AEPD (Spain) - EXP202305233
From GDPRhub
| AEPD - EXP202305233 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 5(1) GDPR Article 5(1)(c) GDPR Article 5(1)(a) GDPR Article 6(1)(f) GDPR Article 6(1)(a) GDPR Article 6(1) GDPR Article 6(1)(b) GDPR Article 9 GDPR Article 9(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.03.2023 |
| Decided: | |
| Published: | 25.11.2025 |
| Fine: | 6,500,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | EXP202305233 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | RP |
The DPA fined a university €650,000 for requiring students to use mandatory facial recognition during online exams without a legal basis and in violation of Article 9 GDPR.
English Summary
Facts
The case concerned the Valencian International University (Universidad Internacional Valenciana – VIU), which acted as the controller. On 20 March 2023, a data subject filed a complaint with the DPA. The data subject stated that the controller required all students to use a remote-proctoring system based on facial recognition to take online examinations, and that the controller did not offer any non-biometric alternative. The controller used a tool which performed continuous biometric facial verification, monitored students through cameras, and recorded activity on the student’s computer, such as screenshots and the detection of copied text or peripheral devices.
During the investigation the controller confirmed that it had used facial recognition for examination supervision since 2017, and that it had imposed the tool as the only option for students. The controller relied on consent under Article 6(1)(a), performance of a contract under Article 6(1)(b), and legitimate interest under Article 6(1)(f). It also argued that the processing did not involve special categories of data, because the software only performed one-to-one verification and allegedly did not store biometric templates.
The controller stated that fraud in online education had increased and that remote-proctoring systems were necessary to protect academic integrity. It also argued that the National Agency for Quality Assessment and Accreditation (Agencia Nacional de Evaluación de la Calidad y Acreditación – ANECA) required strict identity checks in online programmes.
The controller further claimed that the DPA had changed its interpretation of biometric data with its 2023 Biometric Systems Guide, and that sanctioning the controller would breach the principles of legal certainty, non-retroactivity and culpability. It also claimed that the DPA could not impose separate penalties for breaches of Article 9 GDPR and Article 5(1)(c) GDPR because this would violate the non-bis-in-idem principle.
Holding
The DPA held that the controller violated both Article 9 GDPR and Article 5(1)(c) GDPR. It found that the facial recognition system processed biometric data for the purpose of uniquely identifying individuals, which meant that it constituted special category data. The DPA emphasised that facial images are biometric data whenever they are processed through techniques that extract or compare unique biological features for the purpose of identifying an individual. It stressed that the GDPR definition in Article 4(14) focuses on the purpose and method of processing, not on whether templates are permanently stored or whether the system performs identification versus verification.
The DPA explained that in this case, the remote-proctoring tool used algorithms to capture, analyse, and compare the facial features of each student, transforming a static image into a mathematical representation that allowed the system to confirm whether the live image matched the reference image previously provided. This transformation into “biometric patterns” was enough to constitute biometric data, even if the controller claimed that the template was destroyed quickly after use.
The DPA also considered the continuous nature of the verification. The system did not perform a one-off identity check but repeatedly analysed the student’s face throughout the exam session. This constant monitoring meant the system was continuously processing new biometric data points, making the processing more intrusive and reinforcing the conclusion that it concerned special category data.
Consequently, the DPA held that the controller needed a valid exception under Article 9(2), which they found it did not have. The DPA asserted that the controller could not rely on consent because students did not have a real choice: they had no alternative examination method, and the possibility of enrolling in a different university did not satisfy the GDPR standard of free consent. The DPA also found that academic integrity concerns did not amount to a substantial public interest capable of justifying biometric processing under Article 9(2).
The DPA also held that the controller violated the principle of data minimisation under Article 5(1)(c), because continuous biometric monitoring was not necessary to ensure examination integrity. The controller did not show that less intrusive measures were inadequate, and the DPA noted that remote-proctoring without biometric processing, or in-person options, could have achieved the same objective with fewer risks. The Data Protection Impact Assessments did not demonstrate a balanced assessment of alternatives or risks.
The DPA found that the controller acted negligently by applying a significantly intrusive technology for several years without a lawful basis under Article 9 GDPR. It rejected arguments about legal uncertainty or non-retroactivity, and stated that the controller could not rely on an incorrect interpretation of the GDPR to avoid responsibility. It also rejected the non-bis-in-idem claim, because the infringements of Article 9 GDPR and Article 5(1)(c) GDPR protected different legal interests.
