purpose of the processing, the recipients of the data, the retention period, and their data protection rights.
- Who will have access to the certificate, and for how long will it be retained? Access should be limited to those who have a genuine need to know, and the certificate should be retained only for as long as necessary for the recruitment process or to demonstrate compliance with an applicable legal obligation.
