Spain's AEPD issues warning to municipality over facial recognition function in video surveillance

The Spanish Data Protection Agency (AEPD) warned a city council about a municipal video surveillance system procurement document whose technical specifications explicitly required recording equipment to have facial detection and recognition capabilities. AEPD noted that these features could constitute AI-based image analysis or even unique identification processing, but the existing documentation could not determine whether the features would actually be enabled, nor whether biometric templates or vectors would be generated, or 1:1 or 1:N comparisons would be performed. AEPD required the city council to assess, before the system is put into operation, item by item, whether each AI feature is necessary and proportionate for the specific purpose, ensure that non-essential features are disabled by default, and conduct a data protection impact assessment covering the facial recognition system, reference image database, comparison process, matching thresholds, false positives and false negatives, and human intervention. If facial recognition is used for unique identification, the enhanced rules for biometric data under Articles 4.14 and 9 of the RGPD must also apply. AEPD stated that if necessary measures are not taken, it may initiate investigations or corrective procedures including penalties.