The AEPD imposed two administrative fines: €300,000 for the breach of Article 9 GDPR and €350,000 for the breach of Article 5(1)(c) GDPR, for a total of €650,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/225
• File No.: EXP202305233
Sanctioning Procedure No. PS/00067/2024
RESOLUTION OF SANCTIONING PROCEEDINGS
Contents
BACKGROUND..........................................................................................................2
PROVEN FACTS................................................................................................29
LEGAL BASIS.................................................................................50
I. Jurisdiction and Procedure....................................................................................50
II. Preliminary Issues Regarding the Processing Carried Out by the UIV..................................50
2.1. Personal Data Subject to Processing............................................................50
2.2. Characteristics and Risks of the Processing of Personal Biometric Data...................................................................................................................59
2.3. Biometric data as special category and high-risk personal data.......................................................................................................................62
2.4. On the processing of biometric data and the data controller...........................................................................................................67
III. On the admission and assessment of evidence...........................................................69
IV. Response to the objections against the Commencement Agreement..................................92
V. Response to the objections raised against the Proposed Resolution..119
5.1. Response to the preliminary issues raised....................122
5.2. Response to the objections raised regarding the legal nature
of the data processed and the atypical nature of the conduct imputed under Article 9 of the
GDPR.....................................................................................................................137
5.3. Response to the FIFTH OBJECTION. The Proposed Resolution violates
the principle of culpability: given the interpretative doubts arising from the GDPR,
a sanction cannot be imposed.................................................................................164
5.4. Response to the SIXTH ALLEGATION regarding: “Incorrect application of the
criteria for graduating sanctions”...............................................................168
VI. On the existence of an exception to the prohibition of processing under Article 9
of the GDPR, and the legal basis under Article 6 of the GDPR............................................172
6.1. On the need for an exception to the prohibition of processing
of biometric data..............................................................................................172
6.2. Need for a legal basis for processing under Article 6.1..........................174
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/225
6.3. Analysis of the concurrence of an exception and a legal basis in the present case..................................................................................................175
VII. On the breach of Article 5.1.c) of the GDPR.........................................201
7.1. On the requirement that processing be necessary, suitable, and proportionate.
................................................................................................................................201
7.2. Preliminary clarifications on the suitability, necessity, and proportionality analysis carried out by the UIV.....................................................................204
7.3. On the failure to pass the suitability, necessity, and proportionality analysis carried out by the UIV.....................................................................207
VIII. Classification of the infringements and their classification for the purposes of the statute of limitations.....226
8.1. Infringement of Article 9 of the GDPR...................................................................226
8.2. Infringement of Article 5.1.c of the GDPR.............................................................226
IX. Sanction to be imposed................................................................................................227
9.1. Applicable regulations.........................................................................................227
9.2. Gradation of the sanction for the infringement of Article 9 of the GDPR................229
9.3. Gradation of the sanction for the infringement of Article 5.1.c) of the GDPR.........231
RESOLVES:...............................................................................................................233
From the proceedings initiated by the Spanish Data Protection Agency and based on
the following
BACKGROUND
FIRST: ***COMPANY.1 (hereinafter, the complainant) filed a complaint with the Spanish Data Protection Agency on March 24,
2023. The complaint is filed against UNIVERSITAT INTERNACIONAL VALENCIANA - VALENCIAN INTERNATIONAL UNIVERSITY, S.L., with Tax Identification Number (NIF) B98585797 (hereinafter, the University), alleging to this Agency the potential disproportionate processing of biometric data of students enrolled at the International University of Valencia.
According to the facts presented in the complaint:
- The University sent information to students under the heading "activation of exam section," urging them to download an exam monitoring tool that uses facial recognition, without providing any alternative methods for taking the exams. This tool is a
software program called ***APPLICATION.1 which, among other things, uses
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/225
facial recognition and artificial intelligence to verify the identity of
students and prevent, through intrusion into their computers, the commission of
potential fraud, as well as to capture images of students during their
assessment. Furthermore, the students received a document informing them
that they would have to install a video surveillance system that
consists of a dual recording device.
- Specifically, the complaint states that a group of students enrolled in the
online courses received an email on October 3, 2022, with the
following content: “Using the virtual campus does not require the installation of
any programs or software (except for a browser add-on for
specific functionalities). With up-to-date equipment, a compatible web browser
and an acceptable connection, you can enjoy a complete
academic experience. However, there are minimum requirements, which we detail below: webcam and microphone, connection speed of 7.2
and 3.6 Mbps download and upload, LAN cable recommended for tests,
exams, and Master's thesis presentations.”
