criminal-data-handling
Criminal Conviction and Offence Data Handling — GDPR Art. 10
Overview
Article 10 of the GDPR establishes a separate regime for processing personal data relating to criminal convictions and offences, or related security measures. Unlike Art. 9 special category data which is subject to a general prohibition with listed exceptions, Art. 10 permits processing only under the control of official authority, or when authorised by EU or Member State law providing appropriate safeguards. The maintenance of a comprehensive register of criminal convictions is restricted to processing under the control of official authority. This skill provides a framework for identifying, classifying, and lawfully processing criminal data within enterprise contexts.
Legal Framework — Art. 10
Text of Article 10
"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority."
Three Key Requirements
| Requirement | Description | Practical Implication |
|---|---|---|
| Official authority control | Processing must be supervised by or conducted under the authority of a public body with legal competence | Private sector organisations generally cannot process criminal data unless authorised by specific national law |
| National law authorisation | EU or Member State law must specifically authorise the processing and provide appropriate safeguards | Controllers must identify the specific legal provision authorising each criminal data processing activity |
| Comprehensive register prohibition | No private entity may maintain a comprehensive register of criminal convictions | Aggregating criminal records across individuals for database purposes requires official authority status |