SpainGDPR Article 9 and LOPDGDD Article 9, Special Categories of Personal Data in Spain
Agencia Española de Protección de Datos, guide on biometric presence-control systems (November 2023)
Guidance, not a law: the Spanish Data Protection Agency's reading of GDPR Article 9, Special Categories of Personal Data. It binds nobody by itself; the law it reads does.
Guidance on a sensitive categories rule, addressed to public and private bodies.
- Excludes recording-derived identifiers
- No
- Instrument type
- guidance published by a regulator
- Audit expectation
- none
What the regulator expects
- Do not deploy a biometric employee time-and-attendance system in Spain on the Estatuto de los Trabajadores alone; the AEPD's own guidance holds that statute does not itself authorize biometric means, and a genuine General Data Protection Regulation (GDPR) Article 9(2) basis is needed.
- Do not run a facial-recognition matching system against members of the public without a valid Article 9.2 exception.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The AEPD guide of November 2023 on biometric presence-control systems is itself the regulator guidance on this duty and finds no specific statutory authorization in Articles 20.3 and 34.9 of the Estatuto de los Trabajadores.
- As of
- Case link
- https://hj.tribunalconstitucional.es/es/Resolucion/Show/25942
- Guidance link
- https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903_video_devices_en_0.pdf
- Case citation
- Sentencia 76/2019, de 22 de mayo, del Pleno del Tribunal Constitucional (recurso de inconstitucionalidad 1405-2019)
- Guidance body
- European Data Protection Board
- Open questions
- Can a collective agreement under Article 9(2)(b) of the GDPR supply the specific authorization for biometric time-and-attendance control of employees in Spain that the AEPD finds missing in Articles 20.3 and 34.9 of the Estatuto de los Trabajadores, and what must it say to meet the necessity and proportionality tests?
What it makes you log
Logging duty
The guide states that a controller must be able to demonstrate that the data protection impact assessment was passed and to produce the documentation behind its results; it names no log format, no audit and no one entitled to ask for the documentation.
- Kind
- Implicit
- As of
- Provision
- AEPD guide on biometric presence-control systems (November 2023), section VIII.B, applying Regulation (EU) 2016/679, Art. 5(2)
- Trigger
- personal_data_processing
What this law does
General Data Protection Regulation (GDPR) Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
The Spanish data protection authority's (AEPD) reading of GDPR Article 9 for biometric data is listed with that article as guidance. LOPDGDD Article 9 supplies no independent biometric definition; it operates entirely within GDPR Article 9's special-category frame.
The AEPD's November 2023 guide on biometric presence-control systems concludes that current Spanish law contains no sufficiently specific statutory authorization for biometric employee time-and-attendance processing, applying the Tribunal Constitucional's STC 76/2019 reserva-de-ley standard.
In Resolución PS/00120/2021 the AEPD closed its sanction procedure against Mercadona, S.A. over a facial-recognition system in its stores after Mercadona paid EUR 2,520,000, the proposed fine reduced by 20 percent for voluntary payment. The proposal that the resolution transcribes found that no Article 9.2 circumstance was shown, so that under Article 9.1 of the GDPR the processing was prohibited. The provisions and decisions this entry describes took effect on different days.
Back to the example · Lint your app
Page updated .