AEPD (Spain) - 0098/2022

AEPD - 0098/2022
Authority:	AEPD (Spain)
Jurisdiction:	Spain
Relevant Law:	Article 6(1)(e) GDPR Article 9(2)(g) GDPR Act Against Violence, Racism, Xenophobia and Intolerance in Sport
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:
Published:	20.01.2023
Fine:	n/a
Parties:	Comisión Estatal contra la Violencia, el Racismo, la Xenofobia y la Intolerancia
National Case Number/Name:	0098/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Spanish
Original Source:	AEPD (in ES)
Initial Contributor:	Carmen Villarroel

In a prior consultation, the Spanish DPA held that the State Commission Against Violence, Racism, Xenophobia and Intolerance in Sport could not rely on Article 9(2)(g) GDPR in order to process biometric data of football fans entering stadiums.

English Summary

Facts

The State Commission Against Violence, Racism, Xenophobia and Intolerance in Sport (the Commission) wanted to install biometric identification systems at the entrances to sport stadiums in order to univocally identify football fans. In this regard, Article 13(1) of the Act Against Violence, Racism, Xenophobia and Intolerance in Sport gives the Commission the power to implement additional security measures for high risk competitions and events.

The Commission asked the Spanish DPA for a prior consultation (presumably under Article 36 GDPR) regarding the compliance of the envisaged processing with the GDPR. According to the Commission, the legal basis was Article 6(1)(e) GDPR, as processing was necessary for the performance of a task carried out in the public interest, such interest being the safety and integrity of persons attending football stadiums, as well as prevention of fundamental rights violations in the form of hate crimes and discrimination. Additionally, the Commission relied on Article 9(2)(g) GDPR, which refers to processing of sensitive data that is necessary for reasons of a substantial public interest.

The Commission indicated that it would issue a resolution defining the adequate and specific measures that clubs should undertake in order to protect the interests and fundamental rights of data subjects. The Commission also stated that it would carry out a proportionality assessment and an additional DPIA under Article 35 GDPR, in order to guarantee the adherence to the principles of Article 5 GDPR.

Holding

First, the Spanish DPA stated that the installation of biometric identification systems would constitute processing of special categories of data within the meaning of Article 9 GDPR. The DPA recalled the definition of ‘biometric data’ as meaning 'personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data' (Article 4(14) GDPR).

Second, the DPA emphasised the need to distinguish between biometric identification and biometric authentication, as defined by the Article 29 Working Party in Opinion 3/2012 on developments in biometric technologies. According to this Opinion, biometric identification means the identification of an individual by comparing biometric data acquired at the time of the identification to a number of biometric templates stored in a database, whereas biometric authentification means the verification of an individual by comparing the biometric data acquired at the time of the verification to a single biometric template stored in a device. The DPA relied in its assessment on the EDPB's Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement which uphold that both techniques constitute processing of special categories of data. The DPA manifested its concern for the proliferation of biometric identification systems, which are considered to be particularly intrusive for the rights and freedoms of data subjects.

Third, with regards to the envisaged legal basis, the DPA noted that Article 9(2)(g) GDPR makes reference to a substantial public interest, as opposed to the (standard) public interest contained in other provisions. Hence, according to the DPA, the interpretation of public interest must be more restrictive. The DPA referred to the Spanish Constitutional Court, which ruled that any limitations of the right to data protection must be set out in law and exist prior to any processing. Further, a legitimate aim pursued by the public interest cannot be laid down by general, indeterminate, or vague concepts and the limitation must be proportionate to the aim pursued. With reference to this, the DPA concluded that such a law did not exist in the Spanish acquis. The law referred to by the Commission (Article 13(1) of the Act Against Violence, Racism, Xenophobia and Intolerance in Sport) did not identify a justified substantial public interest or contain specific rules, nor did it provide for suitable and specific measures to safeguard the fundamental rights and interests of data subjects. While the provision referred to identity verification systems, it did not mention the specific possibility of using biometric systems.

Therefore, the DPA concluded that the envisaged processing, as schemed by the the Commission, could not rely on the legal basis of Article 9(2)(g) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.

Legal cabinet



                                                                 N/REF: 0098/2022




       The consultation asks if the adoption of an agreement of the State Commission

against Violence, Racism, Xenophobia and Intolerance, in the field of
their powers, establishing measures for the compliance of the clubs
consisting of the installation of biometric systems to control all
the accesses to the stands of animation that allows the unequivocal identification of
fans who access said stands, it would be legally viable

in accordance with the regulatory data protection regulations.

       Said possibility would be protected, according to the consultation, in the competition
legally attributed by article 13.1 of Law 19/2007, of July 11,
against violence, racism, xenophobia and intolerance in sport, which
the power to decide the implementation of additional security measures

for the set of competitions or highly rated sporting events
risk, or for venues that have been subject to closure sanctions with
according to the second and third titles of this Law, including in particular that of
b) Promote systems for verifying the identity of persons who process
access to sports venues.


