No. The provision applies to processing "based on Article 6(1)", so the controller must first identify a legal basis in Article 6(1) and then, in addition, satisfy the Article 10 condition of official control or a legal authorisation with safeguards. A private controller consequently needs both elements before handling conviction or offence data.

The provision covers personal data relating to criminal convictions and offences and to related security measures. The words "relating to" and the separate mention of offences indicate a scope wider than final convictions alone, but the text does not spell out how far pre-conviction information such as suspicions is included, so that question must be resolved by interpretation of the phrase in context.

No. The second sentence of Article 10 provides that any comprehensive register of criminal convictions shall be kept only under the control of official authority, and this rule admits no exception through a mere legal authorisation of the kind that permits other processing under the first sentence.

Criminal conviction and offence data are not listed among the special categories in Article 9(1); Article 10 establishes a distinct regime built on official control or legal authorisation rather than on a catalogue of exceptions like Article 9(2). Other provisions of the Regulation nevertheless treat the two categories as comparably sensitive, for example Article 35(3)(b) on impact assessments and Article 37(1)(c) on the designation of a data protection officer.