Can staff clock in by fingerprint or face in Spain? What the regulator says
Quick answer
It is not expressly banned, but since the Spanish data protection authority's November 2023 guide, clocking by fingerprint or facial recognition is treated as high-risk processing of special category data, which cannot rely on employee consent and requires a data protection impact assessment showing there is no less intrusive alternative. Since there almost always is one, it is very hard to justify in practice.
What changed in November 2023
Until then it was common to argue that using a fingerprint merely to *verify* someone already identified was not special category processing. The Spanish data protection authority (AEPD) corrected that view in its guide on biometric presence control, aligning itself with the European Data Protection Board: both biometric identification and biometric authentication are special category data processing.
If you run sites in several countries, note that Spain's regulator has taken a firmer line here than some employers are used to.
The guide's four key points
According to the AEPD's official press release:
- It is high-risk processing involving special category data. To do it there must be an exception lifting the general prohibition in article 9 of the GDPR, plus a lawful basis.
- For time recording and workplace access control, if the exception is article 9.2.b) (employment obligations), a law must specifically authorise biometrics for that purpose. Article 34.9 of the Workers' Statute does not mention it.
- Consent does not work in employment, because of the imbalance between employer and employee.
- A prior DPIA is mandatory and must pass the three-part test of suitability, necessity and proportionality.
Why it almost never passes the necessity test
The question is: can the same aim be achieved by less intrusive means? For recording working time, a card, a PIN or an app achieves it. Fingerprints being more convenient, or stopping buddy punching, does not make them *necessary*.
If it is considered anyway
The guide lists required measures, including: informing people about the processing and its risks, allowing the link between the biometric template and the person to be revoked, technically preventing templates being used for other purposes, encrypting them, using formats that prevent databases being cross-matched, deleting data when no longer needed, and data protection by design.
I already have fingerprint terminals: what now?
- Do not ignore it. The AEPD has fined companies over fingerprint clocking.
- Talk to your data protection officer or adviser.
- Check whether the terminal supports card or PIN. Many do: biometrics is switched off and the device kept.
- Delete stored biometric templates if you stop using them, and keep a record.
- Tell staff about the change.
Alternatives that do the same job
- A personal proximity card or fob.
- A mobile or web app.
- Card + PIN if buddy punching is a concern.
Full comparison in clocking methods.
What about opening doors?
The reasoning is similar outside employment too: see biometrics in access control.
This guide summarises the AEPD's position for orientation. Assessing your own case is for your company and its data protection adviser.
If you want to replace or convert your terminals, we can help with the technical side: time and attendance.
Frequently asked questions
Is it valid if the employee signs a consent form?
No. The AEPD considers that consent in employment is not freely given because of the imbalance between the parties, and it cannot lift the prohibition on processing biometric data.
What if the collective agreement allows it?
Some legal commentators point to collective bargaining as a possible route, but the DPIA and necessity test would still have to be passed. Take legal advice.
Is facial recognition treated differently from fingerprints?
For these purposes, no: both are biometric data used to uniquely identify a person.
Sources
This guide is for information only and is not a substitute for legal advice or for the technical design of each installation. Regulations change: always check the current text at the official source.