AEPD (Spain) - 0098/2022
|AEPD - 0098/2022|
|Relevant Law:||Article 6(1)(e) GDPR|
Article 9(2)(g) GDPR
Act Against Violence, Racism, Xenophobia and Intolerance in Sport
|Parties:||Comisión Estatal contra la Violencia, el Racismo, la Xenofobia y la Intolerancia|
|National Case Number/Name:||0098/2022|
|European Case Law Identifier:||n/a|
|Original Source:||AEPD (in ES)|
|Initial Contributor:||Carmen Villarroel|
In a prior consultation, the Spanish DPA held that the State Commission Against Violence, Racism, Xenophobia and Intolerance in Sport could not rely on Article 9(2)(g) GDPR in order to process biometric data of football fans entering stadiums.
English Summary[edit | edit source]
Facts[edit | edit source]
The State Commission Against Violence, Racism, Xenophobia and Intolerance in Sport (the Commission) wanted to install biometric identification systems at the entrances to sport stadiums in order to univocally identify football fans. In this regard, Article 13(1) of the Act Against Violence, Racism, Xenophobia and Intolerance in Sport gives the Commission the power to implement additional security measures for high risk competitions and events.
The Commission asked the Spanish DPA for a prior consultation (presumably under Article 36 GDPR) regarding the compliance of the envisaged processing with the GDPR. According to the Commission, the legal basis was Article 6(1)(e) GDPR, as processing was necessary for the performance of a task carried out in the public interest, such interest being the safety and integrity of persons attending football stadiums, as well as prevention of fundamental rights violations in the form of hate crimes and discrimination. Additionally, the Commission relied on Article 9(2)(g) GDPR, which refers to processing of sensitive data that is necessary for reasons of a substantial public interest.
The Commission indicated that it would issue a resolution defining the adequate and specific measures that clubs should undertake in order to protect the interests and fundamental rights of data subjects. The Commission also stated that it would carry out a proportionality assessment and an additional DPIA under Article 35 GDPR, in order to guarantee the adherence to the principles of Article 5 GDPR.
Holding[edit | edit source]
First, the Spanish DPA stated that the installation of biometric identification systems would constitute processing of special categories of data within the meaning of Article 9 GDPR. The DPA recalled the definition of ‘biometric data’ as meaning 'personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data' (Article 4(14) GDPR).
Second, the DPA emphasised the need to distinguish between biometric identification and biometric authentication, as defined by the Article 29 Working Party in Opinion 3/2012 on developments in biometric technologies. According to this Opinion, biometric identification means the identification of an individual by comparing biometric data acquired at the time of the identification to a number of biometric templates stored in a database, whereas biometric authentification means the verification of an individual by comparing the biometric data acquired at the time of the verification to a single biometric template stored in a device. The DPA relied in its assessment on the EDPB's Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement which uphold that both techniques constitute processing of special categories of data. The DPA manifested its concern for the proliferation of biometric identification systems, which are considered to be particularly intrusive for the rights and freedoms of data subjects.
Third, with regards to the envisaged legal basis, the DPA noted that Article 9(2)(g) GDPR makes reference to a substantial public interest, as opposed to the (standard) public interest contained in other provisions. Hence, according to the DPA, the interpretation of public interest must be more restrictive. The DPA referred to the Spanish Constitutional Court, which ruled that any limitations of the right to data protection must be set out in law and exist prior to any processing. Further, a legitimate aim pursued by the public interest cannot be laid down by general, indeterminate, or vague concepts and the limitation must be proportionate to the aim pursued. With reference to this, the DPA concluded that such a law did not exist in the Spanish acquis. The law referred to by the Commission (Article 13(1) of the Act Against Violence, Racism, Xenophobia and Intolerance in Sport) did not identify a justified substantial public interest or contain specific rules, nor did it provide for suitable and specific measures to safeguard the fundamental rights and interests of data subjects. While the provision referred to identity verification systems, it did not mention the specific possibility of using biometric systems.
