The criminal record certificate that says nothing: Spain annuls two million

Reading the headline, the temptation is to conclude that the certificate may now be requested. That is not what the judgment says. The court removed ONE obstacle — automatic classification as Article 10 data, which requires a reinforced legal basis — and left everything else standing. The certificate remains personal data, and asking for it remains processing that needs a legal basis and must pass the necessity test.

• The document still contains personal data: name, date of birth, and the very fact that this person was subjected to a check.
• A legal basis under Article 6 is required, and for a private employer the candidate's consent does not hold: in a recruitment relationship it is not freely given.
• The necessity test remains: for a specific role the certificate may be proportionate; for every position indiscriminately it is not.
• National law matters more than the judgment: in Italy, Article 2-octies of Legislative Decree 196/2003 requires a legislative provision for Article 10 data, and asking candidates for the certificate is allowed only where a law provides for it.

And there is the other side, which a DPO must keep in mind. The opposite view exists and has been argued forcefully: a clean certificate still says something about the person — precisely, that they have no convictions — and that is information about their judicial past, even when the box is empty. It is the position from which the Spanish fine arose, and the one that guides practice today in several jurisdictions, Italy among them.

The practical question to take to the client is the same as before the judgment, and there is only one: for which role, and under which provision. If both have a written answer, the request holds under any reading of Article 10. If the answer is that they ask everyone because it is safer, safety lies precisely on the other side.