       Therefore, in the opinion of the consultant, the treatment of the data
personal data of fans, including their biometric data, would be carried out in
application of article 6.1.e) of Regulation (EU) 2016/679 General of
Data Protection (RGPD), that is, that the processing of the data would be
necessary “for the fulfillment of a mission carried out in the public interest or

in the exercise of public powers conferred on the data controller”.
In this case, the mission carried out by the Clubs/SAD in the public interest would be the
to guarantee the safety and integrity of the people who come to the
football stadiums, as well as prevent and avoid violations of rights
of people, such as hate crimes and discrimination, to
through the measures listed above.


       Likewise, when referring to the requested measure to the treatment of categories
special data, the exception regulated in article 9.2.g) of the
GDPR, that is, that the processing of biometric data "is necessary for
reasons of essential public interest, on the basis of Union law

or of the Member States, which must be proportional to the objective pursued,
essentially respect the right to data protection and establish
appropriate and specific measures to protect the interests and rights
fundamentals of the interested party." In this regard, the agreement that in your case
adopts the CEVRXID, it would also establish the appropriate measures and
that the Clubs/SAD must adopt to protect the interests and

c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                        1 Legal Office

fundamental rights of the interested parties regarding the implementation of the
additional measure required, as required by article 9.2.g) of the GDPR,
previously referred to.


       It is also indicated that given that the additional measure would require the
treatment of special categories of data, the agreement adopted by the
CEVRXID in relation to the obligation to adopt the requested measure will require
also that, before implanting it, the following is carried out:


             - A trial of proportionality, where it is analyzed from the point
       From a data protection point of view, both the suitability of the measure and the
       need for treatment and its proportionality in the sense
       strict.
             - An Impact Assessment on Data Protection that
       meets the requirements of article 35 of the GDPR.

             In short, the measure would guarantee that the treatment of
       personal identification data (including biometrics) that perform
       Clubs/SAD is carried out with due respect for the principles
       legality, loyalty and transparency, purpose limitation, minimization
       of data, accuracy, conservation, security, as well as

       proactive responsibility, as established in article 5 of the GDPR.


       In this way, according to the consultant, the measure would guarantee that the
processing of personally identifiable data (including biometric data)
carried out by the Clubs/SAD is carried out duly respecting the

principles of legality, loyalty and transparency, limitation of purpose,
data minimization, accuracy, conservation, security, as well as
proactive responsibility, as established in article 5 of the GDPR.



                                           Yo

       Regulation (EU) 2016/679, of the European Parliament and of the Council of
April 27, 2016 regarding the protection of natural persons in what
regarding the processing of personal data and the free circulation of these
data and which repeals Directive 95/46/EC (General Regulation of

data protection, GDPR) defines in its article 4.14 the biometric data
as “personal data obtained from a specific technical treatment,
relating to the physical, physiological or behavioral characteristics of a
natural person that allow or confirm the unique identification of said
person, such as facial images or dactyloscopic data.


       Article 9 of said standard regulates the treatment of categories
special data types, including biometric data,
establishing a general prohibition of its treatment in the following
terms:
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                        2 Legal Office


       “The processing of personal data that reveals the
ethnic or racial origin, political opinions, religious convictions or
philosophical, or union affiliation, and the treatment of genetic data, data
biometrics aimed at uniquely identifying a natural person,

data relating to health or data relating to sexual life or orientation
sex of a physical person.”

       In relation to the processing of biometric data, in our
Report 36/2020, analyzing article 9.1 in relation to Recital 51
of the GDPR, as well as the Protocol of amendment to the Convention for the Protection

of Individuals regarding the processing of personal data, approved
by the Committee of Ministers at its 128th session in Elsinore on the 18th of
May 2018 (108+ Agreement) we pointed out that

             In order to clarify the interpretative doubts that arise
       regarding the consideration of biometric data as categories

       special data can resort to the distinction between identification
       biometrics and biometric verification/authentication that established the
       Article 29 Group in its Opinion 3/2012 on the evolution of the
       biometric technologies:
              Biometric identification: the identification of an individual by a
       biometric system is normally the process of comparing your data

       biometrics (acquired at the time of identification) with a series
       of biometric templates stored in a database (i.e.,
       a one-to-many mapping process).
             Biometric verification/authentication: Verification of a
       individual by a biometric system is normally the process of
       comparison between your biometric data (acquired at the time of

       verification) with a single biometric template stored in a
       device (i.e., a one-to-one mapping process
       to-one).

             This same differentiation is included in the White Paper on the
       artificial intelligence from the European Commission:


             “Regarding facial recognition, by “identification”
       it is understood that the facial image template of a person is
       compares with many other templates stored in a database
       to find out if your image is stored on it. The
       "authentication" (or "verification"), for its part, usually refers to

       searching for correspondences between two specific templates.
       Allows the comparison of two biometric templates that, in principle,
       they are supposed to belong to the same person; so, the two templates are
       are compared to determine if the person in the two images is the
       same. This procedure is used, for example, in the doors of

c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                       3 Legal Office

       automated border control used in border controls
       of the airports.