- Subsequently, on December 19, 2022, the students received another
email informing them that, starting January 16, 2023,
they had to download an exam monitoring tool that
used facial recognition, without being provided with any other options. The
content of this email is as follows: “Dear students: the exams section of the general classroom has now been activated. It is important that you review this section and download the monitoring tool
APPLICATION.1, since, as we informed you, you can take the exams starting
on January 16th. You have a manual and informational video for downloading
the Proctor. Likewise, the university's technical support service
will be offering workshops to answer questions about online exams and
biometric access control.” It is stated that the students also received an attached document to
this email informing them that they must install a video surveillance system consisting of a dual recording device.
- That, after receiving the email of December 19, 2022, the group of students
requested that their supplementary training and assessments be carried out without
the aforementioned surveillance measures, to which the University
responded that “the implementation of said measures was approved by the Academic Governing Council,” without offering them alternative solutions that did not
require the processing of biometric data.
- The complaint refers to Legal Report 0036/2020 from this Agency,
which analyzed the use of biometric data by universities and
educational institutions, indicating that: “the possibility of admitting
students' free consent to allow the use of
facial recognition techniques to process their biometric data in online assessments
would require that they be offered the possibility of taking
said assessments in a comparable situation where such processing is not necessary,
such as taking the same activity
in person, or offering other alternatives that do not require the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/225
processing of their biometric data and that are comparable in terms of
duration and difficulty to those carried out with facial recognition.”
The complaint also references the resolution of file E/05454/2021 of the Spanish Data Protection Agency (AEPD), dated July 27, 2021, which analyzes a similar case where
it is stated that: “(…) The need for processing is not justified, since the online identification of students has been routinely carried out
by university centers by visually displaying the student without using
facial recognition techniques. On this point, it is necessary to emphasize
that necessity should not be confused with convenience (…)”. Along the same
lines, in the aforementioned resolution, the AEPD determines: “(…) that facial
recognition techniques imply a greater intrusion into the right to the
protection of personal data and that the processing that is intended to be carried out
could pose a high risk to the rights and freedoms of natural persons,
due to the use of new technologies, and the scope and context
in which it will be carried out.”
Along with its complaint, the Foundation submitted three documents:
- Document 1. Founding charter of the complainant foundation.
- Document 2. Foundation bylaws.
- Document 3. “Evidence from students of the International University of Valencia,” which includes a total of five documents, referred to as “evidence.”
Evidence 1. Undated UIV message indicating that the use of the virtual campus does not require the installation of additional software.
Evidence 2. Email dated October 3, 2022, referenced in the complaint.
Evidence 3. Email dated December 19, 2022, referenced in the complaint.
Evidence 4. Screenshots of the content of the attachments to the December 19, 2022, email. Evidence 5. UIV response to an inquiry regarding the new exam system, indicating that it was adopted by decision of the Governing Council on May 3, 2022.
SECOND: On April 26, 2023, the Director of the Spanish Data Protection Agency, through an internal memo, agreed to open an investigation ex officio and instructed the Deputy Directorate General for Data Inspection to initiate preliminary investigative actions to establish the possible occurrence of these events and their perpetrators.
THIRD: The Deputy Directorate General for Data Inspection carried out
preliminary investigative actions to clarify the facts in question,
by virtue of the functions assigned to supervisory authorities in
Article 57.1 and the powers granted in Article 58.1 of Regulation (EU)
2016/679 (General Data Protection Regulation, hereinafter GDPR),
and in accordance with the provisions of Title VII, Chapter I, Section Two, of the
LOPDGDD.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 5/225
The objective of this investigation was to analyze the proportionality of the processing and compliance with data protection principles by the software ***APPLICATION.1, used by the UNIVERSITAT INTERNATIONAL DE
VALENCIA (hereinafter UIV or VIU) for student exams,
which uses facial recognition techniques for identification, as well as the dual-camera system used by this system to monitor the exams (commonly known as “Proctoring” or monitoring ***APPLICATION.2).
Within the procedure, the following preliminary investigative actions were carried out, as detailed in the Preliminary Investigation Actions Report issued by the acting inspector on January 18, 2024:
On October 30, 2023, an initial request for information was made to the UIV, focusing on the following line of inquiry:
- Request and investigate the Record of Processing Activities (ROPA)
regarding the processing activities carried out by ***APPLICATION.1.
- Information on the operation and use cases of the software
APPLICATION.1.
- Information on the details of the personal data processing
carried out by ***APPLICATION.1 and the legal basis used
for this processing.
- Information provided to students regarding the processing carried out by ***APPLICATION.1.
- To inform and contribute to the preparation of the risk analysis for the
rights and freedoms of the individuals affected by these processing activities, and the
preparation and successful completion of a Data Protection Impact Assessment
prior to the implementation of the facial recognition system.