Therefore, the DPA concluded that the envisaged processing, as schemed by the the Commission, could not rely on the legal basis of Article 9(2)(g) GDPR.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
Legal cabinet N/REF: 0098/2022 The consultation asks if the adoption of an agreement of the State Commission against Violence, Racism, Xenophobia and Intolerance, in the field of their powers, establishing measures for the compliance of the clubs consisting of the installation of biometric systems to control all the accesses to the stands of animation that allows the unequivocal identification of fans who access said stands, it would be legally viable in accordance with the regulatory data protection regulations. Said possibility would be protected, according to the consultation, in the competition legally attributed by article 13.1 of Law 19/2007, of July 11, against violence, racism, xenophobia and intolerance in sport, which the power to decide the implementation of additional security measures for the set of competitions or highly rated sporting events risk, or for venues that have been subject to closure sanctions with according to the second and third titles of this Law, including in particular that of b) Promote systems for verifying the identity of persons who process access to sports venues. Therefore, in the opinion of the consultant, the treatment of the data personal data of fans, including their biometric data, would be carried out in application of article 6.1.e) of Regulation (EU) 2016/679 General of Data Protection (RGPD), that is, that the processing of the data would be necessary “for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the data controller”. In this case, the mission carried out by the Clubs/SAD in the public interest would be the to guarantee the safety and integrity of the people who come to the football stadiums, as well as prevent and avoid violations of rights of people, such as hate crimes and discrimination, to through the measures listed above. Likewise, when referring to the requested measure to the treatment of categories special data, the exception regulated in article 9.2.g) of the GDPR, that is, that the processing of biometric data "is necessary for reasons of essential public interest, on the basis of Union law or of the Member States, which must be proportional to the objective pursued, essentially respect the right to data protection and establish appropriate and specific measures to protect the interests and rights fundamentals of the interested party." In this regard, the agreement that in your case adopts the CEVRXID, it would also establish the appropriate measures and that the Clubs/SAD must adopt to protect the interests and c. Jorge Juan 6 www.aepd.es 28001 Madrid 1 Legal Office fundamental rights of the interested parties regarding the implementation of the additional measure required, as required by article 9.2.g) of the GDPR, previously referred to. It is also indicated that given that the additional measure would require the treatment of special categories of data, the agreement adopted by the CEVRXID in relation to the obligation to adopt the requested measure will require also that, before implanting it, the following is carried out: - A trial of proportionality, where it is analyzed from the point From a data protection point of view, both the suitability of the measure and the need for treatment and its proportionality in the sense strict. - An Impact Assessment on Data Protection that meets the requirements of article 35 of the GDPR. In short, the measure would guarantee that the treatment of personal identification data (including biometrics) that perform Clubs/SAD is carried out with due respect for the principles legality, loyalty and transparency, purpose limitation, minimization of data, accuracy, conservation, security, as well as proactive responsibility, as established in article 5 of the GDPR. In this way, according to the consultant, the measure would guarantee that the processing of personally identifiable data (including biometric data) carried out by the Clubs/SAD is carried out duly respecting the principles of legality, loyalty and transparency, limitation of purpose, data minimization, accuracy, conservation, security, as well as proactive responsibility, as established in article 5 of the GDPR. Yo Regulation (EU) 2016/679, of the European Parliament and of the Council of April 27, 2016 regarding the protection of natural persons in what regarding the processing of personal data and the free circulation of these data and which repeals Directive 95/46/EC (General Regulation of data protection, GDPR) defines in its article 4.14 the biometric data as “personal data obtained from a specific technical treatment, relating to the physical, physiological or behavioral characteristics of a natural person that allow or confirm the unique identification of said person, such as facial images or dactyloscopic data. Article 9 of said standard regulates the treatment of categories special data types, including biometric data, establishing a general prohibition of its treatment in the following terms: c. Jorge Juan 6 www.aepd.es 28001 Madrid 2 Legal Office “The processing of personal data that reveals the ethnic or racial origin, political opinions, religious convictions or philosophical, or union affiliation, and the treatment of genetic data, data biometrics aimed at uniquely identifying a natural person, data relating to health or data relating to sexual life or orientation sex of a physical person.” In relation to the processing of biometric data, in our Report 36/2020, analyzing article 9.1 in relation to Recital 51 of the GDPR, as well as the Protocol of amendment to the Convention for the Protection of Individuals regarding the processing of personal data, approved by the Committee of Ministers at its 128th session in Elsinore on the 18th of May 2018 (108+ Agreement) we pointed out that In order to clarify the interpretative doubts that arise regarding the consideration of biometric data as categories special data can resort to the distinction between identification biometrics and biometric verification/authentication that established the Article 29 Group in its Opinion 3/2012 on the evolution of the biometric technologies: Biometric identification: the identification of an individual by a biometric system is normally the process of