| name | criminal-data-handling |
| title | Criminal Conviction and Offence Data Handling — GDPR Art. 10 |
| description | Handles GDPR Art. 10 criminal conviction and offence data classification including official authority requirements, national law derogations, and comprehensive register restrictions. Covers controller obligations for criminal background checks and offence records. Keywords: criminal data, Art 10, conviction data, offence records, criminal background, DBS check. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/criminal-data-handling |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Criminal Conviction and Offence Data Handling — GDPR Art. 10
Overview
Article 10 of the GDPR establishes a separate regime for processing personal data relating to criminal convictions and offences, or related security measures. Unlike Art. 9 special category data which is subject to a general prohibition with listed exceptions, Art. 10 permits processing only under the control of official authority, or when authorised by EU or Member State law providing appropriate safeguards. The maintenance of a comprehensive register of criminal convictions is restricted to processing under the control of official authority. This skill provides a framework for identifying, classifying, and lawfully processing criminal data within enterprise contexts.
Legal Framework — Art. 10
Text of Article 10
"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority."
Three Key Requirements
| Requirement | Description | Practical Implication |
|---|
| Official authority control | Processing must be supervised by or conducted under the authority of a public body with legal competence | Private sector organisations generally cannot process criminal data unless authorised by specific national law |
| National law authorisation | EU or Member State law must specifically authorise the processing and provide appropriate safeguards | Controllers must identify the specific legal provision authorising each criminal data processing activity |
| Comprehensive register prohibition | No private entity may maintain a comprehensive register of criminal convictions | Aggregating criminal records across individuals for database purposes requires official authority status |
Relationship to Art. 6 Lawful Basis
Art. 10 operates as an additional layer on top of Art. 6. A controller processing criminal data must satisfy BOTH:
- A lawful basis under Art. 6(1) — typically Art. 6(1)(c) (legal obligation) or Art. 6(1)(f) (legitimate interests, where national law permits)
- One of the Art. 10 conditions — official authority control OR national law authorisation with appropriate safeguards
Relationship to Art. 9
Criminal data is NOT listed in Art. 9(1) as a special category, but Member States may impose Art. 9-equivalent protections. Some data may fall under both Art. 9 and Art. 10 — for example, data about a criminal offence that also reveals racial profiling concerns or political activity.
