Art. 10 GDPR · Chapter II: Principles
Article 10 GDPR: Processing of personal data relating to criminal convictions and offences
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Personal data relating to criminal convictions and offences may be processed only under the control of official authority or when authorised by Union or Member State law with appropriate safeguards. A comprehensive register of criminal convictions may be kept only under the control of official authority.
Official text
Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others
Judgment of 14 July 2026ECLI:EU:C:2026:579
Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.
- C-439/19, Proceedings brought by B
Judgment of 22 June 2021ECLI:EU:C:2021:504
Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse.
Related (earlier law or other instruments)
- C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:773
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.
Fines
Amounts are shown in the currency in which the fine was imposed.
- Google LLC: SEK 75,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 10 March 2020Appeal status: reduced
Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.