comparing your data biometrics (acquired at the time of identification) with a series of biometric templates stored in a database (i.e., a one-to-many mapping process). Biometric verification/authentication: Verification of a individual by a biometric system is normally the process of comparison between your biometric data (acquired at the time of verification) with a single biometric template stored in a device (i.e., a one-to-one mapping process to-one). This same differentiation is included in the White Paper on the artificial intelligence from the European Commission: “Regarding facial recognition, by “identification” it is understood that the facial image template of a person is compares with many other templates stored in a database to find out if your image is stored on it. The "authentication" (or "verification"), for its part, usually refers to searching for correspondences between two specific templates. Allows the comparison of two biometric templates that, in principle, they are supposed to belong to the same person; so, the two templates are are compared to determine if the person in the two images is the same. This procedure is used, for example, in the doors of c. Jorge Juan 6 www.aepd.es 28001 Madrid 3 Legal Office automated border control used in border controls of the airports. Considering the aforementioned distinction, it can be interpreted that, if In accordance with article 4 of the GDPR, the concept of biometric data would include both assumptions, both the identification and the verification/authentication. However, and in general, the biometric data will only be considered as a category of data in the cases in which they are submitted to treatment technique aimed at biometric identification (one-to-many) and not in the biometric verification/authentication case (one-to-one). However, this Agency considers that it is a question complex, subject to interpretation, with respect to which it is not possible to draw general conclusions, having to attend to the specific case according to the data processed, the techniques used for its treatment and the consequent interference in the right to data protection, should, as long as the Committee does not rule on the matter European Data Protection Agency or the courts, In case of doubt, the most favorable interpretation for the protection of the rights of those affected.” Consequently, in said report this Agency already highlighted the difficulty of separating the concepts of identification and authentication, which requires to be aware of the specific case and the particular techniques used in relation to the purpose pursued by the treatment, as well as the need to grant maximum protection to the rights of those affected against the use of techniques that can be more invasive to your privacy and generate more risks to their rights and freedoms. However, said criterion was subject to what could be established by the European Data Protection Committee or, where appropriate, by the courts. And, in this sense, the Guidelines 5/2022 of the Committee European Data Protection (Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement) pending in this time of final adoption after completion of the consultation process public, they clearly depart from said differentiation between authentication/verification and identification for the purpose of determining treatment of biometric data as a special category in section 12, concluding that both cases imply the treatment of special categories of data: While both functions – authentication and identification – are distinct, they both relate to the processing of biometric data related to an identified or identifiable natural person and therefore constitute a processing of personal data, and more specifically a processing of special categories of personal data. c. Jorge Juan 6 www.aepd.es 28001 Madrid 4 Legal Office Consequently, if said criterion is maintained at the time the proceeds to its final adoption, it will be necessary to review our criteria to adapt it to that maintained by the European Committee for Data Protection, understanding that the processing of biometric data, both in the cases of authentication/verification as identification implies a treatment of special categories of data, subject to the regime of general prohibition and exceptions of article 9 of the GDPR. In any case, in the present case there is no doubt that the consultation was refers to biometric data processing aimed at uniquely identifying to a natural person and, therefore, which implies the treatment of categories personal data specials. II The query refers to a case of biometric data processing with the purpose of verifying to identify, unequivocally, the fans who access the animation stands, implying, as indicated in the previous section, a treatment of special categories of data subject to the general rule of prohibition of the same (art. 9.1. GDPR). However, article 9.2 of the GDPR regulates exceptions to said general prohibition, invoking in the consultation, specifically, the collection in its letter g): g) the treatment is necessary for reasons of personal interest essential public, on the basis of Union or State law members, which must be proportional to the objective pursued, respect in the essential right to data protection and establish measures adequate and specific to protect the interests and rights fundamentals of the interested party; It is appropriate, therefore, to analyze whether in the present case the budgets established in article 9.2.g) to lift the prohibition of processing of biometric data, also taking into account the jurisprudence of the Constitutional Court, the European Court of Rights Rights and the Constitutional Court regarding the limitations of the right fundamental to the protection of personal data. This Agency has had the opportunity to pronounce, on various occasions, with respect to the requirements established by article 9.2.g) of the GDPR for be able to cover the processing of biometric data, particularly with respect to those based on facial recognition, given the proliferation of proposals received in relation to them from different spheres, which shows c. Jorge Juan 6 www.aepd.es 28001 Madrid 5 Legal Office manifest the growing interest in using these systems and the constant concern of this control authority, as they are systems of very intrusive to the fundamental rights and