             Considering the aforementioned distinction, it can be interpreted that, if
       In accordance with article 4 of the GDPR, the concept of biometric data

       would include both assumptions, both the identification and the
       verification/authentication. However, and in general, the
       biometric data will only be considered as a category
       of data in the cases in which they are submitted to treatment
       technique aimed at biometric identification (one-to-many) and not in the
       biometric verification/authentication case (one-to-one).


             However, this Agency considers that it is a question
       complex, subject to interpretation, with respect to which it is not possible to
       draw general conclusions, having to attend to the specific case
       according to the data processed, the techniques used for its treatment and
       the consequent interference in the right to data protection,

       should, as long as the Committee does not rule on the matter
       European Data Protection Agency or the courts,
       In case of doubt, the most favorable interpretation for the
       protection of the rights of those affected.”

       Consequently, in said report this Agency already highlighted the

difficulty of separating the concepts of identification and authentication, which
requires to be aware of the specific case and the particular techniques used in
relation to the purpose pursued by the treatment, as well as the need
to grant maximum protection to the rights of those affected against the use
of techniques that can be more invasive to your privacy and generate more
risks to their rights and freedoms.


       However, said criterion was subject to what could be
established by the European Data Protection Committee or, where appropriate, by
the courts. And, in this sense, the Guidelines 5/2022 of the Committee
European Data Protection (Guidelines 05/2022 on the use of facial
recognition technology in the area of law enforcement) pending in this

time of final adoption after completion of the consultation process
public, they clearly depart from said differentiation between
authentication/verification and identification for the purpose of determining treatment
of biometric data as a special category in section 12, concluding
that both cases imply the treatment of special categories of
data:


             While both functions – authentication and identification – are
       distinct, they both relate to the processing of biometric data related to an
       identified or identifiable natural person and therefore constitute a
       processing of personal data, and more specifically a processing of
       special categories of personal data.
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                       4 Legal Office



       Consequently, if said criterion is maintained at the time the
proceeds to its final adoption, it will be necessary to review our criteria

to adapt it to that maintained by the European Committee for Data Protection,
understanding that the processing of biometric data, both in the cases of
authentication/verification as identification implies a treatment of
special categories of data, subject to the regime of general prohibition and
exceptions of article 9 of the GDPR.


       In any case, in the present case there is no doubt that the consultation was
refers to biometric data processing aimed at uniquely identifying
to a natural person and, therefore, which implies the treatment of categories
personal data specials.



                                           II

       The query refers to a case of biometric data processing
with the purpose of verifying to identify, unequivocally, the fans who

access the animation stands, implying, as indicated in the
previous section, a treatment of special categories of data subject to the
general rule of prohibition of the same (art. 9.1. GDPR).

       However, article 9.2 of the GDPR regulates exceptions to said
general prohibition, invoking in the consultation, specifically, the collection

in its letter g):

             g) the treatment is necessary for reasons of personal interest
       essential public, on the basis of Union or State law
       members, which must be proportional to the objective pursued, respect in

       the essential right to data protection and establish measures
       adequate and specific to protect the interests and rights
       fundamentals of the interested party;

       It is appropriate, therefore, to analyze whether in the present case the
budgets established in article 9.2.g) to lift the prohibition of

processing of biometric data, also taking into account the
jurisprudence of the Constitutional Court, the European Court of Rights
Rights and the Constitutional Court regarding the limitations of the right
fundamental to the protection of personal data.


       This Agency has had the opportunity to pronounce, on various occasions,
with respect to the requirements established by article 9.2.g) of the GDPR for
be able to cover the processing of biometric data, particularly with respect to
those based on facial recognition, given the proliferation of proposals
received in relation to them from different spheres, which shows
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                        5 Legal Office

manifest the growing interest in using these systems and the constant
concern of this control authority, as they are systems of
very intrusive to the fundamental rights and freedoms of
natural persons. Concern that is shared by the rest of

control authorities for years, as evidenced by the
Biometrics Working Paper, adopted on August 1, 2003 by the
Group of 29, or the subsequent Opinion 3/2012 on the evolution of the
biometric technologies, adopted on April 27, 2012, and which has led to
that the Community legislator himself include these data among the categories

special data in the GDPR. Thus, being prohibited
treatment in general, any exception to said prohibition will have
to be subject to restrictive interpretation.

       In this regard, it should be noted, in addition to the aforementioned report 36/2020,
referred to the use of facial recognition techniques in carrying out

online assessment tests, report 31/2019 on the incorporation of
facial recognition systems in video surveillance services under the
of article 42 of the Private Security Law or Report 97/2020 regarding the
Draft Order of the Minister of Economic Affairs and Transformation
Digital on non-presential identification methods for the issuance of

qualified electronic certificates. In all these cases it was concluded that
there was a legal standard in the Spanish legal system that met the
requirements of article 9.2.g) of the GDPR, so that the treatment only
could rely on the consent of those affected as long as it remained
guaranteed that it is free.


