Spain’s data protection regulator clarifies biometric risk and necessity

SC Media reports that the regulator distinguished between one-to-one facial verification and one-to-many facial recognition, noting that persistent databases introduce unique data protection concerns.[1]Biometric Update reports that the regulator published the opinion in response to a query raised by an unnamed company.[2]SC Media says the AEPD emphasized that necessity only applies when no equally effective, less intrusive alternative exists.[1] According to Biometric Update, the AEPD found that a less intrusive alternative may be desirable, but is not sufficient to move from necessity to explicit consent[2] as the legal basis.Biometric Update reports that a non-biometric alternative need not be identical and can have "reasonable differences in speed, comfort or operation."[2] SC Media says the regulator suggested that methods such as qualified electronic signatures or digital identification could serve as viable alternatives.[1]CEA Digital Law writes that this departs from the stricter reading of the AEPD's guidance on biometric attendance control in employment, issued in November 2023[3]. It also reports that the AEPD stresses that this is neither a general authorisation nor a certification of the technology.[3]According to Biometric Update, the AEPD levied a 950,000 euro (roughly US$1.1 million) fine against Yoti in March for failing to offer a non-biometric alternative for authentication.[2] The outlet reports that Yoti responded that there is no alternative that provides adequate security, degree of assurance and customer convenience, pulling its app from the country.[2]Biometric Update also notes that the Digital Omnibus proposal the EU is considering would introduce an exception to GDPR's Article 9 for biometric identity verification in certain situations.[2]