Biometrics and data protection
Biometrics in access control in Spain: when fingerprint or face can be used
Quick answer
Using fingerprint or facial recognition to open doors is, according to Spain's data protection authority, high-risk processing of special category data. In general consent is not enough if access can be controlled by other means, and a prior DPIA is required. It is only realistic where there is a solid, documented security justification.
The starting point
Article 9 of the GDPR prohibits processing biometric data to uniquely identify a person unless one of its exceptions applies. The Spanish authority (AEPD), in its November 2023 guide, made clear that this covers both identification ("who is this?") and authentication ("are they who they say they are?") and applies to presence and access control for both employment and non-employment purposes.
The GDPR is the same across the EU, but national regulators apply it with different emphasis. Spain's reading is on the strict side.
Outside employment: members, residents, customers
You might assume a gym member's or resident's consent is enough. The AEPD's press release rules that out in general: as high-risk processing it must meet the necessity requirement, and it does not if access can be controlled just as well with a card, wristband or code. Consent is also only free if there is a real alternative with no penalty.
In employment
The same applies as for clocking: consent is not valid and a law would be needed to support it. See can staff clock in by fingerprint?.
Requirements if it is considered
- A prior DPIA demonstrating suitability, necessity and proportionality.
- An article 9.2 exception and lawful basis identified and documented.
- A non-biometric alternative available.
- Clear information about the processing and its risks.
- Technical measures: encrypted template, preferably stored under the person's control (for example on their card), with no possible reuse or cross-matching, and deletion when the purpose ends.
- No automated decisions with significant effects without human involvement.
Where it usually comes up, and the answer
| Case | Reason given | Less intrusive alternative |
|---|---|---|
| Gym | Stop card sharing | Personal wristband, member photo on reception screen, turnstile |
| Residential community | Convenience, no key | Encrypted fob or phone |
| Office | A modern image | Encrypted card or mobile credential |
| High-risk room | Certainty of identity | Two-factor (card + PIN); biometrics only if justified |
What biometrics does not fix
- It does not replace a proper door and lock.
- It does not stop someone following another person in: a turnstile does that.
- If the template database leaks, nobody can "change their fingerprint".
What we do when a client asks for it
We explain this framework, propose the alternative and, if the client has a favourable DPIA from their data protection adviser, install the system with the measures that assessment sets. See our biometric access control service. To compare options, see which credential to choose.
An informative summary of the AEPD's position. It is not legal advice on your case.
Frequently asked questions
Can a gym use fingerprints if the member signs a consent form?
According to the AEPD, in general that is not enough, because access can be controlled by less intrusive means and the processing fails the necessity requirement.
What if the fingerprint is stored only on the user’s card?
That reduces risk and the AEPD views it favourably, but it does not remove the need to justify the processing and carry out the DPIA.
Sources
This guide is for information only and is not a substitute for legal advice or for the technical design of each installation. Regulations change: always check the current text at the official source.