The Spanish data protection authority ('AEPD') published, on 11 February 2022, its decision in Proceeding No. PS-00267-2020, in which it imposed a fine of €2,000,000 on Amazon Road Transport Spain S.L. for a violation of Articles 6(1) and 10 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), and Article 10 of the Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights ('LOPDGDD'), following a request for candidates' criminal records during the hiring process, based on consent.

Background to the decision

In particular, the AEPD outlined that a representative of the General Union of Workers filed a claim with the AEPD, noting that, for the hiring of self-employed contractors, Amazon Road Transport requested certificates of absence of a criminal record, i.e. negative certificates, specifically requiring the consent of the candidates, so that this data can be transferred to group companies and their supplier located outside the European Economic Area.

Additionally, the AEPD noted Amazon Road Transport's claim that, when obtaining a negative certificate, data relating to criminal convictions or offences is not processed, since the certificate does not contain any data relating to the commission of crimes, and as such, do not fall under Article 10 of the GDPR and LOPDGDD, respectively.

Findings of the AEPD

The AEPD rejected the claims of Amazon Road Transport regarding the processing of negative criminal conviction certificates, and refused to accept their interpretation of Article 10 of the GDPR, as well as Article 10 of the LOPDGDD, i.e. that this Article does not relate to criminal records, but rather criminal conviction and offences. As such, the AEPD found that Amazon Road Transport was not diligent, as it failed to implement adequate procedures for the collection and processing of personal data relating to criminal conviction.

Outcomes

As a result, the AEPD imposed the fine of €2,000,000 on Amazon Road Transport, and ordered the same to cease requiring the certificate of absence of a criminal record from applicants, delete all the information of the certificates already provided, and adapt its processing in accordance to the requirements of Article 6(1) of the GDPR, in relation to the Article 10 of the same, and Article 10 of the LOPDGDD. Furthermore, the AEPD declared that Amazon Road Transport had not violated Articles 7 and 49(1) of the GDPR, relating to international data transfers.

You can read the decision, only available in Spanish, here.