UNIQUE IDENTIFICATION UNDER THE GDPR AND MEMBER STATE LAW: THE CASE OF SPAIN

Abstract

The study infers that biometric access control systems, including facial recognition and fingerprint verification, involve the processing of special categories of personal data under Articles 4(14) and 9 of the General Data Protection Regulation whenever they facilitate or substantiate the unique identification of individuals. The distinction between biometric identification (1:N) and verification (1:1) does not exclude the relevance of Article 9 GDPR if tag effects arise. Generic requests of public interest or security objectives are low to justify such processing under Article 9(2)(g) GDPR. Spanish constitutional doctrine and EU data protection law direct that a law of acceptable rank establish any hindrance of the fundamental right to data protection, clearly express the substantial public welfare pursued, and provide precise, foreseeable, and robust safeguards. The research finds that Article 13(1) of Spanish Law 19/2007 does not meet these requirements, as it neither expressly authorizes the processing of biometric data nor establishes appropriate safeguards. National regulation and administrative measures mandating biometric access systems in sports venues lack a valid legal basis under Article 9(2) GDPR and are incompatible with the EU data protection framework. Decisions and prior consultations by the Agencia Española de Protección de Datos demonstrate strict enforcement of GDPR principles, including necessity, proportionality, transparency, and data minimisation. Biometric recognition was invariably considered unlawful due to the absence of a valid legal basis, invalid consent, lack of DPIAs, and the availability of less intrusive alternatives. Therefore, the authors confirm that technical design choices do not alter the legal qualification of biometric data. Unique identification capability is decisive, and biometric systems must stay exceptional rather than authoritative means in access control practices.