[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2mLmy3ebQY_4arrr7V7jDyweQGO4tlezOeNsVa6OT-E":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":68},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"25c0fb4b-f79c-4462-af23-5e3bd5358e95","AEPD (Spain) - PS\u002F00372\u002F2025","aepd-spain-ps-00372-2025-a62200","← Older revision Revision as of 10:57, 11 November 2026 Line 82: Line 82: |Initial_Contributor=sf |Initial_Contributor=sf | | }} }}The DPA held that an employer failed to conduct a proper data protection impact assessment before implementing a biometric time-recording system for its employees, thereby violating [[Article 35 GDPR]]. The DPA declared the violation of [[Article 35 GDPR|Article 35 GDPR]] by a controller for implementing a biometric time-recording system for its employees without conducting a proper data protection impact assessment. == English Summary == == English Summary == Line 94: Line 91: During the proceedings, the controller did not present any evidence which demonstrated that one of the [[Article 9 GDPR|Article 9(2) GDPR]] exceptions were applicable and thus allowing for such processing. The controller submitted two data protection impact assessments (DPIA), one of which did not entail a date or signature by the controller. The second DPIA was a generic assessment that the processor conducted for all the time-and-attendance systems managed by it. It included both biometric and non-biometric systems and covered the specific case of fingerprint processing. During the proceedings, the controller did not present any evidence which demonstrated that one of the [[Article 9 GDPR|Article 9(2) GDPR]] exceptions were applicable and thus allowing for such processing. The controller submitted two data protection impact assessments (DPIA), one of which did not entail a date or signature by the controller. The second DPIA was a generic assessment that the processor conducted for all the time-and-attendance systems managed by it. It included both biometric and non-biometric systems and covered the specific case of fingerprint processing. === Holding === The DPA held that the controller did not undertake the necessary three-part assessment of suitability, necessity and strict proportionality of implementing such a system. In determining the necessity of the system, the controller did not assess whether there were less intrusive alternatives and neither did it weigh the benefits of the system against the potential harm to data subjects. However, because the controller replaced the system with a new card-based system, the DPA did not find a violation of [[Article 9 GDPR|Article 9(1) GDPR]] particularly regarding the necessity of applying an exemption to the prohibition of processing special category data in paragraph 2 of the provision. === Holding === Regarding the necessity for an exception to the prohibition of processing special category data under [[Article 9 GDPR|Article 9(1) GDPR]], the DPA dismissed the violation. Particularly, because the controller replaced the system with a new card-based system. The DPA held that the controller did not undertake the necessary three-part assessment of suitability, necessity and strict proportionality of implementing such a system. In determining the necessity of the system, the controller did not assess whether there were less intrusive alternatives and neither did it weigh the benefits of the system against the potential harm to data subjects. Furthermore, in light of the category of data being processed (biometric fingerprint data) the DPA stressed the necessity for conducting a proper risk assessment and subsequently implementing measures which mitigate against the established risks posed by the system. Furthermore, in light of the category of data being processed (biometric fingerprint data) the DPA stressed the necessity for conducting a proper risk assessment and subsequently implementing measures which mitigate against the established risks posed by the system. The DPA found that the controller implemented measures for established risks in a very vague, generic and abstract manner. The DPA further held that the controller lacked implementing security measures to prevent breaches or human error. Evidently, the DPA found that the measures provided by the controller were not specifically tailored to the circumstances and characteristics of the system. The DPA found that the controller implemented measures for established risks in a very vague, generic and abstract manner. The DPA further held that the controller lacked implementing security measures to prevent breaches or human error. Evidently, the DPA found that the measures provided by the controller were not specifically tailored to the circumstances and characteristics of the system. Therefore, the DPA held that whilst an impact assessment was conducted and deemed the system to be acceptable as regards the risks posed, it did not meet the requirements for necessity, suitability, and proportionality as required by the GDPR. Neither did the controller conduct a proper risk assessment and correspondingly implement the necessary measures to mitigate against the risks posed by the system. Therefore, the DPA held that whilst an impact assessment was conducted and deemed the system to be acceptable as regards the risks posed, it did not meet the requirements for necessity, suitability, and proportionality as required by the GDPR. Neither did the controller conduct a proper risk assessment and correspondingly implement the necessary measures to mitigate against the risks posed by the system.","Spain's Data Protection Agency (AEPD) found an employer violated Article 35 of the GDPR by implementing a biometric time-recording system without a proper data protection impact assessment (DPIA). The employer failed to demonstrate the necessity or proportionality of the system and did not explore less intrusive alternatives. Although the violation of Article 9 GDPR was dismissed due to the system's replacement with a card-based one, the AEPD emphasized the need for thorough risk assessments when processing sensitive biometric data.","Spain's AEPD fines employer for improper biometric data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00372\u002F2025&diff=53681&oldid=53580","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-11-11T10:57:14+00:00","2026-11-11T11:00:36.418731+00:00",7,[17,20],{"name":18,"type":19},"biometric time-recording system","product",{"name":21,"type":22},"fingerprint processing","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":67},[50],{"slug":51,"name":52,"problem":53,"products":54},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[55,61],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":56,"product_name":57,"url":59,"description":60},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":62,"product_name":63,"url":65,"description":66},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":69,"title":70,"body":71,"framework_refs":72,"framework_notes":78},"biometric-time-tracking-system-deployed-without-mandatory-dpia","Biometric Time-Tracking System Deployed Without Mandatory DPIA","A Spanish employer deployed a biometric fingerprint-based time-recording system without conducting a Data Protection Impact Assessment (DPIA) as required by GDPR Article 35, which is mandatory when processing special-category data like biometrics. The employer also failed to demonstrate that the system was necessary, proportionate, or that less privacy-invasive alternatives had been considered. This case underscores that deploying high-risk data processing systems without prior risk assessment exposes organisations to regulatory sanctions even if the system is later removed. It also highlights that privacy compliance must be built into system design decisions from the outset, not addressed retroactively.",[73,74,75,76,77],"GDPR Article 35","GDPR Article 9","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII","NIST SP 800-53 RA-3: Risk Assessment","NIST CSF 2.0 GV.RM-06: Risk tolerance and risk appetite",{"GDPR Article 9":79,"GDPR Article 35":80,"NIST SP 800-53 RA-3: Risk Assessment":81,"NIST CSF 2.0 GV.RM-06: Risk tolerance and risk appetite":82,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII":83},"Article 9 restricts the processing of biometric data as special-category data and requires a lawful basis, which the employer could not establish without prior necessity and proportionality analysis.","Article 35 explicitly requires a DPIA before processing biometric data at large scale or in systematic monitoring contexts — the exact obligation the employer failed to fulfil.","RA-3 requires organisations to conduct risk assessments before authorising information systems, which would have surfaced the privacy risks of biometric processing prior to deployment.","This category calls for governance structures that ensure risk — including privacy risk from sensitive data processing — is evaluated and approved before systems are deployed.","This control requires organisations to identify and comply with applicable privacy requirements — including impact assessments — before processing personal and sensitive data."]