Criminal record check was not covered by the data protection rules

The Swedish Labour Court has confirmed that it was not a breach of the data protection rules to request and read an employee’s criminal record. In fact, the check was never covered by the GDPR. The employee shared a physical copy, which the company read but did not store or file. Instead, the copy was destroyed.

An auto mechanic worked for a company within the motor vehicle sector for a little more than a month. In that connection, he was requested to share a copy of his criminal record. He did not provide a copy until about a month later. Upon reviewing the record, the company found that he had been previously convicted of a crime. It destroyed the copy, and the employment ended soon after.

The Labour Court rejected the employee's claim for SEK 60,000 in compensation for the unlawful processing of his criminal record. The criminal record had been handled manually only. Such non-automated processing can only become subject to the GDPR when the data is included in a register. That was not the case here. The fact that the data originated from the policy authority's register did not change that assessment.

iuno's opinion

Although the conclusion is unsurprising, it serves as a reminder that not every piece of personal data necessarily becomes covered by the GDPR. It depends on how it’s handled in practice. However, even if the data protection rules do not apply, companies can still be liable under the employment rules. And if documentation affecting a job applicant or employee has been destroyed, it can be difficult to defend an HR decision later.

iuno recommends that, specifically for background checks, companies complete the process before hiring a candidate. If the check is not completed until later, it raises several questions under both data protection and employment law. Although that was not an issue raised in this case, it easily could have been.

[The Labour Court’s judgement of 25 March 2026 in case 27/2026]