Nothing illustrates the legal limits of a background check in Spain better than real cases in which the Spanish Data Protection Agency has imposed sanctions. These are not theoretical warnings: they are fines already paid by companies operating in the Spanish market.

Case 1: Amazon Road Transport Spain — EUR 2,000,000

In case PS-00267-2020, the AEPD fined Amazon Road Transport Spain EUR 2,000,000 for requiring its delivery drivers to provide criminal record certificates without a legal provision authorising such a requirement for that type of role. The decision underlines a central principle of this entire framework: criminal-record data are a special category, and neither the employee’s consent nor the stated intention to “verify suitability” is sufficient to legitimise their processing without an express legal authorisation.

Case 2: ASNEF check on a candidate — up to EUR 70,000

In case EXP202103933, the AEPD imposed a fine of EUR 70,000 (reduced to EUR 42,000 for voluntary payment) on a company that consulted the ASNEF debtor database for a candidate applying for a lawyer position before the interview. The case confirms that Article 20.1(e) of the LOPDGDD also protects candidates — not only ordinary credit consumers — against creditworthiness checks without a legal basis.

Case 3: security guards — Supreme Court Judgment 435/2022

Although this is not an AEPD proceeding but a Supreme Court judgment, the ruling of 12 May 2022 confirms the same principle from another angle: even in a sector with explicit legal authorisation, such as private security, the contracting company may not obtain the candidate’s criminal records on its own. That verification is an administrative function reserved for the Ministry of the Interior.

The common pattern in all three cases

In all three cases, the common element is not bad faith on the part of the company, but the absence of a specific legal basis before requesting or consulting the data. None of the three companies intended to break the law; all incorrectly assumed that the apparent usefulness or relevance of the information justified obtaining it.

The practical lesson

Before requesting any sensitive candidate data — criminal, financial or special-category data — the question should always be the same: is there a legal rule that authorises me to request this information for this specific role? If the answer is not a clear and documentable “yes”, the risk of sanctions is real and, as these cases demonstrate, can range from tens of thousands to millions of euros.

See also: Human Risk and Background Checks in Spain: The 2026 Reference Guide, GDPR, LOPDGDD and AEPD: The Legal Framework for Background Checks in Spain and ASNEF, RAI and the Public Insolvency Register: What an Employer in Spain May (and May Not) Check