AEPD (Spain) - PS/00372/2025
Spain's AEPD fines employer for improper biometric data processing.
Spain's Data Protection Agency (AEPD) found an employer violated Article 35 of the GDPR by implementing a biometric time-recording system without a proper data protection impact assessment (DPIA). The employer failed to demonstrate the necessity or proportionality of the system and did not explore less intrusive alternatives. Although the violation of Article 9 GDPR was dismissed due to the system's replacement with a card-based one, the AEPD emphasized the need for thorough risk assessments when processing sensitive biometric data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run biometric time-recording system?
Get an email when a new story names biometric time-recording system, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish employer deployed a biometric fingerprint-based time-recording system without conducting a Data Protection Impact Assessment (DPIA) as required by GDPR Article 35, which is mandatory when processing special-category data like biometrics. The employer also failed to demonstrate that the system was necessary, proportionate, or that less privacy-invasive alternatives had been considered. This case underscores that deploying high-risk data processing systems without prior risk assessment exposes organisations to regulatory sanctions even if the system is later removed. It also highlights that privacy compliance must be built into system design decisions from the outset, not addressed retroactively.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.