       Analyzing the requirements of article 9.2.g) in our Report 36/2020
we pointed out the following:

                                             V


             The next question that arises in the consultation is whether the
       processing of biometric data by recognition systems
       facial expression in online evaluation processes could rely on the
       existence of an essential public interest in accordance with article 9.2.g) of the
       GDPR:


             g) the processing is necessary for reasons of public interest
       essential, on the basis of Union or Member States law
       members, which must be proportional to the objective pursued, respect in
       the essential right to data protection and establish measures
       adequate and specific to protect the interests and rights

       fundamentals of the interested party.


             As we indicated previously, the data processing
       personnel necessary for the provision of the public service of
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                       6 Legal Office

       Higher education is legitimized, in general, in the existence of
       a public interest under the provisions of article 6.1.e) of the
       GDPR. However, in the case of special categories of data, the
       case contemplated in letter g) of article 9.2. does not refer only to

       the existence of a public interest, as it does in many other of
       its precepts the RGPD, but it is the only precept of the RGPD that
       requires that it be "essential", an adjective that comes to qualify
       said public interest, taking into account the importance and necessity of
       greater protection of the data processed.


             Said precept finds its precedent in article 8.4 of the
       Directive 95/46/EC of the European Parliament and of the Council of 24
       October 1995, regarding the protection of natural persons in terms of
       that respects the processing of personal data and the free movement of
       these data: “4. As long as they have adequate guarantees, the

       Member States may, for reasons of important public interest,
       establish other exceptions, in addition to those provided for in section 2,
       either through their national legislation, or by decision of the authority
       of control". However, its reading results in greater rigor in a new
       regulation by the GDPR, since the adjective "important" is replaced by

       "essential" and it is not allowed that the exception can be established by the
       control authorities.

             In relation to what should be understood by public interest
       essential, the Jurisprudence of the
       European Court of Human Rights, which under Article 8

       of the European Convention on Human Rights, has been considering that
       the processing of personal data constitutes a lawful interference in the
       right to respect for private life and can only be carried out if
       performed in accordance with the law, serves a legitimate purpose, respects the
       essence of fundamental rights and freedoms and it is necessary and

       provided in a democratic society to achieve an end
       legitimate ( D.L. against Bulgaria, nº 7472/14, May 19, 2016,
       Dragojević v. Croatia, no. 68955/11, January 15, 2015, Peck
       v. United Kingdom, No. 44647/98, January 28, 2003, Leander v.
       Sweden, no. 9248/81, March 26, 1987, among others). As he points out
       In the last sentence cited, "the concept of necessity implies that the

       interference responds to a pressing social need and, in particular,
       that is proportionate to the legitimate aim that it pursues”.

             Likewise, the doctrine of the Court must be taken into account
       Constitutional regarding the restrictions to the fundamental right to

       data protection, which is summarized in judgment 292/2000, dated 30
       November, in which after configuring the fundamental right to
       protection of personal data as an autonomous right and
       independent power that consists of a power of disposition and control
       on personal data that empowers the person to decide which
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                       7 Legal Office

      of these data to provide to a third party, be it the State or an individual, or
      which this third party can collect, and which also allows the individual
      know who owns that personal data and for what, being able to
      oppose that possession or use, analyzes its limits, pointing out

      in the following:

             More specifically, in the Judgments mentioned regarding the
      data protection, this Court has declared that the right to
      Data protection is not unlimited, and although the Constitution does not

      expressly impose specific limits, nor refer to the Powers
      Public for its determination as it has done with other rights
      fundamental, there is no doubt that they will find them in the
      remaining fundamental rights and legal rights
      constitutionally protected, as required by the principle of unity
      of the Constitution (SSTC 11/1981, of April 8, F. 7; 196/1987, of April 11,

      December [RTC 1987, 196], F. 6; and regarding art. 18, JTS
      110/1984, F. 5). These limits may either be direct restrictions of the
      fundamental right itself, which has been alluded to before, or
      may be restrictions on the way, time or place of exercise of the
      fundamental right. In the first case, regulating those limits is a

      form of development of the fundamental right. In the second, the limits
      that are fixed are to the concrete form in which it is possible to exert the beam of
      faculties that make up the content of the fundamental right in
      matter, constituting a way of regulating its exercise, which
      The ordinary legislator can do in accordance with the provisions of art. 53.1
      EC. The first observation that must be made, which is not obvious, is

      less capital, is that the Constitution has wanted the Law, and only the
      Law, can set the limits to a fundamental right. Rights
      Fundamentals can, of course, yield to goods, and even
      constitutionally relevant interests, provided that the cut that
      undergo is necessary to achieve the intended legitimate purpose,

      provided to achieve it and, in any case, be respectful of the
      essential content of the restricted fundamental right (SSTC 57/1994,
      of February 28 [RTC 1994, 57], F. 6; 18/1999, of February 22 [RTC
      1999, 18], F. 2).

