CJEU 21/04/2026: criminal records and GDPR Article 10

Summary — On 21 April 2026 (case C‑769/22), the CJEU struck down a Hungarian law that broadly opened access to criminal records without adequate safeguards, breaching GDPR Article 10 and Article 8(2) of the Charter. Immediate consequence in Luxembourg: any third‑party access to criminal data must rely on a precise legal basis, be under public control, and include concrete safeguards. See the press release, the case page, and the full judgment on EUR‑Lex. A summary also appears in the Monthly case‑law digest.

The case

The Court censured a mechanism granting electronic access to criminal records of persons convicted of sexual offences against minors, based on a mere self‑declaration of necessity by “authorised persons”. The term “authorised person” was deemed overly vague and the lack of ex ante control incompatible with foreseeability and proportionality. Key principle: “any comprehensive register of criminal convictions may be kept only under the control of a public authority”, and third‑party access requires a clear legal basis with appropriate safeguards (see the EUR‑Lex summary).

Legal reasoning

• Applicable rule. GDPR Article 10 requires that processing of data relating to criminal convictions/offences be carried out under the control of a public authority or be authorised by EU or Member State law providing “appropriate safeguards”. The Court interprets this in light of GDPR Article 5 principles and Article 6(1)(e), but insists on concrete material and procedural safeguards (see the full judgment).
• Required safeguards. Defects found: indeterminate definition of “authorised persons”, absence of ex ante review by a competent authority, and insufficient measures to limit the interference to what is strictly necessary (cf. April 2026 digest).
• Article 6(1)(e) GDPR. Access may serve a public‑interest task only where the law clearly defines purposes, actors, access conditions and controls, and embeds Article 10‑level safeguards. Otherwise, third‑party access remains unlawful, even if the goal (child protection, crime prevention) is legitimate.
• Alignment with CNPD. In Luxembourg, the CNPD reiterates that criminal data may be processed only under public control or under a law with appropriate safeguards; it also stresses specific record‑keeping for such processing. See GDPR – Chapter II and Record of processing.

What changes in practice

• Hiring and HR. Private employers cannot consult or store criminal data without a specific, precise legal basis with safeguards (purposes, actors, logging, retention, data subject rights). Otherwise, checking a B3 extract must be strictly minimised (view only, no copy, ultra‑short retention) and documented, in line with your GDPR documentation and CNPD guidance.
• Partners and vendors. Systematic access by a processor (fit‑and‑proper checks) requires a clear legal basis, ex ante control, limited scope, logging, and data subject information. The CJEU rejects any self‑declaratory approach by a third party claiming to be “authorised” without public oversight.
• Regulated sectors. Where sectoral laws mandate checks (e.g., sensitive roles, finance/AML), access may rely on Article 6(1)(c) or (e) GDPR only if the law provides Article 10‑grade safeguards. Internal policies cannot fill a legal gap.
• Governance and accountability. Record every criminal‑data operation in your Article 30 register, detailing legal basis, purposes, competent public recipients, retention, and controls in line with CNPD. An external DPO mandate can steer compliance and ongoing evidence.

Common pitfalls

1. Treating legitimate interest as a catch‑all. Article 6(1)(f) is not enough: under Article 10, you need public control or a law with safeguards (see CJEU C‑769/22).
2. Letting a vendor self‑authorise. Delegating necessity/proportionality assessments without review by a competent authority mirrors the illegality found in Hungary (cf. CJEU digest).
3. Vague “authorised persons”. Broad categories without named/functional criteria, clear clearances, and logging breach foreseeability and minimisation.
4. Keeping copies without necessity. Archiving B3 scans “just in case” exceeds necessity: prefer in‑situ verification, timestamping, and prompt deletion unless a precise legal obligation applies (see Article 10 pages).
5. Skipping information and rights. Even with a legal basis, comply with GDPR Articles 13/14, 15, 16–18 and 21; your privacy notice must state the specific legal basis, public recipients, retention, and redress routes. A Luxembourg DPO can structure these notices.

Official sources

• Court of Justice of the European Union, Press Release, 21 April 2026, C‑769/22. curia.europa.eu
• CURIA – Case page C‑769/22. curia.europa.eu
• EUR‑Lex – Full judgment (EN). eur-lex.europa.eu
• CURIA – Monthly case‑law digest, April 2026. curia.europa.eu
• CNPD Luxembourg – GDPR Chapter II. cnpd.public.lu
• CNPD Luxembourg – Record of processing. cnpd.public.lu

Operational note — As of 22 October 2026, judgment C‑769/22 is final. Luxembourg organisations must verify, processing by processing, the existence of a precise sectoral legal basis with Article 10‑grade safeguards; otherwise, restrict access to what is strictly necessary, ensure public control, and document evidence.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.