Article 10: Processing of personal data relating to criminal convictions and offences

Praxikon tracks Article 10 (Processing of personal data relating to criminal convictions and offences) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIn force since 25-05-2018

Official text

Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 6: Lawfulness of processing

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (3)

7 March 2024 · C-740/22 · CJEU
Endemol Shine Finland
Orally disclosing information about criminal proceedings is processing if the information is or will be in a filing system. Such data may not be disclosed to anyone without the requester showing a specific interest.
22 June 2021 · C-439/19 · CJEU
Latvijas Republikas Saeima
Penalty points for traffic offences are criminal offence data. A law that makes them available to anyone without a specific interest, or passes them to businesses for re-use, breaches the GDPR.
24 September 2019 · C-136/17 · CJEUDirective 95/46
GC and Others v CNIL
The prohibition on processing special category and criminal data also applies to a search engine, within its role when assessing a de-referencing request. For outdated reports on criminal proceedings, the current situation must appear first in the results.

Line of case lawSpecial categories of data

When do data reveal something sensitive?

Lindqvist (2003)A foot injury is already health data.
GC and Others v CNIL (2019)The prohibition also applies to search engines handling de-referencing requests.
OT v Vyriausioji tarnybinės etikos komisija (2022)Indirect revelation, such as through a partner's name, also counts.
Meta Platforms v Bundeskartellamt (2023)Browsing on sensitive sites can yield special category data.
Krankenversicherung Nordrhein (2023)Besides an Article 9 exception, an Article 6 basis is always needed.
Lindenapotheke (2024)Online orders for pharmacy medicines are health data.
Schrems v Meta Platforms (2024)A public statement about one's orientation does not free up other data on it.
Russmedia Digital (2025)A marketplace must screen ads with sensitive data in advance.

Checked on 5 November 2026

← Art. 9: Processing of special categories of personal data Art. 11: Processing which does not require identification →

Connections

Case law

Legal Newsdesk Sweden: paid online publication of criminal convictions is in principle not journalism, national exemptions may not switch off the GDPR
2026-07-09 · final, Hof van Justitie van de EU (Vijfde kamer), ND tegen Legal Newsdesk Sweden AB (voorheen Garrapatica AB)

Enforcement and fines

Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
2024-11-26 · final, Autoriteit Persoonsgegevens