On November 16, 2023, a response was received from the UIV to the first
request for investigation. From the analysis of the documentation provided,
in accordance with the Inspector's Report, the following relevant information is extracted:
- They state that “***APPLICATION.1 is a continuous authentication system for the
identity of the person taking the exam and uses a facial
recognition algorithm, a screen monitoring system, and an
environmental control system using a second camera, in order to
prevent identity theft and fraud in exams.”
o They state that the operation of ***APPLICATION.1 includes three phases:
o Acceptance by the student of the terms and conditions.
• Registration of the student's identity, capturing the student's image for the first time, and then installing the necessary software on the student's device.
• Monitoring of activities during the exam, where the student is continuously authenticated. C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/225
They provide several documents prepared by the software manufacturer/supplier, ***COMPANY.2 (hereinafter, ***COMPANY.2), with the functional description of ***APPLICATION.1 under the name “Grouped Documents” (Documents 1.1, 1.2, and 1.3). From the analysis of these documents, the inspector extracts the following relevant information in their report:
In “Document 1.2” on the operation of ***APPLICATION.1 and its essential characteristics, prepared by ***COMPANY.2, the following information is highlighted:
(i) System description: “Depending on the institution's needs, the system can be configured to monitor the user using different tools (security levels). These tools can be used independently or in combination, and are as follows:
(...)
(i) Regarding technical security measures, in section 2.2 of the specifications, the system ***COMPANY.2 states that "the system implements the most advanced measures":
"- All recommendations and best practices in code development and web vulnerability review, such as those of (...) among others, are followed.
- Annual external audits.
- Anonymized data storage: The system works with anonymized data, where ***COMPANY.2 never knows the identity of the users it is monitoring, ***APPLICATION.1 does not handle identities, and all incoming data is linked to an alphanumeric code. The relationship between codes and the identity of individuals resides on the servers of the data controller." -***COMPANY.2 has designed a system taking privacy into account
by default and by design:
(ii) In section 3.3 on “proactive responsibility,” the specifications
of ***COMPANY.2 state, among other aspects, the following:
-“The biometric processing performed is for
authentication/verification and not for identification. This means that
comparisons are made one-to-one and not one-to-many.”
-The biometric processing performed is low-impact because it is for
authentication/verification and not identification.
-It does not store biometric data: when the system ***APPLICATION.1
receives an image, it extracts the biometric data from the image and the user's record
and compares them, obtaining a result. This data is
destroyed and not stored, remaining in the system for only a few
seconds.
-Control resides with the user. Before beginning to use
***APPLICATION.1, the student receives all the necessary information from
the academic institution. Furthermore, monitoring is always based
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/225
on the user's consent, and if it is denied, the
data controller must offer this
student an alternative.
In document 1.3 regarding the operation of the
desktop monitoring tool called ***TOOL.1, which has been
developed and installed at UIV, ***COMPANY.2 states, among
other things, that:
-***APPLICATION.1 does not record video; it captures screenshots every time the
student changes programs, browser tabs, browses the internet, or
uses any application on their computer.
-Opening and closing of programs is detected based on a blacklist that
can be considered Incidents.
-Detection of peripherals connected to the computer, such as multiple monitors or cameras.
-Detection of texts that the student may copy, recording the copied text and the program from which it is copied.
-In addition to the above, the software monitors the student's activity, but at no time does it access information on the student's computer.
Furthermore, the UIV states in its document of December 16, 2023, that the
project has received approval from the European Commission, which allocated
funds within the H2020 program during the period 2018 to 2020. The document includes the
URL with the project information sheet: https://cordis.europa.eu/article/id/429031-cyber-
security-steps-in-to-keep-academic-integrity-in-check/es.
The UIV's Record of Processing Activities (ROPA) is also provided as Document 2.1, detailing the data processing activities carried out by ***APPLICATION.1:
a. Name of the processing activity: “Proctoring of
online exams”.
b. Purposes of the processing:
1. To verify that the student taking the exam is who they claim to be.
2. Prevent identity theft.
3. Prevent fraud or cheating on exams.
4. Guarantee academic quality and integrity.
5. Comply with the requirements of certifying bodies (ANECA).
c. Categories of data processed: identification data, student image, biometric data (facial pattern), behavior during the exam, and assessment content.
d. Legal basis for processing:
i. 1. Explicit user consent obtained during the pre-contractual and contractual phases.
ii. 2. Contract performance.
iii. 3. Legitimate interest in fraud prevention.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/225
e. Deletion period: for the time necessary to carry out the purposes for which they were collected and, in any case, until the evaluation records for each test become final.
