Spain Data Protection & Privacy Regulation

Lawful Processing & Special Data

The AEPD found that Yoti Ltd violated GDPR articles 5.1(e), 7 and 9 in connection with its biometric data processing, imposing combined fines of EUR950,000 broken into three components: EUR500,000 for unlawful biometric processing, EUR200,000 for invalid consent, and EUR250,000 for excessive retention. The finding is understood to treat facial-match biometric data as special-category data under article 9 even where the operator claims immediate deletion after matching, a position that narrows the room for operators to argue that transient or non-retained biometric processing falls outside the special-category regime. The consent finding is understood to have turned on a pre-ticked-box mechanism used to obtain agreement for ancillary research-and-development use of the data, which the AEPD treated as invalid consent under article 7's standard for freely given, specific and unambiguous agreement.

This finding sits within a wider pattern this cycle of AEPD attention to biometric data specifically, rather than to special-category data generally, suggesting biometric processing has become a discrete enforcement priority rather than one example among many special-category categories. The retention component of the fine, EUR250,000 for excessive retention, indicates that even where initial collection and matching may have a lawful basis, the AEPD is scrutinising how long biometric data is actually held relative to the purpose for which it was collected.

Outlook

Yoti's appeal of the underlying sanction to the Spanish High Court, following the AEPD's rejection of its request for reconsideration on 2 March 2026, is the key item to watch for this module. Should the Audiencia Nacional narrow or overturn the AEPD's findings on the biometric special-category classification or the consent-validity analysis, that would materially affect the durability of the AEPD's current interpretive line on lawful processing of biometric data going forward.

Controller/Processor Duties

Three substantial fines this cycle turn on the same underlying accountability failure: an inadequate data protection impact assessment for biometric processing. The AEPD fined Aena EUR10,043,002 for deploying biometric-boarding facial recognition at eight airports without a DPIA that adequately assessed proportionality against less-intrusive alternatives, the largest of the three penalties and the clearest signal that the AEPD expects controllers to demonstrate genuine consideration of alternatives before deploying biometric systems at scale. Separately, the AEPD fined FC Barcelona EUR500,000 in March 2026 for a deficient biometric DPIA, covering facial and voice data collection for approximately 143,000 club members, again turning on DPIA adequacy rather than on the underlying lawfulness of the processing itself.

Read together with the Yoti finding on unlawful biometric processing and invalid consent, these three actions establish DPIA adequacy for biometric systems as a distinct and currently very active enforcement front for the AEPD, spanning aviation, professional sport, and digital identity verification. The common thread across Aena and FC Barcelona is not that biometric processing itself was unlawful in principle, but that the controllers had not conducted or documented an assessment rigorous enough to justify the proportionality of the chosen approach against less intrusive alternatives.

Outlook

The pattern across three unrelated sectors this cycle suggests the AEPD is applying a consistent, elevated bar for DPIA adequacy specifically where biometric data is involved, and organisations deploying facial recognition, voice biometrics, or similar systems in Spain should expect continued scrutiny of their DPIA documentation. Whether this enforcement pattern extends into further sectors, and how the Yoti appeal to the Audiencia Nacional resolves, will indicate whether the current DPIA-adequacy standard for biometric systems is durable or subject to judicial narrowing.

Algorithmic, Biometric & Surveillance Governance

Royal Decree 723/2026 entered into force on 5 October 2026, repealing and fully replacing Royal Decree 1659/1998. Its Article 3.2(k) creates a binding duty on employers to inform each worker, in writing, in advance and traceably, of algorithmic or automated decision-making systems that determine working time, task allocation, pay, career progression, workplace location or contract termination, together with the guidelines, criteria and rules those systems apply. This is the single most material data-protection-adjacent development identified for Spain this cycle, and it establishes an individual worker right to algorithmic transparency that interacts directly with, but does not displace, obligations arising under the GDPR and the LOPDGDD. Separately, reports suggest the AEPD received a notification describing an AI-agent-linked breach, though the identity of the notifying organisation and the technical details of the incident have not been confirmed; this should be read as an early, unverified signal of AI-agent-related incidents reaching the breach-notification framework, not as a confirmed finding.

Outlook

The practical rollout of Royal Decree 723/2026 will be visible first in the volume and content of worker information requests submitted under its 30-working-day response mechanism. Whether the AEPD issues further guidance interpreting the scope of Article 3.2(k), for instance on what counts as sufficiently traceable disclosure of algorithmic criteria, is the clearest near-term marker to watch. Any corroboration of the reported AI-agent-linked breach notification would also be a significant development for how the breach-notification framework applies to AI-agent architectures specifically.

