General Data Protection Regulation

Article 10

Processing of personal data relating to criminal convictions and offences

Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

Holdings

/
C-474/2414 Jul 2026

AR and Others v Österreichische Datenschutzbehörde and Others

4. Article 10 of Regulation 2016/679

must be interpreted as not applying to the processing of personal data relating to offences provided for by national anti-doping legislation and to the sanctions imposed for such offences, since, irrespective of the classification of those offences under national law, those offences and those sanctions are directed only at a particular group of persons, namely athletes, in the same way as disciplinary sanctions whose purpose is to ensure that the members of a group comply with rules of conduct specific to that group.

C-740/227 Mar 2024

Endemol Shine Finland Oy

The GDPR, in particular Article 6(1)(e) and Article 10, precludes orally disclosing data on a natural person's criminal convictions contained in a court's filing system to any person for the purpose of public access to official documents, where the requester need not show a specific interest in obtaining those data. It is irrelevant whether the requester is a commercial company or a private individual.

C-439/1922 Jun 2021

Proceedings brought by B

Article 10 of Regulation (EU) 2016/679 applies to the processing of personal data relating to penalty points imposed on drivers of vehicles for road traffic offences.

C-439/1922 Jun 2021

Proceedings brought by B

Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10, precludes national legislation that requires the public body responsible for the register of penalty points imposed on drivers of vehicles for road traffic offences to make those data accessible to the public, where the person requesting access does not have to establish a specific interest in obtaining them.

C-439/1922 Jun 2021

Proceedings brought by B

Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10, precludes national legislation that authorises the public body responsible for the register of penalty points imposed on drivers of vehicles for road traffic offences to disclose those data to economic operators for re-use.