[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fChFhwomN5_JqSvH7eRmWlnIVRYJFhewh44V1zWHx_t0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"47c3a027-8ab3-4b28-94fb-ebcf564aed32","biometric-time-tracking-system-deployed-without-mandatory-dpia","25c0fb4b-f79c-4462-af23-5e3bd5358e95","Biometric Time-Tracking System Deployed Without Mandatory DPIA","A Spanish employer deployed a biometric fingerprint-based time-recording system without conducting a Data Protection Impact Assessment (DPIA) as required by GDPR Article 35, which is mandatory when processing special-category data like biometrics. The employer also failed to demonstrate that the system was necessary, proportionate, or that less privacy-invasive alternatives had been considered. This case underscores that deploying high-risk data processing systems without prior risk assessment exposes organisations to regulatory sanctions even if the system is later removed. It also highlights that privacy compliance must be built into system design decisions from the outset, not addressed retroactively.","**Before deployment:**\n- Conduct a formal DPIA before implementing any system that processes biometric or other special-category personal data.\n- Evaluate and document less privacy-invasive alternatives (e.g., card-based, PIN-based systems) and justify why biometric processing is strictly necessary.\n\n**Governance and oversight:**\n- Establish a mandatory privacy review gate in the IT and HR procurement process so no high-risk system goes live without DPO sign-off.\n- Maintain a record of processing activities (RoPA) that flags any processing of Article 9 special-category data for automatic DPIA triggers.\n\n**Long-term improvements:**\n- Train HR, facilities, and procurement staff on GDPR requirements for biometric data so they recognise when a DPIA is legally required.\n- Implement a periodic review cycle to reassess the necessity and proportionality of all existing special-category data processing systems.",[12,13,14,15,16],"GDPR Article 35","GDPR Article 9","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII","NIST SP 800-53 RA-3: Risk Assessment","NIST CSF 2.0 GV.RM-06: Risk tolerance and risk appetite",{"GDPR Article 9":18,"GDPR Article 35":19,"NIST SP 800-53 RA-3: Risk Assessment":20,"NIST CSF 2.0 GV.RM-06: Risk tolerance and risk appetite":21,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII":22},"Article 9 restricts the processing of biometric data as special-category data and requires a lawful basis, which the employer could not establish without prior necessity and proportionality analysis.","Article 35 explicitly requires a DPIA before processing biometric data at large scale or in systematic monitoring contexts — the exact obligation the employer failed to fulfil.","RA-3 requires organisations to conduct risk assessments before authorising information systems, which would have surfaced the privacy risks of biometric processing prior to deployment.","This category calls for governance structures that ensure risk — including privacy risk from sensitive data processing — is evaluated and approved before systems are deployed.","This control requires organisations to identify and comply with applicable privacy requirements — including impact assessments — before processing personal and sensitive data.","published","2026-11-11T11:20:22.670568+00:00","2026-11-11T11:20:22.657+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00372\u002F2025&diff=53681&oldid=53580","aepd-spain-ps-00372-2025-a62200","AEPD (Spain) - PS\u002F00372\u002F2025",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45],{"slug":46,"name":47,"problem":48},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]