Criminal record certificate in Franchise Agreements: Permissibility of the request?

1. Introduction

Franchise agreements often contain a clause according to which the franchisee must present his criminal record certificate to the franchisor if necessary and the certificate of good conduct must not contain any negative entries. For example, such a clause could read:

“(1) Criminal record certificate. The FRANCHISEE must have a clean European Criminal Record Certificate for the term of the Agreement and provide proof of itimmediately upon request by the FRANCHISOR.”

There is a serious risk that such a clause violates data protection law due to the lack of relevant special legal permission standards in German and EU law regarding the requirement for criminal record certificate.

2. Facts

The criminal record certificate contains personal data about criminal convictions and offenses, the processing of which is subject to particularly high requirements under Article 10 Paragraph 1 Sentence 1 of the General Data Protection Regulation (“GDPR”). They may only be processed if there is a specific legal basis for this that “provides for appropriate guarantees for the rights and freedoms of the data subjects”. However, as far as can be seen, there is no legal basis under German law:

• For employees, Section 26 of the German Federal Data Protection Act (“BDSG”) only contains regulations for the processing of data about crimes committed by employees.
• As franchisees are not employee, Section 26 BDSG is not applicable to franchisees.

The EU framework decision (2009/315/JI) on the European Criminal Record Certificate does not help either. According to Article 9 (2) of the Decision, personal data transmitted for purposes other than criminal proceedings may only be processed in accordance with national law. This brings us back to the starting point. Unfortunately, there is no national legal basis.

It is questionable whether it is permissible to simply take note of the criminal record certificate without saving the personal data it contains in a file system. However, this creative approach is anything but legally secure.

As far as can be seen, there seems to be no German decision regarding this matter.  The Spanish data protection authority Agencia Española de Protección de Datos (“AEPD”) has already imposed a fine of EUR 2 million on Amazon (see ZD-Aktuell 2022, 01080). Amazon had required self-employed drivers to have a criminal record certificate without entries. However, in the opinion of the AEPD, this design was not GDPR compliant:

• The AEPD was of the opinion that requesting a criminal record certificate, even as a “negative certificate” (and therefore without corresponding entries), constituted the processing of data about criminal convictions and offenses within the meaning of Art. 10 GDPR and therefore only with consent of the person concerned may be carried out under official supervision or may be based on a special national legal basis.
• There was no legal basis in the form of a national law requiring transport personnel to have a criminal record certificate without entries. In fact, not even state authorities would require this when issuing transport licenses.
• Consent was also ruled out because it was not voluntary (it was not possible to progress further in the application process without consent).
• The AEPD rejected the argument that the logistics company had a legitimate interest in protecting the safety and trust of its customers through this application requirement. Such an argument would only be relevant in accordance with Art. 6 Para. 1 lit. f GDPR, but even if Art. 6 were applicable (and not Art. 10 GDPR), the obligation to present a negative certificate would exceed the limits of what is reasonable.

3. Conclusion

Instead of a criminal record certificate, the franchisor's right to ask questions might be permissible as a milder means. A franchisor may specifically ask about previous convictions that are relevant to the specific license relationship, instead of simply looking at the criminal record (which can also reveal previous convictions that are irrelevant to the relationship).

In the franchise agreement, the clause could then be formulated in such a way that the franchisee assures that he has not been convicted of any criminal offenses that would make him appear unreliable to carry out the franchise business (e.g. breach of trust, theft, criminal offenses in connection with this Youth Protection Act). For example, the clause could read as follows:

“No Criminal record. The FRANCHISEE confirms having no criminal record which would make the FRANCHISEE unreliable to operate the Store (e.g. for fraud, theft, offences relating to the Youth Protection Act).”