The paper addresses some concerns recently raised within the EU Parliament, regarding an alleged commercial use of the European Criminal Register Information System (ECRIS) by a company providing employers with speedy and efficient access to employees' criminal records. Commercial practices of this kind take advantage from the fragmentation of European data protection law fostered by the opening clauses enshrined in the GDPR. As it is, the lack any explicit guideline from the EU legislator concerning the delimitation of the geographical scope of application of national GDPR-complementing legislations has been conducive to a situation of widespread legal uncertainty in relation to the reach and remit of the Member States' laws, including the eventual prohibitions of forced access to criminal records for employment purposes set out therein.