Spain

Amazon Road Transport Spain S.L.

2,000,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2022-02-11.

Rank · Sector

#23

of 168 in Transportation and Energy

Rank · Spain

#20

of 1,075

Rank · All fines

#124

of 3,051

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2022-02-11
Controller / Processor: Amazon Road Transport Spain S.L.
Sector: Transportation and Energy
Quoted Articles: Art. 6 (1) GDPR, Art. 10 GDPR, Art. 10 LOPDGDD
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA (AEPD) has fined Amazon Road Transport Spain S.L. EUR 2,000,000. The AEPD had received a complaint from a trade union against the company. Amazon Road required certificates confirming the absence of criminal records when hiring drivers. Amazon Road believed that these certifications were not subject to Art. 10 GDPR. However, contrary to Amazon Road's interpretation, the AEPD determined that these data do fall under Art. 10 GDPR. During its investigation, the AEPD concluded that the processing of these data consequently did not comply with the requirements of Art. 10 GDPR. For this reason, the DPA came to the conclusion that Amazon Road had processed the data on the absence of criminal records without a valid legal basis.

Open original source Links to the regulator's original publication or another source.