Subsequently, the data is kept duly blocked for the duration of the statute of limitations for legal actions, claims, and violations.
f. Security measures: “The application ***APPLICATION.1 has the certification ***CERTIFICATION.1, therefore the security measures are those described in said standard. Additionally, the VIU is integrated within the security, organizational, and regulatory framework of ***COMPANY.3.
Among the ***COMPANY.3 standards applicable to the security of the VIU are the Information Security Policy and the Standard on the Use of Information Systems.”
Regarding the legal bases included in the RAT and listed in the previous section,
the response also includes the following clarifying statements:
“For the purpose of verifying, through facial recognition and biometric data, that the student is a party to the educational contract, the applicable legal bases are:
1. The execution of the educational contract.
2. Consent: granted upon acceptance of the general conditions at the time of enrollment (educational contract). This consent is given beforehand when the interested party is not yet a student of the university and has full capacity to choose a university. Therefore, the consent is freely given because the student can choose any institution and is not yet subject to university regulations.
For the purpose of verifying the environment with the second camera to prevent fraud:
1. Legitimate interest (no biometric processing is carried out with the data obtained; the environment is only viewed to discourage the student from engaging in fraudulent activities and to detect them).
2. Consent (the student consents expressly in the general conditions
use of the camera in the environment)
For the prevention of fraud in online exams:
1. Legitimate interest. The weighting of this interest is carried out in the
impact assessment provided.
or Regarding the information provided to the student about the use of
***APPLICATION.1, the following documents are provided and made available to students both in the pre-contractual phase (before enrollment) and in the contractual phase (upon enrollment), and post-contractual phase (once the student has formalized enrollment):
a. Prior to formalizing enrollment:
The inspector states in his report that: It has been verified that the UIV
informs the student about the use of biometric data in ***APPLICATION.1
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/225
for facial recognition through various documents provided to the
student prior to the enrollment process (pre-contractual phase), as it has been proven that these documents are
publicly available on the university's website.
These documents are as follows:
• Informative links about the operation of the virtual campus and
frequently asked questions.
(ii) The University's Evaluation Regulations between 2019 and 2022 as
Document 3.5, which the Inspector verified in his Preliminary Actions Report
that are published on the website and
can be consulted by the student before making a decision to enroll,
through the two links provided by the University.
It is noted that the Evaluation Regulations of February 25, 2019, and October 10, 2020, state in Chapter IV, Article 11 et seq. that online exams will be conducted using biometric recognition.
And the Evaluation Regulations approved on May 3, 2021, and October 21, 2022, make the same statement in Article 2.
(i) The UIV indicates that information is also provided to students
in the documents accompanying each Master's Verification Report,
which they can access publicly through the UIV website.
They provide an example of a Master's report as Document
3.2, in whose section 5.4.1.b) and Annex there is reference to identity and plagiarism control
through facial recognition, describing
the operation of the program ***APPLICATION.1.
(ii) As document 3.3 provides an example of a Study Plan
from the UIV.
(iii) As document 3.4 submitted in 2018 by the UIV, the
Favorable Evaluation Report from ANECA dated May 31, 2019, is provided regarding the proposed modification of the Study Plan
formulated in 2018, which was submitted to ANECA. According to the UIV, this agency made
three recommendations for improving the
online exam evaluation system, which the UIV claims to have corrected
by introducing authentication measures, screen control, and control of the environment for a second camera.
(iv) Finally, as document 3.11, an example of a
master's program catalog with a section on online exams is provided (page 19).
a. Upon enrollment (formalizing registration).
The General Conditions that the
student must accept during the registration process, published by the UIV
between 2017 and 2023, are provided as grouped document 3.1. That the UIV refers to it as the “Teaching Contract,” the acceptance of which, in turn, implies expressing contractual consent.
UIV states that this contract is available for consultation from the pre-contractual phase, although it is accepted and becomes
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/225
consent upon enrollment. Therefore, it can also be considered as information provided prior to enrollment.
Regarding the General Conditions published by the university in the years to which the events referred to in the complaint filed in this case correspond: 2022 and 2023, three documents are provided (“General Conditions 2022,” “General Conditions 2022 September,” and “General Conditions 2023”). All of them contain a
ninth clause on “student responsibilities,” which states It refers to
the acceptance of “a facial recognition technology system that will allow for monitoring your effective participation in the exams and tests administered by this university. This system will be used solely and exclusively for this monitoring function and never for
any other purpose.” The possibility of taking a fully online course, without travel or in-person exams, is an essential element for contracting with the UIV.
c. Once enrollment is formalized:
It is stated that, once enrollment is formalized (what they call the contractual phase), the student receives ongoing training on facial recognition and biometric processing carried out by ***APPLICATION.1.
The University provides several documents containing training
related to the student's biometric registration in ***APPLICATION.1 as
Documents 3.6 to 3.9, such as: the Online Training Manual with
biometric control as document 3.6 (***APPLICATION.4) and the
update of this same manual from August 2023 as document
3.7 (***APPLICATION.5), an installation guide and instructions for
***APPLICATION.1 as document 3.8, and the monitoring protocol
using this tool as Document 3.9. They state that through
these documents, the student is informed, at the beginning of the course, about
facial recognition, biometric processing, and the use of the two monitoring cameras.
Regarding the explicit consent of students to biometric processing, they state that, in addition to having the aforementioned legal bases, explicit consent is requested, which “is requested from the user both in the pre-contractual phase, when the interested party is not yet a student and has full capacity to choose a university, and in the contractual phase.” They state that consent is obtained at the following times:
(i) Through acceptance of the General Conditions provided as Document 3.1 by the person who will be registering.
(ii) At the time of registering the user's facial image in the tool, who must also accept the Privacy Policy
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/225
specific to the processing carried out with the software ***APPLICATION.1.
This Privacy Policy is documented
“Attached Documents – (…)”.
From the analysis of this document 3.10 Privacy Policy, the inspector
concludes that the data subject is informed about the identification of the
data controller, the purpose of the processing, the data retention period, the legal basis for the processing, their
rights, the absence of international data transfers, and
the potential recipients. Regarding the legal basis for the
processing, it includes the following text: “We inform you that we carry out
the processing indicated above in accordance with the
following legal bases: consent and performance of the
training contract signed with you to verify that the person taking the exam is a party to said contract, and legitimate interest in
preventing fraud.”
(ii) Finally, they state that “all devices used during the
exam must be installed manually and explicitly by the
student, which implies an express and categorical action that reinforces
the initial consent given upon accepting the conditions.” What is stated
is documented in the Training and Download Manual provided as
documents 3.6 and 3.7.
In response to our request for the start date of the
RAT processing activity, they state that the UIV has used facial recognition and biometric data in exams since 2017. They consider it
a well-known fact within the Spanish-speaking community that their
university adheres to the 100% online academic model with
facial recognition and compliance with ANECA requirements.
Two documents are provided as Document 5 containing the Data Protection Impact Assessment (DPIA): an initial assessment
conducted in September 2020, and a second document with a
subsequent update of this DPIA conducted in July 2023. Neither
of them is stamped or signed by the University or the data controller. Both documents are identical in their first 29 sections,
the main difference being that the document entitled
“DPIA 2020-update July 2023” includes two update annexes.
The following information relevant to the investigation is extracted from the analysis of both documents:
(i) The DPIA incorporates a systematic description of the processing operations
detailing the existing data flow.
(ii) The purposes of the processing are the 5 previously mentioned in
the RAT.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 12/225
(iii) The Legal Bases applicable to this processing are analyzed with the following statements:
i. Regarding Legal Base 1 – Data Subject Consent
ii. Regarding Legal Base 2 – Contract Performance:
iii. On the Legal Basis – Legitimate Interest
iv. On the Legal Basis – Public Interest
(i) No analysis of the exceptions in Article 9.2 of the GDPR that would allow the processing is included: the UIV denies that it processes special category data because the program performs 1.1 comparisons typical of an authentication system, and the DPIA points out that they are excluded from this concept according to Opinion 3/2019 of the Article 29 Working Party.
(ii) However, it includes an analysis of the sensitivity level of the biometric data in the processing, which refers to this Agency's legal reports 0036/2020 and 0047/2021 and the EDPB's Guidelines 05/2022, stating:
"The EDPB considers (in the area of Enforcement Law) the regulations restrictively, as they constitute a serious interference with the rights and freedoms of data subjects, and are also a processing activity that affects a..." a significant portion of the population
and that does not imply positive action on the part of individuals regarding the
processing of their biometric data, which is not the case in
the processing in question carried out by the UIV, which is known
to the interested parties and only affects the
students of the institution. However, the Spanish Data Protection Agency (AEPD) in consultation
N/REF 0098/2022 seems to open the door to the possibility that if the EDPB reaffirms
that the processing of biometric data (identification and
verification) constitutes the processing of special category data,
this supervisory authority will follow the same criterion. It is important
to emphasize that these changes in criteria within the Executive Branch
confirm the lack of clarity in the Legislative Branch when drafting the
GDPR and necessitate recourse to the Judicial Branch to ultimately determine
the criteria to be applied in the interpretation of the regulation.” The analysis concludes: “The only possible conclusion is that the definition of biometric data includes two purposes: identification and authentication, and that only identification makes biometric data a special category of data.”
