Practical Application

Employment Background Checks: A company hiring for a financial services position wants to check applicants' criminal records. Article 10 prohibits the company from processing this data based solely on consent or legitimate interests (Article 6 bases). However, financial services regulations require criminal background checks for certain positions and authorize employers to conduct them with safeguards (proportionality, relevance, non-discrimination for spent convictions). The company relies on this legal authorization to satisfy Article 10, conducts only the checks authorized by law, limits retention of the records, and implements security measures. The company does not create a comprehensive database of all employees' criminal histories - only limited records of checks conducted.

Official Criminal Records Bureau: A national government criminal records bureau maintains comprehensive records of all criminal convictions within the country. This falls under Article 10's first pathway - processing under control of official authority. The bureau processes conviction data as part of its official mandate, provides authorized access to courts, police, and other official bodies, and responds to authorized third-party requests (employers, licensing authorities) according to legal frameworks. The bureau operates under governmental oversight and accountability mechanisms.

Volunteer Organization Child Protection: A youth sports organization wants to screen volunteers working with children to prevent those with relevant criminal convictions from accessing vulnerable populations. Child protection laws authorize and require such checks, providing appropriate safeguards: only convictions relevant to child safety are disclosed, spent minor convictions may be filtered, the organization must handle records securely and confidentially, volunteers have rights to challenge inaccurate records, and data retention is limited. The organization satisfies Article 10 through this legal authorization pathway, ensuring volunteers working with children are appropriately screened while respecting data protection rights.

Insurance Risk Assessment: An insurance company wants to process criminal records data to assess risk and set premiums. Unless specific insurance law authorizes this with appropriate safeguards, Article 10 prohibits such processing. The company cannot rely merely on consent (obtained through insurance application forms) or legitimate interests - there must be explicit legal authorization. In jurisdictions where insurance law does authorize processing of limited criminal records data for risk assessment, the company must comply with the law's safeguards, such as only considering relevant offences, applying proportionate weight to criminal history, and not discriminating based on spent convictions.

Violation Example - Private Database: A commercial data broker company creates a comprehensive database of individuals' criminal conviction histories compiled from public court records and offers subscription access to employers, landlords, and others. This violates Article 10's second sentence - comprehensive criminal records registers can only be kept under official authority control. While court records may be public, aggregating them into a comprehensive commercial database exceeds what Article 10 permits for private entities. The company would need to be an official governmental authority or cease maintaining such a comprehensive register.

Housing Application Screening: A landlord wants to conduct criminal background checks on prospective tenants. Whether this is permitted depends on whether Member State law specifically authorizes landlords to process such data with appropriate safeguards. In some jurisdictions, housing law may authorize limited checks (e.g., for serious violent or property crimes) with safeguards preventing blanket discrimination. In others, no such authorization exists, and the landlord cannot process criminal conviction data regardless of consent. The landlord cannot rely on legitimate interests alone - specific legal authorization is required.

Professional Licensing: Medical licensing authorities require doctors to disclose criminal convictions as part of licensing and renewal processes. Professional regulation law authorizes these authorities (often governmental or quasi-governmental bodies) to process criminal records data with safeguards ensuring only relevant convictions affect licensing decisions, proportionate responses, and appeal mechanisms. This legal authorization satisfies Article 10, enabling licensing bodies to protect public safety while respecting data protection principles.

Court Records Publication: Courts publish judgments online including defendants' names and conviction details. This processing occurs under official authority control (the judiciary) for transparency and public interest purposes. While creating potential privacy concerns addressed through separate mechanisms (like anonymization in some cases, time limitations on online publication, or balancing tests), the processing satisfies Article 10's requirement for official authority control. However, a private company scraping these published judgments to create a commercial searchable database faces Article 10 restrictions on comprehensive registers.

Rehabilitation of Offenders: An individual with a 10-year-old minor conviction applies for employment. National rehabilitation of offenders law provides that this conviction is 'spent' and need not be disclosed for most employment purposes (except positions requiring enhanced checks like child care). When the employer conducts a standard background check, the spent conviction is not disclosed by the official criminal records bureau. This safeguard, built into the legal framework authorizing background checks, protects rehabilitated individuals while allowing relevant convictions to be considered. The employer processing the background check response complies with Article 10 through the legal authorization pathway with appropriate safeguards.

Cross-Border Challenges: A multinational company operating in multiple EU countries must conduct background checks on employees. Because Article 10 implementation varies by Member State, the company faces different rules in different countries: some allow employers to conduct checks for most positions with minimal restrictions; others severely limit when checks are permitted; some have robust spent convictions filtering; others don't. The company must implement country-specific compliance procedures respecting each jurisdiction's criminal records processing laws.

Best Practices: Organizations processing criminal conviction data should: (1) verify specific legal authorization exists beyond general Article 6 bases; (2) understand and comply with applicable Member State laws and their safeguards; (3) limit processing to what's specifically authorized and necessary; (4) implement robust security for such sensitive data; (5) provide transparency to data subjects about criminal records processing; (6) respect spent convictions and rehabilitation provisions; (7) avoid blanket discrimination based on criminal history - consider relevance and proportionality; (8) don't create comprehensive criminal records databases (leave that to official authorities); (9) implement retention limits; and (10) train staff on special requirements for criminal conviction data.