Criminal convictions data (Article 10) & processing without identification (Article 11)
Article 10 data - criminal convictions, offences and related security measures - needs greater protection but is NOT a special category under Article 9. It may be processed only under the control of official authority or where authorised by EU/member-state law with appropriate safeguards; a comprehensive register can only be kept under official authority. All other GDPR rules (including Article 6) still apply. Article 11 says if a controller does not require identification of a subject, it need not acquire extra data just to comply - and certain data-subject-rights obligations fall away unless the subject supplies identifying information.
| Point | Criminal convictions (Art 10) | Special-category data (Art 9) |
|---|---|---|
| Is it 'sensitive' under Art 9? | No - separate regime | Yes |
| Permitted route | Official authority control OR authorised by EU/member-state law with safeguards | One of the ten Article 9 conditions |
| Comprehensive register | Only under official authority | n/a |
| Article 6 basis still needed? | Yes | Yes |
If purposes do not (or no longer) require identifying the subject, the controller need not acquire or keep extra data just to comply, and certain data-subject-rights obligations don't apply - unless the subject provides additional information enabling identification, which reverses the assumption.
Key terms - quick answers
What is “Article 10”?
What is “Article 11”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.