(iii) The EIPD includes the following statements regarding the existence of
automated decisions by ***APPLICATION.1:
“The mechanism for detecting anomalous behavior carried out by the
UIV does not generate a student profile; it only alerts to
suspicious or anomalous behavior”…“Although it can be said that there is no
automated decision insofar as the alert sent to the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/225
teacher that there is a possible infraction implies that the teacher carries out
the review, there is an automated decision in the opposite direction since
the system selects those students whose evaluation process
(regarding the possibility of fraud) will not be reviewed.”
“Regarding desktop monitoring, the tool analyzes, among other measures, open programs, whether the user accesses the internet
during the exam, etc. Notwithstanding the above, the tool
only takes screenshots and is not able to access
private information on the student's computer. Furthermore, among the
measures for fraud control, the
student is also monitored via a second camera. This information is processed
using AI but without employing biometric techniques. In any case,
no automated decisions are made, and human
intervention is always involved in the review. To use the second
camera, the student must access a QR code that links to a URL
of the data controller, who will request permission to access
the personal device's camera.”
(iv) The 2020 DPIA and its 2023 update include the same
assessment of the necessity and proportionality of the processing, which is
scattered throughout various sections, concluding
that the processing is necessary and proportionate in a section of
common conclusions, which states the following:
“The conclusions are:
1. The processing operations analyzed are necessary
to achieve the purposes set out by the controller, since
no other way has been identified to achieve the processing purposes without
processing this personal data, or by processing less data.
2. The use of this type of system is necessary for the process to be
efficient and to provide the necessary educational quality guarantees.
3. The student receives all the information regarding the delivery method
of the training prior to the start of enrollment,
so that they can choose between the UIV methodology and that of other
universities. The student knows before enrolling that the
exams will be online and that there will be controls to prevent fraud, so
they have Other alternatives to in-person exams are available at other universities.
Access to UIV is free and with full knowledge of the details of the data processing analyzed in this Impact Assessment.
4. The processing operations carried out are proportionate, in that they are not excessive to achieve the proposed objectives.
5. The manufacturer/supplier has anonymized biometric data, thus providing security guarantees for said data. To verify which person the biometric data belongs to, the identifier available in the UIV Blackboard tool will be required.
6. Given the increase in academic fraud, it is considered that the only way to guarantee that such fraud does not occur in distance exams is to use technology and the means it offers to guarantee equal opportunities and quality of studies.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/225
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/225 -The unfair advantage that cheating creates in assessments for the students who commit it, and the corresponding disadvantage for the student who has made the effort to study.
-To maintain the prestige and confidence in the qualification obtained by the
student, and to ensure that its market value does not decrease.”
(v) Both DPIAs include the same analysis of alternatives to
the use of facial recognition technologies to evaluate students.
All the methods analyzed are those mentioned by the Spanish Data Protection Agency (AEPD) in its
report 0036/2020, as well as those proposed by the Dutch
data protection authority. It rules out their application.
(vi) The DPIA includes an analysis of the inherent risks of the processing
for both the rights and freedoms of the data subjects and the security
of the personal data processed, concluding with the existence of
risks of HIGH probability and VERY HIGH impact. An
action plan is provided that incorporates different controls and preventive measures
which are considered to be documented in the Preliminary Investigation
Action Report.
In response to the request for documentation of the security measures to
guarantee the processing, Document 6.1 is provided. 6.8, regarding which
the inspector considers that there is evidence of having adopted the
following security measures:
- Certification ***CERTIFICATION.1 from ***COMPANY.2 with an
initial certification date of July 28, 2023.
- Security best practices defined by AWS.
- AWS infrastructure security measures (source code protection, WAF, AWS IAM-based access control, encryption of
Amazon S3 buckets, SSH access for server administration,
SSH tunnel database connections, HTTPS traffic, monitoring of permissions and
activity through Access Advisor, event collection with
filebeat-logstash-kibana, restricted access to EC2 instances,
segregation of roles and least privilege).
- System security measures ***APPLICATION.1 at the
user level.
a. Certificate from ***COMPANY.2 signed on July 3,
2023, confirming that it does not perform user profiling and that the
monitoring of the second camera does not use biometric data.
b. The Information Security Policy of ***COMPANY.3.
c. Rules for the use of information systems of ***COMPANY.3.
or Finally, the respondent makes in section 7 of its document “Other
relevant statements” that:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/225
(i) The implementation of the technology ***APPLICATION.1 is not voluntary, but rather
is carried out in compliance with the requirement to implement fraud prevention controls in examinations imposed by ANECA, in the
aforementioned report. Furthermore, the Resolution of April 6, 2021, of
the General Secretariat of Universities indicates the need to use a
environmental monitoring camera. A copy of this resolution is attached as
Document 7.1
(ii) It is also a market demand, since students seek
universities that guarantee there will be no fraud but rather equal
opportunities.