Algorithmic, Biometric & Surveillance Governance

Biometric enforcement is currently the AEPD's most active governance front, evidenced by three fines this cycle spanning digital identity verification (Yoti, EUR950,000 combined), aviation boarding systems (Aena, EUR10,043,002), and professional sports club membership management (FC Barcelona, EUR500,000). Each case turns on a different specific failure -- unlawful processing and invalid consent for Yoti, inadequate DPIA proportionality assessment for Aena and FC Barcelona -- but together they establish biometric data processing as a category receiving sustained, cross-sectoral AEPD attention rather than isolated sectoral scrutiny.

AESIA, Spain's national AI supervisory authority established under the national AI governance framework, is expected to coordinate with the AEPD to help ensure data-protection requirements are enforced alongside the EU AI Act's obligations, particularly for biometric and AI-driven systems where the two regulatory frameworks overlap. This coordination expectation reflects the structural reality that AI-driven biometric identification systems increasingly sit at the intersection of AI Act risk-classification obligations and GDPR's special-category data rules, though the operational form this AEPD-AESIA coordination will take has not been confirmed through a primary document this cycle.

Outlook

The coordination relationship between AESIA and the AEPD is the item to watch most closely, since formal confirmation of how the two authorities divide or share supervisory responsibility for AI-driven biometric systems would clarify whether Spain is developing an integrated AI-Act/GDPR enforcement posture for biometric technologies or maintaining largely separate regulatory tracks that happen to converge on the same underlying processing activities.

Enforcement & Redress

The Spanish data protection authority is understood to have fined a used-vehicle dealer €680,000 under resolution PS-00540-2025, in connection with a security breach that allowed exfiltration of customer data and with mismanagement of the right to object to direct marketing. The figure places this among the larger sanctions reported in this enforcement channel, and the dual basis for the fine — a security failure together with handling of marketing-objection rights — illustrates that the authority continues to treat breach-response adequacy and the practical operation of data-subject rights as connected questions in a single enforcement action rather than as separate matters.

At the same time, a ruling attributed to the Audiencia Nacional has constrained one of the authority's own enforcement tools: the court held that the regulator cannot demand payment of default interest that accrues on a sanction while that sanction remains judicially suspended pending appeal. This is a procedural limit on how the authority can pursue collection during an active appeal, rather than a limit on its power to impose sanctions in the first place, and it indicates that the courts are prepared to check the mechanics of enforcement even where the underlying sanctioning power is not in question. The exact case reference for this ruling has not been independently confirmed.

Taken together, the picture for this period is of a regulator maintaining a high enforcement tempo — with fines against commercial actors for breach and rights-handling failures continuing to be issued — set against a judiciary willing to impose boundaries on how collection is pursued once a sanction is contested.

Outlook

Enforcement activity by the Spanish authority is expected to continue at a similar pace, with breach-handling and marketing-related rights failures remaining a recurring basis for sanctions against commercial operators. The interest-collection ruling is likely to be a reference point in future appeals where sanctioned parties seek judicial suspension, and whether it is applied more broadly across pending appeals is a point to watch.

Enforcement & Redress

The AEPD, Spain's data protection supervisory authority, has proposed a EUR 5,000 administrative fine against El Salto, a cooperative investigative media outlet, in connection with its reporting on undercover police infiltration of social movements. Alongside the proposed fine, the reported proceeding would require El Salto to redact elements of its published coverage, specifically pixelating images and removing the initials and aliases used to refer to individuals connected to the infiltration operations described in its reporting.

The matter is understood to still be at the proposal stage: a formal AEPD proposal is not the same as a final, binding resolution, and reporting available at this point does not establish whether the outlet will contest the proposed measures or whether the AEPD will adjust or confirm them before any final decision issues. The underlying substantive question, whether and how data protection rules concerning the identifiability of individuals in published reporting apply to investigative journalism about undercover state security operations, has not yet been resolved by a final AEPD decision on the public record.

This finding rests on secondary press reporting rather than on direct retrieval of the AEPD's own resolution or proceeding record, so procedural detail beyond the fine amount and the redaction elements described, such as the formal legal basis cited or the specific statutory provision invoked, is not yet confirmed.

Outlook

The eventual resolution of this proceeding will be the point of note: confirmation of whether the proposed fine and redaction order are upheld, reduced, withdrawn, or contested will clarify how the AEPD applies data protection enforcement powers against investigative reporting that identifies individuals connected to undercover policing operations.

