GDPR Article 9 and AEPD Biometric Guidance, Special Categories

Regulation (EU) 2016/679, Art. 9; LOPDGDD, Art. 9

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 7 December 2018.

A sensitive categories rule binding public and private bodies.

As of 24 August 2026.

What it requires

Do not deploy a biometric employee time-and-attendance system in Spain on the Estatuto de los Trabajadores alone; the AEPD's own guidance holds that statute does not itself authorize biometric means, and a genuine General Data Protection Regulation (GDPR) Article 9(2) basis is needed.
Do not run a facial-recognition matching system against members of the public without a valid Article 9.2 exception; the AEPD categorically prohibited exactly that in its Mercadona enforcement and fined it EUR 2,520,000.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

LOPDGDD Article 9 supplies no independent biometric definition; it operates entirely within General Data Protection Regulation (GDPR) Article 9's special-category frame.

The AEPD's November 2023 guide on biometric presence-control systems (itself marked "en revision", under review, so treated as the AEPD's current stated position rather than a settled rule), concludes that current Spanish law contains no sufficiently specific statutory authorization for biometric employee time-and-attendance processing, applying the Tribunal Constitucional's STC 76/2019 reserva-de-ley standard.

The AEPD fined Mercadona EUR 2,520,000 (Resolucion PS/00120/2021) for a facial-recognition system matching shoppers against people with criminal convictions or restraining orders, holding the processing categorically prohibited under Article 9.1 with no Article 9.2 exception available.

When LexLint raises it

processes_biometrics
processes_voice
high_risk_decisions

Read the law

AEPD, "Guia sobre tratamientos de control de presencia mediante sistemas biometricos" (Nov. 2023)
AEPD Resolucion PS/00120/2021

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app