freedoms of natural persons. Concern that is shared by the rest of control authorities for years, as evidenced by the Biometrics Working Paper, adopted on August 1, 2003 by the Group of 29, or the subsequent Opinion 3/2012 on the evolution of the biometric technologies, adopted on April 27, 2012, and which has led to that the Community legislator himself include these data among the categories special data in the GDPR. Thus, being prohibited treatment in general, any exception to said prohibition will have to be subject to restrictive interpretation. In this regard, it should be noted, in addition to the aforementioned report 36/2020, referred to the use of facial recognition techniques in carrying out online assessment tests, report 31/2019 on the incorporation of facial recognition systems in video surveillance services under the of article 42 of the Private Security Law or Report 97/2020 regarding the Draft Order of the Minister of Economic Affairs and Transformation Digital on non-presential identification methods for the issuance of qualified electronic certificates. In all these cases it was concluded that there was a legal standard in the Spanish legal system that met the requirements of article 9.2.g) of the GDPR, so that the treatment only could rely on the consent of those affected as long as it remained guaranteed that it is free. Analyzing the requirements of article 9.2.g) in our Report 36/2020 we pointed out the following: V The next question that arises in the consultation is whether the processing of biometric data by recognition systems facial expression in online evaluation processes could rely on the existence of an essential public interest in accordance with article 9.2.g) of the GDPR: g) the processing is necessary for reasons of public interest essential, on the basis of Union or Member States law members, which must be proportional to the objective pursued, respect in the essential right to data protection and establish measures adequate and specific to protect the interests and rights fundamentals of the interested party. As we indicated previously, the data processing personnel necessary for the provision of the public service of c. Jorge Juan 6 www.aepd.es 28001 Madrid 6 Legal Office Higher education is legitimized, in general, in the existence of a public interest under the provisions of article 6.1.e) of the GDPR. However, in the case of special categories of data, the case contemplated in letter g) of article 9.2. does not refer only to the existence of a public interest, as it does in many other of its precepts the RGPD, but it is the only precept of the RGPD that requires that it be "essential", an adjective that comes to qualify said public interest, taking into account the importance and necessity of greater protection of the data processed. Said precept finds its precedent in article 8.4 of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, regarding the protection of natural persons in terms of that respects the processing of personal data and the free movement of these data: “4. As long as they have adequate guarantees, the Member States may, for reasons of important public interest, establish other exceptions, in addition to those provided for in section 2, either through their national legislation, or by decision of the authority of control". However, its reading results in greater rigor in a new regulation by the GDPR, since the adjective "important" is replaced by "essential" and it is not allowed that the exception can be established by the control authorities. In relation to what should be understood by public interest essential, the Jurisprudence of the European Court of Human Rights, which under Article 8 of the European Convention on Human Rights, has been considering that the processing of personal data constitutes a lawful interference in the right to respect for private life and can only be carried out if performed in accordance with the law, serves a legitimate purpose, respects the essence of fundamental rights and freedoms and it is necessary and provided in a democratic society to achieve an end legitimate ( D.L. against Bulgaria, nº 7472/14, May 19, 2016, Dragojević v. Croatia, no. 68955/11, January 15, 2015, Peck v. United Kingdom, No. 44647/98, January 28, 2003, Leander v. Sweden, no. 9248/81, March 26, 1987, among others). As he points out In the last sentence cited, "the concept of necessity implies that the interference responds to a pressing social need and, in particular, that is proportionate to the legitimate aim that it pursues”. Likewise, the doctrine of the Court must be taken into account Constitutional regarding the restrictions to the fundamental right to data protection, which is summarized in judgment 292/2000, dated 30 November, in which after configuring the fundamental right to protection of personal data as an autonomous right and independent power that consists of a power of disposition and control on personal data that empowers the person to decide which c. Jorge Juan 6 www.aepd.es 28001 Madrid 7 Legal Office of these data to provide to a third party, be it the State or an individual, or which this third party can collect, and which also allows the individual know who owns that personal data and for what, being able to oppose that possession or use, analyzes its limits, pointing out in the following: More specifically, in the Judgments mentioned regarding the data protection, this Court has declared that the right to Data protection is not unlimited, and although the Constitution does not expressly impose specific limits, nor refer to the Powers Public for its determination as it has done with other rights fundamental, there is no doubt that they will find them in the remaining fundamental rights and legal rights constitutionally protected, as required by the principle of unity of the Constitution (SSTC 11/1981, of April 8, F. 7; 196/1987, of April 11, December [RTC 1987, 196], F. 6; and regarding art. 18, JTS 110/1984, F. 5). These limits may either be direct restrictions of the fundamental right itself, which has been alluded to before, or may be restrictions on the way, time or place of exercise of the fundamental right. In the first case, regulating those limits is a form of development of the fundamental right. In the second, the limits that are fixed are to the concrete form in which it is possible to exert the beam of faculties