September 28, 2020

Volume X, Number 272

September 28, 2020

Subscribe to Latest Legal News and Analysis

ICO Consults on the Processing of Criminal Convictions Personal Data

The ICO has recently launched a call for views on criminal convictions and offences data, or related security measures, under Article 10 of the GDPR. It is specifically consulting on market practice and understanding in this area.

The Legal Framework

The legal framework surrounding the collection and use of criminal convictions data is complex and in certain sectors, there are additional hurdles to overcome.

The legal framework is mainly set out in Articles 6 and 10 of the GDPR, as well as the UK Data Protection Act 2018, as the GDPR allows Member States to make derogations in this area. For example, the UK has a specific derogation regarding the processing of criminal convictions data for employment, social security and social protection purposes. Processing in reliance upon this derogation requires the controller to put in place (and maintain) an appropriate policy document.

Controllers must also follow the key data protection principles set out in the GDPR, in particular, data minimisation, accuracy and storage limitation.

The ICO Survey

Aware of the fact that a complex legislative framework governs the processing of Article 10 data, and perhaps in preparation for detailed guidance on how to apply conditions for processing criminal records data, the ICO’s consultation aims to assess if gaps exist in data controllers’ awareness and understanding of the relevant data protection requirements.

Key questions asked by the ICO in the form of a survey on the subject include:

  1. For what purpose(s) do you process Article 10 data?
  2. How confident are you about making decisions when processing Article 10 data?
  3. What are they key challenges you face when processing Article 10 data?
  4. Which data protection requirements are you aware of when processing Article 10 data?
  5. What would assist further understanding of data protection requirements when processing Article 10 data?
  6. Which organisations do you ask when you have a query about processing Article 10 data?

The survey will remain open until Friday 28 February 2020. If you are interested in responding, please use this link.


© Copyright 2020 Squire Patton Boggs (US) LLPNational Law Review, Volume X, Number 28


About this Author

Emaa Yaltaghian Squire PB Data Privacy Lawyer

Emma Yaltaghian is a member of our Data Privacy & Cybersecurity team. Emma advises clients on all aspects of compliance with the EU GDPR and UK Data Protection Act 2018, as well as the EU ePrivacy rules.

Emma also assists the EMEA Communications Practice by providing regulatory advice.

Emma has successfully project managed numerous data protection compliance projects, including conducting detailed gap analysis and remediation.

Emma has advised clients in data breach scenarios, including cross-border data breaches. She has also advised on whether or not notification...

+44 20 7655 1515