Spain’s data protection authority, the Agencia Española de Protección de Datos, has fined Fútbol Club Barcelona €500,000 after finding the club processed biometric data from more than 100,000 members without conducting an adequate Data Protection Impact Assessment.
Barcelona deployed two biometric systems during a membership census update: a facial recognition system and a voice recognition system. Members completing the census remotely were required to provide a facial scan via their device camera or record their voice for biometric identity verification. The AEPD found the club’s documentation fell short of the requirements under Article 35 of the GDPR, which mandates a DPIA wherever processing is likely to result in high risk to individuals.
The authority identified several high-risk factors in the club’s processing: the use of biometric data for identification purposes, large-scale processing involving over 100,000 individuals including minors, and the deployment of new technologies. The AEPD concluded that the documentation produced by Barcelona lacked essential elements required to qualify as a valid DPIA, specifically the absence of a genuine necessity and proportionality assessment and an inadequate evaluation of risks to individuals.
A central point in the AEPD decision, case PS-00450-2024, is that obtaining user consent does not eliminate the obligation to conduct a DPIA when high-risk processing is involved. The club had asked members to consent to biometric data collection, but the authority drew a clear line: consent is a separate legal requirement from the procedural obligation to assess risk before a high-risk system is deployed. Both obligations must be satisfied independently.
The decision also sets out what a valid DPIA must contain: a clear description of the processing, a genuine necessity and proportionality assessment, a detailed risk evaluation, proposed mitigation measures, and a residual risk assessment. Organizations that treat the DPIA as a documentation formality rather than a substantive analytical exercise remain exposed even where they have obtained individual consent.
The case is a pointed reminder to any organization deploying facial or voice recognition for identity verification at scale. Under GDPR, the obligation to assess risk arises from the nature of the processing, not from whether users have agreed to it. With biometric enrollment increasingly common in member-facing digital services, regulators across Europe have signaled they will scrutinize both the quality of DPIAs and the conditions under which biometric data is collected.
Sources: Datenschutz Notizen, AEPD Decision PS-00450-2024
–
By the ID Tech Editorial Team
