# Standards and Regulatory References — Criminal Data Handling

## Primary Legislation

### GDPR — Regulation (EU) 2016/679

- **Article 10**: Processing of personal data relating to criminal convictions and offences or related security measures shall be carried out only under the control of official authority or when authorised by EU or Member State law providing appropriate safeguards. Comprehensive registers of criminal convictions kept only under official authority control.
- **Recital 19**: Member States should be able to maintain or introduce more specific provisions to adapt the application of the GDPR rules, including for processing criminal data.
- **Article 6(1)**: Lawful basis requirement applies cumulatively with Art. 10 — controller must satisfy both Art. 6 and Art. 10.

### UK Data Protection Act 2018

- **Section 10**: Enforcement of Art. 10 in UK law — processing of criminal conviction data must meet a condition in Schedule 1 Part 1 (processing conditions for employment, health, and research), Part 2 (substantial public interest conditions), or Part 3 (additional conditions).
- **Schedule 1, Part 1, Paragraph 1**: Employment, social security, and social protection — processing necessary for employment purposes where authorised by law.
- **Schedule 1, Part 2, Paragraph 6**: Regulatory requirements — processing necessary to comply with a requirement imposed by an enactment or rule of law, or for a purpose connected with the exercise of a function conferred by an enactment.
- **Schedule 1, Part 2, Paragraph 10**: Preventing or detecting unlawful acts — processing necessary for preventing or detecting an unlawful act where obtaining consent would prejudice the purpose.
- **Schedule 1, Part 2, Paragraph 14**: Preventing fraud — processing necessary for preventing fraud or a particular kind of fraud.
- **Section 11**: Appropriate policy document requirement — when relying on Schedule 1 conditions, the controller must have in place an appropriate policy document explaining compliance with the data protection principles.

### UK Rehabilitation of Offenders Act 1974

- **Section 4(1)**: Spent convictions and cautions shall not be proper grounds for dismissing or excluding a person from any office, profession, occupation, or employment.
- **Section 4(2)**: Spent convictions need not be disclosed in response to questions about criminal history, except in proceedings before a judicial authority.
- **Exceptions Order 1975** (as amended): Lists exempted professions and activities where spent convictions may be disclosed, including financial services, healthcare, education, and legal professions.

### Financial Services and Markets Act 2000 (UK)

- **Section 61**: Fitness and propriety — the FCA may determine that a person is not fit and proper to perform a controlled function. Criminal convictions are a relevant consideration.
- **FCA Handbook SUP 10C.10**: Fitness and propriety assessment criteria include criminal proceedings, convictions, and civil penalties.

## Case Law

### R (on the application of T) v Chief Constable of Greater Manchester Police — [2014] UKSC 35

- **Court**: UK Supreme Court
- **Holding**: The blanket disclosure of all criminal record information on enhanced DBS certificates, without any mechanism for filtering, was incompatible with Article 8 ECHR (right to respect for private life). Led to the introduction of the DBS filtering mechanism.
- **Significance**: Criminal data disclosure must be proportionate. Even where a legal basis exists, blanket disclosure without consideration of relevance and proportionality is unlawful.

### MM v United Kingdom — Application no. 24029/07 (ECtHR, 2012)

- **Court**: European Court of Human Rights
- **Holding**: The absence of a clear legislative framework governing the retention and disclosure of criminal record data violated Article 8 ECHR.
- **Significance**: National law authorising criminal data processing must contain sufficient safeguards, including clear rules on retention, access, and disclosure.

## Regulatory Guidance

### ICO — Criminal Offence Data Guidance (2021)

- **Reference**: ICO Guide to the UK GDPR, Section on Criminal Offence Data
- **Key Content**: Practical guidance on identifying criminal offence data, applicable Schedule 1 conditions, appropriate policy document requirements, and the relationship between Art. 10 and the Rehabilitation of Offenders Act 1974.

### EDPB Guidelines 8/2022 on the Identification of a Controller or Processor's Lead Supervisory Authority

- **Relevant Section**: Section 3.2 addresses data processing in the context of criminal law cooperation, confirming that criminal data processing by private sector entities is subject to national supervisory authority oversight under Art. 10.

### FCA Handbook — Fitness and Propriety (FIT)

- **FIT 2.1**: Honesty, integrity, and reputation — criminal convictions are relevant to determining fitness and propriety for controlled functions.
- **FIT 2.1.3**: Guidance on which types of convictions are relevant, including dishonesty, fraud, financial crime, and violence.