Amazon Road Transport Spain, S.L. – Court Ruling (Spain, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Amazon Road Transport Spain, S.L. faced a court ruling after a complaint about requiring job applicants to provide criminal record certificates. This matters because it raises questions about how companies can collect sensitive personal information. Businesses should be cautious when asking for such data and ensure they have the right legal basis.
What happened
Amazon Road Transport Spain, S.L. required job applicants to submit certificates confirming they had no criminal record, which raised legal concerns.
Who was affected
Job applicants seeking to work with Amazon Flex who were required to provide sensitive personal information.
What the authority found
The court ruled that Amazon Road Transport Spain, S.L. lacked a valid legal basis for processing criminal record information without specific authorization.
Why this matters
This case highlights the need for companies to carefully evaluate their data collection practices, especially when it involves sensitive information.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates. The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value. On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Articles 10] and [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 71 LOPDGDD]. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law. The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities. The Court granted the appeal and annulled the DPA’s decision and the €2 million fine. First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum i
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Amazon Road Transport Spain, S.L. in ES
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Amazon Road Transport Spain, S.L. - Spain (2026). Retrieved from cookiefines.eu
Last updated: