Biometric data processing risks and the legal necessity of authentication methods are being reevaluated by the Spanish Data Protection Agency, known as the AEPD, with further coverage provided by Biometric Update.
The AEPD recently issued a legal opinion clarifying that biometric applications carry varying degrees of risk depending on their specific implementation. The regulator distinguished between one-to-one facial verification and one-to-many facial recognition, noting that persistent databases introduce unique data protection concerns. Under the General Data Protection Regulation, or GDPR, organizations must obtain explicit consent for processing biometric data unless it is deemed necessary. The AEPD emphasized that necessity only applies when no equally effective, less intrusive alternative exists. While companies are responsible for determining appropriate fraud prevention levels, the regulator suggested that methods such as qualified electronic signatures or digital identification could serve as viable alternatives. This guidance follows a 950,000 euro fine issued to Yoti earlier this year for failing to provide non-biometric authentication options. The AEPD maintains that while alternatives may differ in speed or convenience, they must remain sufficiently effective to satisfy legal requirements. As the European Union considers the Digital Omnibus proposal, which may introduce specific exceptions for biometric identity verification, the industry faces increasing pressure to balance security with user privacy and regulatory compliance.
Source: Biometric Update
