Amazon Road Transport Spain, S.L. – Court Ruling (Spain, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Spanish court ruled that Amazon Road Transport Spain, S.L. improperly required job applicants to provide criminal record certificates. This matters because it shows that companies must be careful about how they handle sensitive personal data. Businesses should review their hiring practices to ensure compliance with data protection laws.
What happened
Amazon Road Transport Spain, S.L. required job applicants to submit certificates confirming they had no criminal record without proper legal basis.
Who was affected
Job applicants seeking positions within Amazon's delivery program were affected.
What the authority found
The court held that Amazon did not have a valid legal basis for processing personal data related to criminal convictions.
Why this matters
This ruling sets a precedent for how companies handle sensitive personal data during hiring. Businesses should ensure they have the right legal grounds for data requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 31 July 2026.
Processing notes: articles corrected, national law identified, amount discrepancy, authority corrected, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates. The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value. On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Articles 10] and [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 71 LOPDGDD]. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law. The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities. The Court granted the appeal and annulled the DPA’s decision and the €2 million fine. First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum i
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Amazon Road Transport Spain, S.L. in ES
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Amazon Road Transport Spain, S.L. - Spain (2026). Retrieved from cookiefines.eu
Last updated: