Criminal background check

Answer:

If you or the company are in one of the EU Member States then the EU GDPR is applicable. This means that the company would need a legal ground to conduct the background check. Because, usually background checks reveal sensitive or criminal conviction data, the most common legal ground used in this type of situations is consent. So the hiring company should have asked for your consent before performing the background check. Moreover, they should have also explained to you via a privacy notice why the background check is needed, what data they would be processing about you, how long they would keep it as well as what are your rights as regards to your data. If the company hasn't done so, then they have indeed breached the provisions of the EU GDPR.
If you wa nt to find out more about consent, check out this article: Four main questions for obtaining and managing data subjects’ consent under GDPR (https://advisera.com/eugdpracademy/knowledgebase/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/).