             Precisely, if the Law is the only one authorized by the Constitution

      to set limits to fundamental rights and, in the case
      present, to the fundamental right to data protection, and those
      limits cannot be different from those constitutionally established, which
      for the case are none other than those derived from the coexistence of this
      fundamental right with other legal rights and goods of rank

      constitutional, the legal empowerment that allows a Public Power
      collect, store, process, use and, where appropriate, transfer personal data,
      it is only justified if it responds to the protection of other rights
      constitutionally protected assets or assets. So if
      those operations with the personal data of a person are not
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      8 Legal Office

       carried out with strict observance of the norms that regulate it,
       violates the right to data protection, since limits are imposed
       constitutionally illegitimate, either to its content or to the exercise of the
       bundle of faculties that compose it. How will that violate it too?
       Limitative law if it regulates the limits in such a way that they make the

       fundamental right affected or ineffective the guarantee that the Constitution
       grants you And so it will be when the Law, which should regulate the limits to
       fundamental rights with scrupulous respect for their content
       essential, is limited to empowering another Public Power to establish in each
       the restrictions that may be imposed on the rights
       fundamentals, whose unique determination and application will be at risk

       of the decisions adopted by that Public Power, who may decide, in
       what interests us now, about obtaining, storing,
       treatment, use and transfer of personal data in the cases that it deems
       convenient and brandishing, even, interests or assets that are not
       protected with constitutional rank […]”. (Legal Basis 11)




             “On the one hand, because although this Court has declared that the
       The Constitution does not prevent the State from protecting legal rights or assets to
       cost of the sacrifice of others equally recognized and, therefore, that the
       legislator may impose limitations on the content of rights

       fundamentals or their exercise, we have also specified that, in such
       assumptions, these limitations must be justified in the protection
       of other rights or constitutional goods (SSTC 104/2000, of 13 December
       April [ RTC 2000, 104] , F. 8 and those cited there) and, in addition, they must be
       proportionate to the purpose pursued with them (SSTC 11/1981, F. 5, and
       196/1987, F. 6). Well, otherwise they would incur in arbitrariness

       proscribed by art. 9.3 EC.
             On the other hand, even having a constitutional foundation and
       being proportionate the limitations of the fundamental right
       established by Law ( STC 178/1985 [ RTC 1985, 178] ), these
       may violate the Constitution if they suffer from a lack of certainty and
       predictability in the very limits they impose and their way of

       application. Conclusion that is corroborated by the Court's jurisprudence
       European Commission on Human Rights that has been cited in F. 8 and that here
       must be reproduced. And it should also be noted that not only
       would harm the principle of legal certainty (art. 9.3 CE), conceived
       as certainty about the applicable law and expectation
       reasonably founded of the person on what should be the performance

       of power applying the Law (STC 104/2000, F. 7, for all), but
       that at the same time said Law would be harming the essential content
       of the fundamental right thus restricted, given that the way in which it is
       have set their limits make it unrecognizable and make it impossible, in the
       practice, its exercise (SSTC 11/1981, F. 15; 142/1993, of April 22
       [ RTC 1993, 142] , F. 4, and 341/1993, of November 18 [ RTC 1993,
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                       9 Legal Office

       341], F. 7). So that the lack of precision of the Law in the
       material assumptions of the limitation of a fundamental right is
       likely to generate an indeterminacy about the cases to which
       apply such a restriction. And when this result occurs, beyond all

       reasonable interpretation, the Law no longer fulfills its function of guaranteeing the
       own fundamental right that it restricts, since it allows instead
       simply operate the will of who has to apply it, undermining
       thus both the effectiveness of the fundamental right and the legal certainty
       […]”. (FJ 15).


             “More specifically, in relation to the fundamental right to
       privacy we have highlighted not only the need for your
       possible limitations are based on a legal provision that has
       constitutional justification and that they be proportionate (SSTC 110/1984,
       F. 3, and 254/1993, F. 7) but the Law that restricts this right must

       accurately express each and every material budget
       of the limiting measure. Otherwise, it is wrong to understand that the
       judicial resolution or the administrative act that applies it are founded
       in the Law, since what it has done, making abandonment of its
       functions, is to empower other Public Powers so that they are

       who set the limits to the fundamental right (SSTC 37/1989, of 15
       of February [RTC 1989, 37], and 49/1999, of April 5 [RTC 1999, 49]).
             Similarly, regarding the right to data protection
       personal, it can be estimated that the constitutional legitimacy of the
       restriction of this right cannot be based, by itself, on the
       activity of the Public Administration. Nor is it enough that the Law

       empowers it to specify its limits in each case, limiting itself to
       indicate that you must make such precision when there is any right or
       well constitutionally protected. It is the legislator who must
       determine when that good or right that justifies the
       restriction of the right to the protection of personal data and in what

       circumstances can be limited and, furthermore, it is he who must do it
       by means of precise rules that make the interested party foreseeable
       imposition of such limitation and its consequences. Well, in another case
       legislator would have transferred to the Administration the performance of a
       function that only corresponds to him in terms of fundamental rights in
       By virtue of the legal reservation of art. 53.1 CE, that is, establish

       clearly the limit and its regulation. […] (FJ 16)”.


