On 5 November 2020, the UK’s DPA (“ICO UK”) published guidance on criminal offense data.
Among other aspects, ICO UK clarifies the meaning of the “under the control of official authority” and “comprehensive register of criminal convictions” notions.
In particular, this guidance emphasizes that if an organization is processing criminal offense data, it must still identify a lawful basis for such processing under Article 6 of the GDPR, as well as a condition for processing criminal offense data under Article 10 of the GDPR.
The guidance is available here.