Enforcement & Redress

The AEPD's enforcement activity remained materially active in the period under review. Its record EUR 18 million fine against Amadeus IT Group, S.A., reported in May 2026, concerned a traveller-profiling pilot project the regulator found was conducted without adequate legal basis or sufficient information to data subjects, addressing breaches of Articles 6 and 14 of the GDPR. The AEPD is also reported to have fined Vodafone EUR 750,000, reported 25 September 2026, in connection with a data breach and inadequate security measures, and to have fined 23andMe EUR 2.4 million, reported 10 August 2026, for security and breach-notification failures affecting 2,642 individuals. Separately, the AEPD fined a security-alarm and video-surveillance company EUR 100,000 for obstructing the exercise of data-subject rights via a chargeable phone line, a decision reported 22 September 2026. Across this enforcement activity, the AEPD is understood to consistently apply the proportionality principle under Article 83(1) of the GDPR, giving considerable weight to the fact that most respondents before it are small and medium-sized enterprises; no change to the underlying maximum-fine tiers was found this cycle.

Outlook

The Amadeus decision, as the largest fine identified in this period, is likely to remain a reference point in AEPD enforcement reasoning on profiling conducted without adequate legal basis. Continued proportionality-weighted treatment of SME respondents suggests the AEPD's fine levels for smaller entities will likely remain calibrated below headline GDPR maximums, even as enforcement volume continues at a sustained pace.

Enforcement & Redress

The Audiencia Nacional, Spain's national court competent to review AEPD sanction decisions, held in a judgment reported as issued on 24 September 2026 that the AEPD may not liquidate suspensive interest that accrues during the period a sanction decision remains suspended pending appeal. This is a narrowing of one specific collection mechanism available to the regulator once a fine is contested, not a change to the AEPD's underlying power to impose sanctions or to the level of fines it may impose. The finding is sourced via law-firm commentary (Picón y Asociados) describing the ruling; the primary judgment text, including its docket reference, was not independently retrieved this cycle, so the precise legal reasoning and scope of application remain to be confirmed against the original source.

Alongside this development, the AEPD's statutory fine-tier maxima remain unchanged: sanctions for the lower infraction tier under the GDPR's own penalty framework, as applied domestically, continue to carry a ceiling of up to EUR 10 million or 2% of total annual global turnover, and the higher tier continues to carry a ceiling of up to EUR 20 million or 4%. No development this cycle alters either ceiling or the AEPD's general sanctioning authority; the change is confined to a procedural detail of how accessory interest on a suspended sanction may be collected.

The practical significance for entities with a sanction currently under appeal is that the regulator's ability to add suspensive interest to the eventual collected amount appears to be constrained by this ruling, though the exact mechanics, including whether the ruling applies to sanctions already under appeal or only to future cases, were not established in the material reviewed this cycle.

Outlook

Confirmation of the underlying Audiencia Nacional judgment text, including its docket reference, is the clearest item likely to sharpen this finding in a future cycle. Until that confirmation is obtained, the practical scope of the suspensive-interest limitation for entities with pending AEPD appeals should be treated as provisional.

Enforcement & Redress

The AEPD's sanctioning powers remain grounded in GDPR article 83, permitting administrative fines of up to EUR20 million or 4% of global annual turnover, whichever is higher, and LOPDGDD article 77 mandates publication of final sanctioning resolutions once they become firm. This cycle's biometric enforcement wave -- the Yoti, Aena and FC Barcelona fines -- illustrates the AEPD exercising this authority at a range of scales, from EUR500,000 up to over EUR10 million, depending on the severity and sectoral context of the underlying violation.

Of particular note for the redress dimension is the active contestation of the Yoti sanction. The AEPD rejected Yoti's request for reconsideration on 2 March 2026, and Yoti has since escalated its challenge to a full appeal before the Spanish High Court, the Audiencia Nacional, disputing both the substantive findings and the adequacy of the AEPD's notification procedure. This is a live, unresolved legal proceeding rather than a settled enforcement outcome, and it represents the clearest current test of how far Spanish courts will support the AEPD's interpretive approach to biometric special-category data and consent validity under the current enforcement wave.

Outlook

The Audiencia Nacional's eventual ruling on Yoti's appeal is the single most consequential redress-related development to track, since it will either validate or narrow the AEPD's current enforcement approach to biometric data, with direct implications for how durable the accompanying Aena and FC Barcelona DPIA-adequacy findings prove to be if similarly challenged.