             Likewise, our Constitutional Court has already had the opportunity
       to rule specifically on article 9.2.g) of the GDPR,

       as a consequence of the challenge of article 58 bis of the Law
       Organic 5/1985, of June 19, of the General Electoral Regime,
       introduced by the third final provision of Organic Law 3/2018, of
       December 5, Protection of Personal Data and guarantee of the
       digital rights, regarding the legitimacy of data collection
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      10 Legal Office

      personal information relating to the political opinions of the persons who carry
      carried out by political parties in the framework of their electoral activities,
      precept that was declared unconstitutional by Judgment no.
      76/2019 of May 22.


             Said sentence analyzes, firstly, the legal regime to which
      that is subject to the treatment of the special categories
      of data in the GDPR:

             In accordance with paragraph 1 of art. 9 GDPR, the
      processing of personal data that reveal political opinions,

      in the same way as the processing of personal data that reveals
      ethnic or racial origin, religious or philosophical convictions or
      trade union membership and processing of genetic data, biometric data
      aimed at uniquely identifying a natural person, data
      relating to health or data relating to sexual life or orientation
      sex of a natural person. However, section 2 of the same

      precept authorizes the processing of all such data when concurs
      any of the ten circumstances provided therein [letters a) to j)]. Some of
      These circumstances have a limited scope of application (labor,
      social, associative, health, judicial, etc.) or respond to a purpose
      determined, therefore, in themselves, delimit the treatments
      that authorize as an exception to the general rule. Besides, the

      enabling efficacy of several of the assumptions provided therein is
      conditioned to the fact that the Law of the Union or that of the States
      members expressly foresee and regulate them in their scope of
      competences: this is the case of the circumstances included in letters
      a), b), g), h), i) and j).
             Processing of special categories of personal data

      is one of the areas in which the Regulation expressly
      General of Data Protection has recognized the Member States
      "room for manoeuvre" when it comes to "specifying its rules", as
      qualifies its recital 10. This margin of legislative configuration
      extends both to the determination of the enabling causes for
      the processing of specially protected personal data -is

      that is, to the identification of the purposes of essential public interest and the
      assessment of the proportionality of the treatment to the end
      persecuted, essentially respecting the right to protection of
      data - such as the establishment of "adequate measures and
      to protect the interests and fundamental rights
      of the interested party" [art. 9.2 g) GDPR]. The Regulation contains, for

      Therefore, a concrete obligation of the Member States of
      establish such guarantees, in the event that they enable to treat
      specially protected personal data.

             In relation to the first of the requirements demanded by article
      9.2.g), the invocation of an essential public interest and the necessary
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      11 Legal Office

       specification thereof, the High Court recalls what was stated in its
       judgment 292/2000 in which it was rejected that the identification of the
       legitimate purposes of the restriction could be done through concepts
       generic or vague formulas, considering that the restriction of the right

       fundamental to the protection of personal data cannot be based,
       by itself, in the generic invocation of an indeterminate "interest
       public" :

             In the aforementioned STC 292/2000 (RTC 2000, 292), in which

       Legislative interference in the right to
       protection of personal data, we reject that the identification of the
       legitimate purposes of the restriction could be done through concepts
       generic or vague formulas:
             "16. [...] In the same way, regarding the right to the protection of
       personal data, it can be estimated that the constitutional legitimacy of the

       restriction of this right cannot be based, by itself, on the
       activity of the Public Administration. Nor is it enough that the Law
       empowers it to specify its limits in each case, limiting itself to
       indicate that you must make such precision when there is any right or
       well constitutionally protected. It is the legislator who must

       determine when that good or right that justifies the
       restriction of the right to the protection of personal data and in what
       circumstances can be limited and, furthermore, it is he who must do it
       by means of precise rules that make the interested party foreseeable
       imposition of such limitation and its consequences. Well, in another case
       legislator would have transferred to the Administration the performance of a

       function that only corresponds to him in terms of fundamental rights in
       By virtue of the legal reservation of art. 53.1 CE, that is, establish
       clearly the limit and its regulation.
             17. In the present case, employment by the LOPD (RCL 2018, 1629)
       in his art. 24.1 of the expression "control and verification functions", opens

       a space of uncertainty so wide that it causes a double and
       perverse consequence. On the one hand, by enabling the LOPD to the
       Administration to restrict fundamental rights invoking
       such an expression is renouncing to set the limits itself,
       empowering the Administration to do so. And in such a way that
       As the Ombudsman points out, it allows redirecting the same

       practically all administrative activity, since all activity
       administration that involves establishing a legal relationship with a
       administered, which will be the case in practically all cases in which
       the Administration needs someone's personal data, it will entail
       Ordinarily the authority of the Administration to verify and control that this

       administered has acted in accordance with the administrative legal regime of
       the legal relationship established with the Administration. which, in view of
       reason for restriction of the right to be informed of art. 5 LOPD, leave
       in the most absolute uncertainty to the citizen about in which cases
       this circumstance will occur (if not in all) and add to the inefficiency
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      12 Legal Office

      any jurisdictional guardianship mechanism that must prosecute
      Such an assumption of restriction of fundamental rights without another
      complementary criterion that comes to the aid of its control of the
      administrative action in this matter.

