What it says
- One of the projects involved facial detection or recognition; the other, detection of people and vehicles, metadata generation, and searching for people by their appearance (clothing, hair, sex, age group), even from a photograph.
- The AEPD recalls that the regulations do not prevent the use of these technologies, but require safeguards from the earliest stages, including in the purchase and configuration of the system.
- Before putting it into operation, the controller must decide which functions it needs for its purpose, what data each one generates, how long it is kept, and who has access to it.
- The fact that a capability to identify, search for, or track people is available does not by itself justify using it: it must pass the necessity and proportionality analysis, with a prior impact assessment if there is high risk.
- If any function processes biometric data to uniquely identify a person, the reinforced regime for such data applies.
How it has evolved
Thread: The AEPD and the uses of AI. Preventive warnings (Article 58.2.a GDPR), decisions, and criteria of the AEPD on data processing with AI.
- September 23, 2026 · The AEPD warns a company that wanted to score résumés with AI: these are the safeguards
- October 6, 2026 · The AEPD warns two city councils about AI video surveillance and facial recognition (this story)
The Tech Guardian summarizes and comments in its own words on third-party publications. The full information belongs to the original source, which we recommend you read.