--- title: "Spain — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/spain/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/spain/algorithmic-biometric-and-surveillance-governance/index.html description: "Spain — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 5 claims Amber ▾ # AI governance is institutionally advanced (AESIA" generated_at: 2026-10-25T04:46:50Z content_sha256: ac186090e1161ce1ef99bf7b0a73bc3b4220df4208c8a486296c747511c7a677 generator: "fe-fleet/md-twin@1.0" --- # Spain — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules5 claimsAmber▾# AI governance is institutionally advanced (AESIA operative, 16 guidelines published) but the core Organic Law implementing AI Act governance domestically remains in draft/proposed stage as of mid-2026. Primary framework GDPR Art 9, Art 22 + EU AI Act (Regulation (EU) 2024/1689) + draft Spanish Organic Law on AI governance Supervisory authority [Agencia Española de Supervisión de la Inteligencia Artificial (AESIA)](https://www.aesia.gob.es) Traffic-light rationale — Amber AI governance is institutionally advanced (AESIA operative, 16 guidelines published) but the core Organic Law implementing AI Act governance domestically remains in draft/proposed stage as of mid-2026. #### Sub-modules (6) #### Profiling RestrictionsGreen GDPR Art 22 grants data subjects the right to object to decisions based solely on automated processing, including profiling, applicable directly in Spain. Claims (1): - GDPR grants data subjects the rights of access, rectification, erasure, objection, portability, restriction of processing, and the right to object to automated decision-making including profiling; AEPD confirms these are exercisable by minors from age fourteen. #### Automated Decision Making TransparencyAmber AEPD's AI-adaptation guidance ties automated processing to the GDPR information/transparency principle, requiring data subjects to be aware of how AI-driven processing uses their data. Claims (1): - AEPD guidance on GDPR-compliant AI processing ties automated processing to the information/transparency principle, requiring affected data subjects to be made aware of how their data is used within AI-embedding treatments. #### Ai Risk AssessmentsAmber AESIA was created from scratch as Spain's dedicated national AI authority ahead of the EU AI Act's governance requirements, publishing 16 interpretive AI guidelines drawing on its regulatory sandbox; a draft Organic Law on AI governance, designating notifying/market-surveillance authorities and giving AESIA a single-point-of-contact role, was approved by Council of Ministers on 26 May 2026 and sent to Congress. Claims (2): - Spain became the first EU Member State to establish a dedicated national AI supervisory authority, AESIA, which has published 16 interpretive AI guidelines developed within its AI regulatory sandbox to help translate EU AI Act principles into practical compliance steps. - On 26 May 2026, Spain's Council of Ministers approved a draft Organic Law on the proper use and governance of AI, designating notifying and market-surveillance authorities with AESIA as single point of contact, and sent it to Congress for parliamentary processing. #### Biometric RegimeAmber Facial-recognition and related biometric identification are treated as Art 9 special-category data requiring an essential-public-interest legal basis grounded in an appropriately-ranked statute; AEPD has rejected the argument that ordinary video-surveillance legitimation extends to facial/gait/voice recognition. Claims (2): - The use of facial recognition in video-surveillance implies processing of biometric data classified as a special category under GDPR Art 9, in principle prohibited absent an applicable exception under Spanish law. - AEPD's 2020 legal report concluded that facial-recognition technology in private-security video-surveillance is, in principle, prohibited under GDPR as special-category biometric processing, and that the legitimation applicable to plain image/sound-capturing video-surveillance cannot be extended to facial, gait, or voice recognition. #### Genetic DataAmber No ES-specific genetic-data regime beyond GDPR Art 9's general special-category treatment was identified in this research pass. Absence provenance: unavailable . Searched: AEPD datos geneticos regimen especial. #### State Surveillance CarveoutsAmber No ES-specific state-surveillance carveout beyond LO 7/2021 (law-enforcement-purpose data processing) was substantively evidenced in this research pass. Claims (1): - Ley Orgánica 7/2021 provides a distinct data-protection regime for personal data processed for the prevention, detection, investigation and prosecution of criminal offences and execution of criminal penalties, operating alongside the general GDPR/LOPDGDD regime. Category narrative 81 words Spain was the first EU Member State to create a dedicated AI supervisory authority, the Agencia Española de Supervisión de la Inteligencia Artificial (AESIA), operationalising EU AI Act oversight ahead of most peers, with a draft Organic Law on AI governance approved by the Council of Ministers in May 2026 and pending parliamentary processing. Biometric identification (facial recognition, gait, voice) is treated by AEPD as high-risk Art 9 special-category processing requiring reinforced safeguards. GDPR Art 22 profiling/automated-decision-making objection rights apply directly. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Royal Decree 723/2026 entered into force on 5 October 2026, repealing and fully replacing Royal Decree 1659/1998. Its Article 3.2(k) creates a binding duty on employers to inform each worker, in writing, in advance and traceably, of algorithmic or automated decision-making systems that determine working time, task allocation, pay, career progression, workplace location or contract termination, together with the guidelines, criteria and rules those systems apply. This is the single most material data-protection-adjacent development identified for Spain this cycle, and it establishes an individual worker right to algorithmic transparency that interacts directly with, but does not displace, obligations arising under the GDPR and the LOPDGDD. Separately, reports suggest the AEPD received a notification describing an AI-agent-linked breach, though the identity of the notifying organisation and the technical details of the incident have not been confirmed; this should be read as an early, unverified signal of AI-agent-related incidents reaching the breach-notification framework, not as a confirmed finding. #### Outlook The practical rollout of Royal Decree 723/2026 will be visible first in the volume and content of worker information requests submitted under its 30-working-day response mechanism. Whether the AEPD issues further guidance interpreting the scope of Article 3.2(k), for instance on what counts as sufficiently traceable disclosure of algorithmic criteria, is the clearest near-term marker to watch. Any corroboration of the reported AI-agent-linked breach notification would also be a significant development for how the breach-notification framework applies to AI-agent architectures specifically. 1 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance Biometric enforcement is currently the AEPD's most active governance front, evidenced by three fines this cycle spanning digital identity verification (Yoti, EUR950,000 combined), aviation boarding systems (Aena, EUR10,043,002), and professional sports club membership management (FC Barcelona, EUR500,000). Each case turns on a different specific failure -- unlawful processing and invalid consent for Yoti, inadequate DPIA proportionality assessment for Aena and FC Barcelona -- but together they establish biometric data processing as a category receiving sustained, cross-sectoral AEPD attention rather than isolated sectoral scrutiny. AESIA, Spain's national AI supervisory authority established under the national AI governance framework, is expected to coordinate with the AEPD to help ensure data-protection requirements are enforced alongside the EU AI Act's obligations, particularly for biometric and AI-driven systems where the two regulatory frameworks overlap. This coordination expectation reflects the structural reality that AI-driven biometric identification systems increasingly sit at the intersection of AI Act risk-classification obligations and GDPR's special-category data rules, though the operational form this AEPD-AESIA coordination will take has not been confirmed through a primary document this cycle. #### Outlook The coordination relationship between AESIA and the AEPD is the item to watch most closely, since formal confirmation of how the two authorities divide or share supervisory responsibility for AI-driven biometric systems would clarify whether Spain is developing an integrated AI-Act/GDPR enforcement posture for biometric technologies or maintaining largely separate regulatory tracks that happen to converge on the same underlying processing activities. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 5 Sources and claims (5) - Probable[Agencia Española de Protección de Datos](https://www.aepd.es/sites/default/files/2020-02/adecuacion-rgpd-ia.pdf) — AEPD guidance on GDPR-compliant AI processing ties automated processing to the information/transparency principle, requiring affected data subjects to be made aware of how their data is used within AI-embedding treatments.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/aesia-s-ai-guidelines-spain-steps-into-the-ai-spotlight) — Spain became the first EU Member State to establish a dedicated national AI supervisory authority, AESIA, which has published 16 interpretive AI guidelines developed within its AI regulatory sandbox to help translate EU AI Act principles into practical compliance steps.observed 2026-08-03 - Confirmed[DataGuidance](https://www.dataguidance.com/news/spain-council-ministers-approves-draft-organic-law-ai) — On 26 May 2026, Spain's Council of Ministers approved a draft Organic Law on the proper use and governance of AI, designating notifying and market-surveillance authorities with AESIA as single point of contact, and sent it to Congress for parliamentary processing.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/AEPD-informe-sistemas-reconocimiento-facial-empresas-seguridad-privada) — AEPD's 2020 legal report concluded that facial-recognition technology in private-security video-surveillance is, in principle, prohibited under GDPR as special-category biometric processing, and that the legitimation applicable to plain image/sound-capturing video-surveillance cannot be extended to facial, gait, or voice recognition.observed 2026-08-03 - Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/en/our-work-and-tools/regulation) — Ley Orgánica 7/2021 provides a distinct data-protection regime for personal data processed for the prevention, detection, investigation and prosecution of criminal offences and execution of criminal penalties, operating alongside the general GDPR/LOPDGDD regime.observed 2026-08-03