             The same reproaches also deserve the use in art. 24.2
      LOPD of the expression "public interest" as the basis of the
      imposition of limits to the fundamental rights of art. 18.1 and 4 CE,
      because it contains an even greater degree of uncertainty. just notice
      that all administrative activity, ultimately, pursues the

      safeguarding of general interests, the achievement of which constitutes the
      purpose to which the Administration must objectively serve with
      according to art. 103.1 CE."
             This argument is fully transferable to the present
      prosecution. Similarly, therefore, we must conclude that the
      constitutional legitimacy of the restriction of the fundamental right to

      personal data protection cannot be based, by itself, on the
      generic invocation of an indeterminate "public interest". well in another
      case, the legislator would have transferred the political parties -whom the
      challenged provision empowers to collect personal data relating to
      to the political opinions of people in the framework of their activities

      elections - the performance of a function that is the sole responsibility of him in
      matter of fundamental rights by virtue of the reservation of the Law of the
      art. 53.1 CE, that is, clearly establish its limits and its regulation.
             Nor can it be accepted, as equally imprecise, the purpose
      adduced by the lawyer of the State, which refers to the functioning of the
      democratic system, since it also contains a high degree of

      uncertainty and may involve circular reasoning. On the one hand,
      political parties are by themselves "necessary channels for the
      functioning of the democratic system" (for all, STC 48/2003, of
      March 12 (RTC 2003, 48), FJ 5); and, on the other hand, all
      functioning of the democratic system pursues, ultimately, the

      safeguarding of constitutional aims, values and assets, but this does not
      reaches to identify the reason why the right should be restricted
      fundamental affected.
             Finally, it should be specified that it is not necessary to be able to
      suspect, with greater or lesser grounds, that the restriction pursues
      an unconstitutional purpose, or that the data collected and

      processed will be harmful to the private sphere and the exercise of rights.
      rights of individuals. It is enough to note that, by not
      to be able to identify with sufficient precision the purpose of the treatment
      of data, the constitutional character cannot be prosecuted
      legitimate use of that purpose, nor, where appropriate, the proportionality of the

      measure provided in accordance with the principles of suitability, necessity and
      proportionality in the strict sense.



c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      13 Legal Office

             On the other hand, regarding the guarantees that the
      legislator, the aforementioned judgment no. 76/2019 of May 22, after
      remember that "In view of the potential intrusive effects on the
      affected fundamental right resulting from data processing
      personal data, the jurisprudence of this Court requires the legislator to,

      In addition to meeting the aforementioned requirements, you also
      establish adequate guarantees of a technical, organizational and
      procedural, that prevent risks of different probability and
      severity and mitigate its effects, because only in this way can the
      respect for the essential content of the fundamental right itself”, analyzes
      What is the norm that must contain the aforementioned guarantees:


             "Therefore, the resolution of this challenge requires that
      clarify a doubt raised regarding the scope of our
      doctrine on adequate guarantees, which consists of determining whether
      adequate guarantees against the use of information technology must
      be contained in the law that authorizes and regulates that use or may

      can also be found in other normative sources.
             The question can only have a constitutional answer. The
      provision of adequate guarantees cannot be deferred to a moment
      after the legal regulation of the processing of personal data of
      in question Appropriate safeguards should be built into the
      own legal regulation of the treatment, either directly or through

      express and perfectly delimited reference to external sources that
      have the appropriate regulatory status. Only that understanding is
      compatible with the double requirement arising from art. 53.1 EC (RCL
      1978, 2836) for the legislator of fundamental rights: the reservation
      of law for the regulation of the exercise of fundamental rights
      recognized in the second chapter of the first title of the Constitution

      and respect for the essential content of said fundamental rights.
             According to reiterated constitutional doctrine, the reserve of law is not
      limited to requiring that a law enable the restrictive measure of rights
      fundamental, but it is also necessary, according to both
      requirements called -sometimes- normative predetermination and
      -others- regarding the quality of the law as well as respect for the essential content of the

      law, that in this regulation the legislator, who is obliged to
      primary way to weigh the rights or interests in conflict,
      predetermine the assumptions, conditions and guarantees in which
      the adoption of restrictive measures of rights is appropriate
      fundamental. That mandate of predetermination regarding
      essential elements, also ultimately linked to the judgment of

      proportionality of the limitation of the fundamental right, cannot
      be deferred to a subsequent legal or regulatory development, nor
      it can be left in the hands of the individuals themselves” (FJ 8).

             Therefore, the processing of biometric data to the
      under article 9.2.g) requires that it be provided for in a standard
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                     14 Legal Office

      of European or national law, having in the latter case
      said norm, according to the aforementioned constitutional doctrine and the provisions
      in article 9.2 of the LOPDGDD, rank of law. Said law shall,
      also specify the essential public interest that justifies the

      restriction of the right to the protection of personal data and in
      what circumstances can be limited, establishing the rules
      that make the imposition of such a law foreseeable to the interested party
      limitation and its consequences, without it being sufficient, to these
      effects, the generic invocation of a public interest. and said law

      must also establish the appropriate type of guarantees
      technical, organizational and procedural, that prevent risks
      of different probability and severity and mitigate their effects.

             In addition, said law must in all cases respect the principle
      of proportionality, as recalled in the Judgment of the Court

      Constitutional 14/2003, of January 28:

             In other words, pursuant to a settled doctrine of
      this Court, the constitutionality of any restrictive measure of
      fundamental rights is determined by the strict observance

      of the principle of proportionality. For the purposes that matter here enough
      remember that, in order to check whether a restrictive measure of a
      fundamental right overcomes the proportionality judgment, it is necessary
      verify if it meets the following three requirements or conditions: if the
      measure is capable of achieving the proposed objective (judgment of
      suitability); if, moreover, it is necessary, in the sense that there is no other

      more moderate measure for the achievement of such purpose with the same
      effectiveness (judgment of necessity); and, finally, if it is weighted or
      balanced, because it derives from it more benefits or advantages for the
      general interest than damages to other goods or values in conflict
      (judgment of proportionality in the strict sense; SSTC 66/1995, of 8

      May [RTC 1995, 66], F. 5; 55/1996, of March 28 [RTC 1996, 55]
      , FF. 7, 8 and 9; 270/1996, of December 16 [RTC 1996, 270], F. 4.e;
      37/1998, of February 17 [RTC 1998, 37], F. 8; 186/2000, of 10
      July [ RTC 2000, 186] , F. 6).”



             The conclusions reached in the aforementioned case are transferable to the
present, since the treatment of the special categories of data
seeks to rely on the power of the Commission to promote systems of
verification of the identity of the people who try to access the premises
sports, under the terms provided in article 13.1. of Law 19/2007, of

July 11.

      Said precept is developed by article 15.3 of the Royal Decree
203/2010, of February 26, which approves the Regulation of

c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      15 Legal Office

prevention of violence, racism, xenophobia and intolerance in the
sport:

             3. In the cases contemplated in article 13.1 of the Law

       19/2007, of July 11, verification and monitoring of identity
       of those who purchase tickets or control the distribution of
       localities will be carried out by implementing ticket sales systems
       nominative and developing procedures that allow to supervise the
       distribution of assigned locations and to know the identity of the

       holders of access titles to sports facilities.
             The treatment of the data obtained in accordance with these
       procedures will be limited to providing information on who
       access or attempt to access sports venues, with the purpose of
       to ensure compliance with existing prohibitions and, where appropriate,
       case, purge the responsibilities that may arise.

             The organizers will cancel the data of the people who
       they would have accessed the sporting event when it concludes,
       keeping exclusively the data necessary to identify
       who may have engaged in conduct prohibited by law
       19/2007, of July 11, which may only be transferred to the authorities or

       competent bodies in matters of public safety.


       As can be seen, article 13.1 of Law 19/2007, of 11 December
July refers to identity verification systems, but does not
considers the possibility that said systems may involve treatments

of biometric data, nor does it establish the pertinent and adequate guarantees for
the protection of the fundamental right to the protection of personal data.
This possibility is not provided for in article 15.3 of the Royal Decree either.
203/2010, of February 26, although it should be noted that said standard
would lack, as has been explained, the appropriate legal status for

proceed to the regulation of the treatment of special categories of data
personal.


       Therefore, claiming in the processing of personal data
included in the special categories of data referred to in the article

9.1. of the RGPD, since it is about biometric data directed to the
identification of natural persons, it is a prerequisite that some
of the circumstances contemplated in section 2 that lifts the prohibition
of treatment of said data, established in general in its
section 1, requiring article 9.2. of the LOPDGDD that "Treatments of

data referred to in letters g), h) and i) of article 9.2 of Regulation (EU)
2016/679 founded on Spanish law must be covered by a
standard with the force of law, which may establish additional requirements relating to
your security and confidentiality. not existing, as indicated, norm
that enables said treatment under article 9.2.g) of the GDPR, since
c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                      16 Legal Office

that article 13.1. does not meet the legal requirements and
jurisprudentially, as has been analyzed in the present

report.

      And without said gap being able to be filled by means of an agreement of the
CEVRXID, as it does not have the appropriate regulatory range. In this sense, as already

As indicated, the jurisprudence of the Constitutional Court is clear regarding
of the norm that must contain the adequate guarantees that cannot be
be deferred to a time after the legal regulation of data processing
personal in question. Adequate safeguards must be incorporated
to the legal regulation of the treatment itself, either directly or by referral

expressly and perfectly delimited to external sources that have the rank
adequate normative (Ruling 76/2019 of May 22, FJ 8)


      Consequently, it must be concluded that the adoption of an agreement

of the State Commission against Violence, Racism, Xenophobia and
Intolerance, within the scope of its powers, establishing measures
for the compliance of the clubs consisting of the installation of
biometric systems for the control of all access to the stands of

animation that allows the unequivocal identification of the fans who
access said stands, is not in accordance with the regulations governing
Data Protection.





























c. Jorge Juan 6 www.aepd.es
28001 Madrid
                                     17