{"id":125231,"date":"2026-11-05T10:18:05","date_gmt":"2026-11-05T09:18:05","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=125231"},"modified":"2026-11-05T10:18:10","modified_gmt":"2026-11-05T09:18:10","slug":"aepd-less-intrusive-alternative-biometrics","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/fr\/blog\/aepd-less-intrusive-alternative-biometrics\/","title":{"rendered":"AEPD: a less intrusive alternative does not by itself rule out biometrics"},"content":{"rendered":"<div lang=\"en\">\n<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>On 3 November 2026 the AEPD published a reply to a query on 1:1 facial verification of customers, classed as strategically important.<\/li>\n<li>A less intrusive alternative only excludes biometrics if it is equally effective against the specific risk.<\/li>\n<li>Explicit consent can be a valid basis where a genuine non-biometric option exists, which is a separate question from the necessity test.<\/li>\n<\/ul>\n<\/div>\n<p>Spain&rsquo;s data protection authority, the Agencia Espa\u00f1ola de Protecci\u00f3n de Datos (AEPD), has refined its approach to biometrics: the existence of a less intrusive alternative does not, on its own, make biometric processing unnecessary. It set this out in a <a href=\"https:\/\/www.aepd.es\/informes-y-resoluciones\/criterios-juridicos-aepd\/analisis-sobre-necesidad-libertad-de-eleccion-datos-biometricos\" target=\"_blank\" rel=\"noopener\">reply published on 3 November 2026<\/a>, which matters for any Spanish business using or considering such systems.<\/p>\n<h2>The case and the new approach to necessity<\/h2>\n<p>A company asked about using one-to-one facial verification to check customers&rsquo; identity remotely. Until then it relied on a non-biometric process based on documents, video and visual comparison by specialist staff. The AEPD found that, on the documentation provided, the planned processing could pass the tests of suitability, necessity and proportionality on an ex ante basis.<\/p>\n<p>The key lies in necessity. A less intrusive alternative displaces biometrics only if it meets the same need with equivalent effectiveness, for example against impersonation or document manipulation. Data protection law, the AEPD says, does not oblige a controller to keep a technology merely because it is less intrusive.<\/p>\n<p>This departs from the stricter reading of the AEPD&rsquo;s guidance on biometric attendance control in employment, issued in <a href=\"https:\/\/www.cuatrecasas.com\/es\/spain\/propiedad-intelectual\/art\/novedades-uso-datos-biometricos-control-acceso\" target=\"_blank\" rel=\"noopener\">November 2023<\/a>, under which a lower-risk option made biometrics unnecessary.<\/p>\n<h2>Explicit consent and freedom of choice<\/h2>\n<p>The AEPD recalls that explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR) can legitimise biometric processing where people can refuse without losing the service. That requires a real and effective non-biometric option, though not an identical one: channel, speed or convenience may differ. In this case it mentions in-person service and electronic identity tools such as qualified electronic signatures or certain mechanisms linked to the electronic national ID card.<\/p>\n<p>The Agency separates two questions. For consent: is there a genuine choice? For necessity: is there a less intrusive measure of equivalent effectiveness? Only the second can make biometrics unnecessary.<\/p>\n<h2>Limits and European context<\/h2>\n<p>The AEPD stresses that this is neither a general authorisation nor a certification of the technology. The controller keeps a margin of appreciation, but must define the need, justify the reliability level required, compare alternatives and document its reasoning under the accountability principle. If the expected improvement does not materialise, or equivalent alternatives emerge, the decision must be reviewed. Actual risk also matters: a one-off 1:1 check with no biometric repository and deletion of the reference data is not the same as 1:N identification or a persistent database.<\/p>\n<p>The Agency links this to the Digital Omnibus proposal, which would add an exception to Article 9 GDPR for certain verifications where the data or means remain under the individual&rsquo;s sole control. It is still an unadopted proposal, and the reply rests on current law. The AEPD also signals a forthcoming biometrics guide.<\/p>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>At the Euro-American Committee of Digital Law &#8211; CEA Digital Law we welcome the clear distinction between freedom of consent and necessity, which tidies a debate that was often blurred. For clocking-in and access control, the prudent reading is that this does not open the door to every use: the reply concerns customers, not employment, where the imbalance between the parties still calls for particular caution. We recommend that businesses document the specific risk, measure how effective the alternatives really are, and review the assessment periodically.<\/p>\n<p>For Latin America and the Caribbean, where several authorities are looking at biometric verification in banking and public services, an approach built on function, architecture and actual risk is a useful reference. Open questions remain on consistency with other European authorities and on the final scope of the guide and the Digital Omnibus.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/www.aepd.es\/informes-y-resoluciones\/criterios-juridicos-aepd\/analisis-sobre-necesidad-libertad-de-eleccion-datos-biometricos\" target=\"_blank\" rel=\"noopener\">AEPD: An\u00e1lisis sobre la necesidad, libertad de elecci\u00f3n y riesgo efectivo en el tratamiento de datos biom\u00e9tricos<\/a><\/li>\n<li><a href=\"https:\/\/www.cuatrecasas.com\/es\/spain\/propiedad-intelectual\/art\/novedades-uso-datos-biometricos-control-acceso\" target=\"_blank\" rel=\"noopener\">Cuatrecasas: Novedades sobre el uso de datos biom\u00e9tricos para el control de acceso<\/a><\/li>\n<li><a href=\"https:\/\/confilegal.com\/20261105-la-aepd-cambia-su-criterio-sobre-los-datos-biometricos-que-haya-alternativa-no-lo-hace-innecesario\/\" target=\"_blank\" rel=\"noopener\">Confilegal<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The AEPD refines its position: biometrics may be necessary if the alternative is not equally effective. Key points for access control and identity checks.<\/p>\n","protected":false},"author":2,"featured_media":125233,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1131],"tags":[],"cea_women":[],"class_list":["post-125231","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-proteccion-de-datos-y-privacidad-fr"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/125231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/comments?post=125231"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/125231\/revisions"}],"predecessor-version":[{"id":125256,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/posts\/125231\/revisions\/125256"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media\/125233"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/media?parent=125231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/categories?post=125231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/tags?post=125231"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/fr\/wp-json\/wp\/v2\/cea_women?post=125231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}