#
Lawful basis and special-category framework is GDPR-aligned with clear, AEPD-published interpretive guidance; consent threshold for minors is well-documented.
Sub-modules (4)
Lawful BasesGreen
GDPR Art 6 bases apply directly; LOPDGDD presumes legitimate interest for professional contact data of individuals acting for a legal person, absent proof to the contrary.
Claims (1):
- LOPDGDD presumes, absent proof to the contrary, a legitimate interest under GDPR Art 6.1(f) for processing professional contact data and role/position data of individuals working for a legal entity.
Consent ThresholdsGreen
LOPDGDD Art 7 sets the age of valid data-processing consent at 14; below that age, parental/guardian consent is required.
Claims (1):
- Processing of a minor's personal data may only be based on the minor's own consent from age fourteen upward; below fourteen, consent must be given by parents or guardians.
Special CategoriesAmber
Facial recognition and other biometric identification technologies are classified as Art 9 special-category data, in principle prohibited absent an applicable exception; AEPD has repeatedly found that consent is an inadequate basis in imbalanced relationships (e.g. employment) and that an 'essential public interest' basis requires an appropriately-ranked statute that currently does not exist for many use-cases (e.g. biometric time/attendance control).
Claims (2):
- The use of facial recognition in video-surveillance implies processing of biometric data classified as a special category under GDPR Art 9, in principle prohibited absent an applicable exception under Spanish law.
- AEPD guidance holds that consent cannot lift the Art 9 prohibition for biometric presence/access-control systems in employment contexts due to the power imbalance between employer and employee, and that reliance on the 'essential public interest' exception requires a statute of appropriate legal rank that does not currently authorise biometric time-control.
Pseudonymisation And AnonymisationAmber
No AEPD-specific pseudonymisation/anonymisation safe-harbour instrument was surfaced in this research pass; GDPR's general pseudonymisation definition (Art 4(5)) applies directly as EU law.
Absence provenance: unavailable. Searched: AEPD anonymisation pseudonymisation guidance ES.
Lawful Processing & Special Data
The AEPD found that Yoti Ltd violated GDPR articles 5.1(e), 7 and 9 in connection with its biometric data processing, imposing combined fines of EUR950,000 broken into three components: EUR500,000 for unlawful biometric processing, EUR200,000 for invalid consent, and EUR250,000 for excessive retention. The finding is understood to treat facial-match biometric data as special-category data under article 9 even where the operator claims immediate deletion after matching, a position that narrows the room for operators to argue that transient or non-retained biometric processing falls outside the special-category regime. The consent finding is understood to have turned on a pre-ticked-box mechanism used to obtain agreement for ancillary research-and-development use of the data, which the AEPD treated as invalid consent under article 7's standard for freely given, specific and unambiguous agreement.
This finding sits within a wider pattern this cycle of AEPD attention to biometric data specifically, rather than to special-category data generally, suggesting biometric processing has become a discrete enforcement priority rather than one example among many special-category categories. The retention component of the fine, EUR250,000 for excessive retention, indicates that even where initial collection and matching may have a lawful basis, the AEPD is scrutinising how long biometric data is actually held relative to the purpose for which it was collected.
Outlook
Yoti's appeal of the underlying sanction to the Spanish High Court, following the AEPD's rejection of its request for reconsideration on 2 March 2026, is the key item to watch for this module. Should the Audiencia Nacional narrow or overturn the AEPD's findings on the biometric special-category classification or the consent-validity analysis, that would materially affect the durability of the AEPD's current interpretive line on lawful processing of biometric data going forward.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (4)
- ConfirmedAgencia Española de Protección de Datos — LOPDGDD presumes, absent proof to the contrary, a legitimate interest under GDPR Art 6.1(f) for processing professional contact data and role/position data of individuals working for a legal entity.observed
- ConfirmedAgencia Española de Protección de Datos — Processing of a minor's personal data may only be based on the minor's own consent from age fourteen upward; below fourteen, consent must be given by parents or guardians.observed
- ConfirmedAgencia Española de Protección de Datos — The use of facial recognition in video-surveillance implies processing of biometric data classified as a special category under GDPR Art 9, in principle prohibited absent an applicable exception under Spanish law.observed
- ConfirmedAgencia Española de Protección de Datos — AEPD guidance holds that consent cannot lift the Art 9 prohibition for biometric presence/access-control systems in employment contexts due to the power imbalance between employer and employee, and that reliance on the 'essential public interest' exception requires a statute of appropriate legal rank that does not currently authorise biometric time-control.observed