Spain’s data protection authority has warned two municipal councils that planned police video surveillance systems with artificial intelligence features could breach data protection law, and has told one of them that facial recognition must stay switched off unless its necessity for a specific policing purpose is first justified.
The Agencia Española de Protección de Datos (AEPD) issued the warnings, numbered AI-00170-2026 and AI-00171-2026, under its power to address data controllers whose planned processing may infringe the General Data Protection Regulation. Neither system is yet in operation, and the AEPD says a warning is a preventive measure, not a finding that an infringement has occurred. The published resolutions withhold the councils’ names.
The first case concerns a tender for cameras at municipal buildings and other areas, monitored from local police premises, in a municipality of more than 30,000 people. Its technical specifications require recorders with facial detection and recognition capabilities. Local outlet El Digital de Albacete has identified the council as Hellín, where a contract estimated at 29,983 euros covers at least 26 new cameras and is still awaiting award.
The AEPD said facial recognition and any other identification or re-identification of people must remain disabled until the council has justified it, and that any assessment must cover the reference image databases, matching procedure, match thresholds, false positives and negatives, human review and the consequences of a match. The mere technical availability of a function does not by itself establish a need to use it, the regulator said.
The second tender covers 38 new cameras and the integration of 124 existing ones into a central video management system. Its specifications include AI cameras that detect people and vehicles and analyze the full scene at all times, plus “search by appearance,” which can locate a person across cameras by clothing color, hair color, sex and age group, or by importing a photograph.
The AEPD said councils must assess the necessity and proportionality of each AI capability separately from the installation of the cameras, and carry out a data protection impact assessment before launch where processing is high risk. If a system identifies individuals biometrically, Spain’s stricter rules for biometric data apply. In the first case, the regulator also said unneeded functions should stay disabled by default and that retention periods must be set for metadata, biometric templates and match results.
Sources: AEPD, El Digital de Albacete
–
By the ID Tech Editorial Team
