• Text Size
• Print
• Email

  From:
  

  To:
  

  Hey! Check out this news page: https://www.thebackgroundinvestigator.com/Articles/-Processors-and-Controllers-Beware---GDPR-fines-the-Controller/3071/index.php.

  SendCancel

International News

Processors and Controllers Beware - GDPR fines the Controller

June 09, 2025 posted by Steve Brownstein

GDPR ALERT >This article seems to answer a lot of Processors and Controllers concerns and questions.

The Spanish Data Protection Authority (AEPD) (from 2022) ordered Amazon Road Transport Spain S.L. to cease the practice of requiring candidates for delivery driver positions to provide certificates of absence of a criminal record.

This order was part of a decision published on February 11, 2022 (Proceeding No. PS-00267-2020), in which the AEPD also imposed a fine of €2 million on the company for violating Articles 6(1) (lawfulness of processing) and 10 (processing of criminal conviction data) of the GDPR, as well as Article 10 of Spain's Organic Law on the Protection of Personal Data (LOPDGDD).

Key reasons for the AEPD's order and decision:

-Unlawful Processing of Criminal Conviction Data: The AEPD concluded that requesting a police certificate of good conduct (even a negative one) constituted processing of personal data relating to criminal convictions under Article 10 GDPR.

-No Valid Legal Basis:No Legal Obligation: The AEPD found there was no Spanish law specifically requiring delivery personnel to provide such a certificate.

-Invalid Consent: Amazon Road Transport relied on consent, but the AEPD deemed it invalid because it was a mandatory requirement to proceed with the application process, thus not freely given.

-No Legitimate Interest: The company's argument of legitimate interest (customer safety and trust) was rejected, with the AEPD stating that requiring the certificate was disproportionate to the stated interest.

Next, there was Order to Desist and Delete Data: In addition to the fine, the AEPD specifically ordered Amazon Road Transport to:

-Cease requiring the certificate of absence of a criminal record from applicants.

-Delete all information from the certificates already provided.

-Adapt its processing practices in accordance with GDPR requirements.

There is a written decision. The AEPD's decision in Proceeding No. PS-00267-2020 was published on February 11, 2022.

While the full text is typically in Spanish, summaries and analyses of the decision are widely available from data protection news outlets and legal firms. You can often find a reference to the case number (PS/00267/2020) on GDPR enforcement trackers and legal databases.