that make up the content of the fundamental right in matter, constituting a way of regulating its exercise, which The ordinary legislator can do in accordance with the provisions of art. 53.1 EC. The first observation that must be made, which is not obvious, is less capital, is that the Constitution has wanted the Law, and only the Law, can set the limits to a fundamental right. Rights Fundamentals can, of course, yield to goods, and even constitutionally relevant interests, provided that the cut that undergo is necessary to achieve the intended legitimate purpose, provided to achieve it and, in any case, be respectful of the essential content of the restricted fundamental right (SSTC 57/1994, of February 28 [RTC 1994, 57], F. 6; 18/1999, of February 22 [RTC 1999, 18], F. 2). Precisely, if the Law is the only one authorized by the Constitution to set limits to fundamental rights and, in the case present, to the fundamental right to data protection, and those limits cannot be different from those constitutionally established, which for the case are none other than those derived from the coexistence of this fundamental right with other legal rights and goods of rank constitutional, the legal empowerment that allows a Public Power collect, store, process, use and, where appropriate, transfer personal data, it is only justified if it responds to the protection of other rights constitutionally protected assets or assets. So if those operations with the personal data of a person are not c. Jorge Juan 6 www.aepd.es 28001 Madrid 8 Legal Office carried out with strict observance of the norms that regulate it, violates the right to data protection, since limits are imposed constitutionally illegitimate, either to its content or to the exercise of the bundle of faculties that compose it. How will that violate it too? Limitative law if it regulates the limits in such a way that they make the fundamental right affected or ineffective the guarantee that the Constitution grants you And so it will be when the Law, which should regulate the limits to fundamental rights with scrupulous respect for their content essential, is limited to empowering another Public Power to establish in each the restrictions that may be imposed on the rights fundamentals, whose unique determination and application will be at risk of the decisions adopted by that Public Power, who may decide, in what interests us now, about obtaining, storing, treatment, use and transfer of personal data in the cases that it deems convenient and brandishing, even, interests or assets that are not protected with constitutional rank […]”. (Legal Basis 11) “On the one hand, because although this Court has declared that the The Constitution does not prevent the State from protecting legal rights or assets to cost of the sacrifice of others equally recognized and, therefore, that the legislator may impose limitations on the content of rights fundamentals or their exercise, we have also specified that, in such assumptions, these limitations must be justified in the protection of other rights or constitutional goods (SSTC 104/2000, of 13 December April [ RTC 2000, 104] , F. 8 and those cited there) and, in addition, they must be proportionate to the purpose pursued with them (SSTC 11/1981, F. 5, and 196/1987, F. 6). Well, otherwise they would incur in arbitrariness proscribed by art. 9.3 EC. On the other hand, even having a constitutional foundation and being proportionate the limitations of the fundamental right established by Law ( STC 178/1985 [ RTC 1985, 178] ), these may violate the Constitution if they suffer from a lack of certainty and predictability in the very limits they impose and their way of application. Conclusion that is corroborated by the Court's jurisprudence European Commission on Human Rights that has been cited in F. 8 and that here must be reproduced. And it should also be noted that not only would harm the principle of legal certainty (art. 9.3 CE), conceived as certainty about the applicable law and expectation reasonably founded of the person on what should be the performance of power applying the Law (STC 104/2000, F. 7, for all), but that at the same time said Law would be harming the essential content of the fundamental right thus restricted, given that the way in which it is have set their limits make it unrecognizable and make it impossible, in the practice, its exercise (SSTC 11/1981, F. 15; 142/1993, of April 22 [ RTC 1993, 142] , F. 4, and 341/1993, of November 18 [ RTC 1993, c. Jorge Juan 6 www.aepd.es 28001 Madrid 9 Legal Office 341], F. 7). So that the lack of precision of the Law in the material assumptions of the limitation of a fundamental right is likely to generate an indeterminacy about the cases to which apply such a restriction. And when this result occurs, beyond all reasonable interpretation, the Law no longer fulfills its function of guaranteeing the own fundamental right that it restricts, since it allows instead simply operate the will of who has to apply it, undermining thus both the effectiveness of the fundamental right and the legal certainty […]”. (FJ 15). “More specifically, in relation to the fundamental right to privacy we have highlighted not only the need for your possible limitations are based on a legal provision that has constitutional justification and that they be proportionate (SSTC 110/1984, F. 3, and 254/1993, F. 7) but the Law that restricts this right must accurately express each and every material budget of the limiting measure. Otherwise, it is wrong to understand that the judicial resolution or the administrative act that applies it are founded in the Law, since what it has done, making abandonment of its functions, is to empower other Public Powers so that they are who set the limits to the fundamental right (SSTC 37/1989, of 15 of February [RTC 1989, 37], and 49/1999, of April 5 [RTC 1999, 49]). Similarly, regarding the right to data protection personal, it can be estimated that the constitutional legitimacy of the restriction of this right cannot be based, by itself, on the activity of the Public Administration. Nor is it enough that the Law empowers it to specify its limits in each case, limiting itself to indicate that you must make such precision when there is any right or well constitutionally protected. It is the legislator who must determine when that good or right that justifies the restriction of the right to the protection of personal data and in what circumstances can be limited and, furthermore, it is he who must do it by means of precise rules that make the interested party foreseeable imposition of such limitation and its consequences. Well, in another case legislator would have transferred to the Administration the performance of a function that only corresponds to him in terms of fundamental rights in By virtue of the legal reservation of art. 53.1 CE, that is, establish clearly the limit and its regulation. […] (FJ 16)”. Likewise, our Constitutional Court has already had the opportunity to rule specifically on article 9.2.g) of the GDPR, as a consequence of the challenge of article 58 bis of the Law Organic 5/1985, of June 19, of the General Electoral Regime, introduced by the third final provision of Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of the digital rights, regarding the legitimacy of data collection c. Jorge Juan 6 www.aepd.es 28001 Madrid 10 Legal Office personal information relating to the political opinions of the persons who carry carried out by political parties in the framework of their electoral activities, precept that was declared unconstitutional by Judgment no. 76/2019 of May 22. Said sentence analyzes, firstly, the legal regime to which that is subject to the treatment of the special categories of data in the GDPR: In accordance with paragraph 1 of art. 9 GDPR, the processing of personal data that reveal political opinions, in the same way as the processing of personal data that reveals ethnic or racial origin, religious or philosophical convictions or trade union membership and processing of genetic data, biometric data aimed at uniquely identifying a natural person, data relating to health or data relating to sexual life or orientation sex of a natural person. However, section 2 of the same precept authorizes the processing of all such data when concurs any of the ten circumstances provided therein [letters a) to j)]. Some of These circumstances have a limited scope of application (labor, social, associative, health, judicial, etc.) or respond to a purpose determined, therefore, in themselves, delimit the treatments that authorize as an exception to the general rule. Besides, the enabling efficacy of several of the assumptions provided therein is conditioned to the fact that the Law of the Union or that of the States members expressly foresee and regulate them in their scope of competences: this is the case of the circumstances included in letters a), b), g), h), i) and j). Processing of special categories of personal data is one of the areas in which the Regulation expressly General of Data Protection has recognized the Member States "room for manoeuvre" when it comes to "specifying its rules", as qualifies its recital 10. This margin of legislative configuration extends both to the determination of the enabling causes for the processing of specially protected personal data -is that is, to the identification of the purposes of essential public interest and the assessment of the proportionality of the treatment to the end persecuted, essentially respecting the right to protection of data - such as the establishment of "adequate measures and to protect the interests and fundamental rights of the interested party" [art. 9.2 g) GDPR]. The Regulation contains, for Therefore, a concrete obligation of the Member States of establish such guarantees, in the event that they enable to treat specially protected personal data. In relation to the first of the requirements demanded by article 9.2.g), the invocation of an essential public interest and the necessary c. Jorge Juan 6 www.aepd.es 28001 Madrid 11 Legal Office specification thereof, the High Court recalls what was stated in its judgment 292/2000 in which it was rejected that the identification of the legitimate purposes of the restriction could be done through concepts generic or vague formulas, considering that the restriction of the right fundamental to the protection of personal data cannot be based, by itself, in the generic invocation of an indeterminate "interest public" : In the aforementioned STC 292/2000 (RTC 2000, 292), in which Legislative interference in the right to protection of personal data, we reject that the identification of the legitimate purposes of the restriction could be done through concepts generic or vague formulas: "16. [...] In the same way, regarding the right to the protection of personal data, it can be estimated that the constitutional legitimacy of the restriction of this right cannot be based, by itself, on the activity of the Public Administration. Nor is it enough that the Law empowers it to specify its limits in each case, limiting itself to indicate that you must make such precision when there is any right or well constitutionally protected. It is the legislator who must determine when that good or right that justifies the restriction of the right to the protection of personal data and in what circumstances can be limited and, furthermore, it is he who must do it by means of precise rules that make the interested party foreseeable imposition of such limitation and its consequences. Well, in another case legislator would have transferred to the Administration the performance of a function that only corresponds to him in terms of fundamental rights in By virtue of the legal reservation of art. 53.1 CE, that is, establish clearly the limit and its regulation. 17. In the present case, employment by the LOPD (RCL 2018, 1629) in his art. 24.1 of the expression "control and verification functions", opens a space of uncertainty so wide that it causes a double and perverse consequence. On the one hand, by enabling the LOPD to the Administration to restrict fundamental rights invoking such an expression is renouncing to set the limits itself, empowering the Administration to do so. And in such a way that As the Ombudsman points out, it allows redirecting the same practically all administrative activity, since all activity administration that involves establishing a legal relationship with a administered, which will be the case in practically all cases in which the Administration needs someone's personal data, it will entail Ordinarily the authority of the Administration to verify and control that this administered has acted in accordance with the administrative legal regime of the legal relationship established with the Administration. which, in view of reason for restriction of the right to be informed of art. 5 LOPD, leave in the most absolute uncertainty to the citizen about in which cases this circumstance will occur (if not in all) and add to the inefficiency c. Jorge Juan 6 www.aepd.es 28001 Madrid 12 Legal Office any jurisdictional guardianship mechanism that must prosecute Such an assumption of restriction of fundamental rights without another complementary criterion that comes to the aid of its control of the administrative action in this matter. The same reproaches also deserve the use in art. 24.2 LOPD of the expression "public interest" as the basis of the imposition of limits to the fundamental rights of art. 18.1 and 4 CE, because it contains an even greater degree of uncertainty. just notice that all administrative activity, ultimately, pursues the safeguarding of general interests, the achievement of which constitutes the purpose to which the Administration must objectively serve with according to art. 103.1 CE." This argument is fully transferable to the present prosecution. Similarly, therefore, we must conclude that the constitutional legitimacy of the restriction of the fundamental right to personal data protection cannot be based, by itself, on the generic invocation of an indeterminate "public interest". well in another case, the legislator would have transferred the political parties -whom the challenged provision empowers to collect personal data relating to to the political opinions of people in the framework of their activities elections - the performance of a function that is the sole responsibility of him in matter of fundamental rights by virtue of the reservation of the Law of the art. 53.1 CE, that is, clearly establish its limits and its regulation. Nor can it be accepted, as equally imprecise, the purpose adduced by the lawyer of the State, which refers to the functioning of the democratic system, since it also contains a high degree of uncertainty and may involve circular reasoning. On the one hand, political parties are by themselves "necessary channels for the functioning of the democratic system" (for all, STC 48/2003, of March 12 (RTC 2003, 48), FJ 5); and, on the other hand, all functioning of the democratic system pursues, ultimately, the safeguarding of constitutional aims, values and assets, but this does not reaches to identify the reason why the right should be restricted fundamental affected. Finally, it should be specified that it is not necessary to be able to suspect, with greater or lesser grounds, that the restriction pursues an unconstitutional purpose, or that the data collected and processed will be harmful to the private sphere and the exercise of rights. rights of individuals. It is enough to note that, by not to be able to identify with sufficient precision the purpose of the treatment of data, the constitutional character cannot be prosecuted legitimate use of that purpose, nor, where appropriate, the proportionality of the measure provided in accordance with the principles of suitability, necessity and proportionality in the strict sense. c. Jorge Juan 6 www.aepd.es 28001 Madrid 13 Legal Office On the other hand, regarding the guarantees that the legislator, the aforementioned judgment no. 76/2019 of May 22, after remember that "In view of the potential intrusive effects on the affected fundamental right resulting from data processing personal data, the jurisprudence of this Court requires the legislator to, In addition to meeting the aforementioned requirements, you also establish adequate guarantees of a technical, organizational and procedural, that prevent risks of different probability and severity and mitigate its effects, because only in this way can the respect for the essential content of the fundamental right itself”, analyzes What is the norm that must contain the aforementioned guarantees: "Therefore, the resolution of this challenge requires that clarify a doubt raised regarding the scope of our doctrine on adequate guarantees, which consists of determining whether adequate guarantees against the use of information technology must be contained in the law that authorizes and regulates that use or may can also be found in other normative sources. The question can only have a constitutional answer. The provision of adequate guarantees cannot be deferred to a moment after the legal regulation of the processing of personal data of in question Appropriate safeguards should be built into the own legal regulation of the treatment, either directly or through express and perfectly delimited reference to external sources that have the appropriate regulatory status. Only that understanding is compatible with the double requirement arising from art. 53.1 EC (RCL 1978, 2836) for the legislator of fundamental rights: the reservation of law for the regulation of the exercise of fundamental rights recognized in the second chapter of the first title of the Constitution and respect for the essential content of said fundamental rights. According to reiterated constitutional doctrine, the reserve of law is not limited to requiring that a law enable the restrictive measure of rights fundamental, but it is also necessary, according to both requirements called -sometimes- normative predetermination and -others- regarding the quality of the law as well as respect for the essential content of the law, that in this regulation the legislator, who is obliged to primary way to weigh the rights or interests in conflict, predetermine the assumptions, conditions and guarantees in which the adoption of restrictive measures of rights is appropriate fundamental. That mandate of predetermination regarding essential elements, also ultimately linked to the judgment of proportionality of the limitation of the fundamental right, cannot be deferred to a subsequent legal or regulatory development, nor it can be left in the hands of the individuals themselves” (FJ 8). Therefore, the processing of biometric data to the under article 9.2.g) requires that it be provided for in a standard c. Jorge Juan 6 www.aepd.es 28001 Madrid 14 Legal Office of European or national law, having in the latter case said norm, according to the aforementioned constitutional doctrine and the provisions in article 9.2 of the LOPDGDD, rank of law. Said law shall, also specify the essential public interest that justifies the restriction of the right to the protection of personal data and in what circumstances can be limited, establishing the rules that make the imposition of such a law foreseeable to the interested party limitation and its consequences, without it being sufficient, to these effects, the generic invocation of a public interest. and said law must also establish the appropriate type of guarantees technical, organizational and procedural, that prevent risks of different probability and severity and mitigate their effects. In addition, said law must in all cases respect the principle of proportionality, as recalled in the Judgment of the Court Constitutional 14/2003, of January 28: In other words, pursuant to a settled doctrine of this Court, the constitutionality of any restrictive measure of fundamental rights is determined by the strict observance of the principle of proportionality. For the purposes that matter here enough remember that, in order to check whether a restrictive measure of a fundamental right overcomes the proportionality judgment, it is necessary verify if it meets the following three requirements or conditions: if the measure is capable of achieving the proposed objective (judgment of suitability); if, moreover, it is necessary, in the sense that there is no other more moderate measure for the achievement of such purpose with the same effectiveness (judgment of necessity); and, finally, if it is weighted or balanced, because it derives from it more benefits or advantages for the general interest than damages to other goods or values in conflict (judgment of proportionality in the strict sense; SSTC 66/1995, of 8 May [RTC 1995, 66], F. 5; 55/1996, of March 28 [RTC 1996, 55] , FF. 7, 8 and 9; 270/1996, of December 16 [RTC 1996, 270], F. 4.e; 37/1998, of February 17 [RTC 1998, 37], F. 8; 186/2000, of 10 July [ RTC 2000, 186] , F. 6).” The conclusions reached in the aforementioned case are transferable to the present, since the treatment of the special categories of data seeks to rely on the power of the Commission to promote systems of verification of the identity of the people who try to access the premises sports, under the terms provided in article 13.1. of Law 19/2007, of July 11. Said precept is developed by article 15.3 of the Royal Decree 203/2010, of February 26, which approves the Regulation of c. Jorge Juan 6 www.aepd.es 28001 Madrid 15 Legal Office prevention of violence, racism, xenophobia and intolerance in the sport: 3. In the cases contemplated in article 13.1 of the Law 19/2007, of July 11, verification and monitoring of identity of those who purchase tickets or control the distribution of localities will be carried out by implementing ticket sales systems nominative and developing procedures that allow to supervise the distribution of assigned locations and to know the identity of the holders of access titles to sports facilities. The treatment of the data obtained in accordance with these procedures will be limited to providing information on who access or attempt to access sports venues, with the purpose of to ensure compliance with existing prohibitions and, where appropriate, case, purge the responsibilities that may arise. The organizers will cancel the data of the people who they would have accessed the sporting event when it concludes, keeping exclusively the data necessary to identify who may have engaged in conduct prohibited by law 19/2007, of July 11, which may only be transferred to the authorities or competent bodies in matters of public safety. As can be seen, article 13.1 of Law 19/2007, of 11 December July refers to identity verification systems, but does not considers the possibility that said systems may involve treatments of biometric data, nor does it establish the pertinent and adequate guarantees for the protection of the fundamental right to the protection of personal data. This possibility is not provided for in article 15.3 of the Royal Decree either. 203/2010, of February 26, although it should be noted that said standard would lack, as has been explained, the appropriate legal status for proceed to the regulation of the treatment of special categories of data personal. Therefore, claiming in the processing of personal data included in the special categories of data referred to in the article 9.1. of the RGPD, since it is about biometric data directed to the identification of natural persons, it is a prerequisite that some of the circumstances contemplated in section 2 that lifts the prohibition of treatment of said data, established in general in its section 1, requiring article 9.2. of the LOPDGDD that "Treatments of data referred to in letters g), h) and i) of article 9.2 of Regulation (EU) 2016/679 founded on Spanish law must be covered by a standard with the force of law, which may establish additional requirements relating to your security and confidentiality. not existing, as indicated, norm that enables said treatment under article 9.2.g) of the GDPR, since c. Jorge Juan 6 www.aepd.es 28001 Madrid 16 Legal Office that article 13.1. does not meet the legal requirements and jurisprudentially, as has been analyzed in the present report. And without said gap being able to be filled by means of an agreement of the CEVRXID, as it does not have the appropriate regulatory range. In this sense, as already As indicated, the jurisprudence of the Constitutional Court is clear regarding of the norm that must contain the adequate guarantees that cannot be be deferred to a time after the legal regulation of data processing personal in question. Adequate safeguards must be incorporated to the legal regulation of the treatment itself, either directly or by referral expressly and perfectly delimited to external sources that have the rank adequate normative (Ruling 76/2019 of May 22, FJ 8) Consequently, it must be concluded that the adoption of an agreement of the State Commission against Violence, Racism, Xenophobia and Intolerance, within the scope of its powers, establishing measures for the compliance of the clubs consisting of the installation of biometric systems for the control of all access to the stands of animation that allows the unequivocal identification of the fans who access said stands, is not in accordance with the regulations governing Data Protection. c. Jorge Juan 6 www.aepd.es 28001 Madrid 17