(iii) The inspector's report considers the following statement noteworthy: “The
International University of Valencia (UIV) has students all over the
world, especially in Latin America. The alternative of traveling to
Spain or the creation of physical locations in all countries to take an
in-person exam is not considered at UIV, since it is a
100% online international university. The market acknowledges that the
UIV exams use facial recognition through biometric data, a technology that has been in use since 2017.
Following the doubts raised by the information provided in response to the first
information request, on November 29, 2023, a second
information request was sent to the UIV, focusing on the following
investigation:
o Request the commissioning agreement with ***COMPANY.2.
o Investigate the details of the tuition contract signed by the student.
o Investigate the possible options for using the software ***APPLICATION.1
eliminating the facial recognition component by using biometric data.
On December 20, 2023, a response to the second request was received from the UIV, in which:
o The commissioning agreement signed with the entity
that develops the system, ***COMPANY.2, was provided as Document 1. Specifically, it is a
document containing a second amending addendum, signed on December 19, 2022, which updated a previous service contract signed on May 27, 2015.
From this addendum of December 19, 2022—which coincides with the date on which the students referred to in this file received the first email urging them to use the application ***APPLICATION.1 starting on January 16, 2023—the following conclusions are drawn in the Preliminary Investigation Report:
(i) “That both parties entered into a service contract on May 27, 2015, for the online student authentication system ***APPLICATION.1, under which the client has contracted the supplier's software system ***APPLICATION.1.
Subsequently, on March 18, 2020, they signed an extension to the aforementioned contract and, on December 20, 2021, an addendum modifying it.
(i) The addendum of December 19, 2022, includes an annex with the data processing agreement. This agreement incorporates, among other aspects:
i. The obligations of the supplier as the data processor.
ii. UIV's powers as data controller.
iii. The data being processed, specifying that special categories of student data are being processed.
iv. The processing operations.
o As a “teaching contract,” documentary evidence of the entire
student enrollment process is provided, through screenshots with
explanatory captions contained in the response document. The inspector, in his report, considers that the teaching contract is entered into upon formalizing
said online enrollment process and accepting the general conditions that
were provided in your Letter 1.
o In response to the request to indicate the options available in
***APPLICATION.1 that allow for the exclusion of biometric processing, they state in their
third point, section b of the document that, as can be seen in the contract with
the data processor with
***APPLICATION.1, this company's offer
includes three service modalities:
“The offer from
***COMPANY.2 includes three service modalities:
***APPLICATION.1+ Monitor Control and Biometric Control
***APPLICATION.2 External Camera Surveillance
***APPLICATION.3 Human Review without Biometrics
o Regarding the analysis of other alternatives, they indicate the following:
“The Human Review service without biometric analysis has never been contracted
because it consists of a single human verification process
of the student's identity at the beginning of the course and before starting an
exam, but this service does not include continuous authentication during
the exam and lacks the necessary effectiveness in preventing
identity theft in online exams.”
“The ***APPLICATION.3 service consists of students not
going through biometric control, but rather connecting with an agent of
APPLICATION.1, showing their face through the webcam, and the
agent of ***APPLICATION.1 simply marking that student as
‘checked’ before starting the exam. It is therefore an
analog human identification process that is not a valid alternative
to biometric control and would not have received the same
consideration from the State Agency ANECA for granting official
recognition of a qualification.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/225
As can be seen in the impact assessment provided in the previous document,
before adopting biometric control, VIU analyzed the
different existing control alternatives and concluded that
the only measure that effectively prevented identity theft in online exams was biometric control.
This control model was validated by the State Agency ANECA after
the appropriate arguments were presented and the non-conformities
previously identified by ANECA regarding the prevention of identity theft and fraud in online exams were overcome.
Finally, they indicate that they have only contracted the first two
modalities of ***APPLICATION.1 (***APPLICATION.4 and ***APPLICATION.2),
stating the following: “As can be seen in the sample invoices provided
as DOCUMENTS 2, 3, and 4, the contracted and invoiced services are
limited to Monitor Control and Biometric Control, which appears on the invoices
as CM, and the external camera surveillance service, which appears on the
invoice as External.”
FOURTH: On April 22, 2024, a business report was obtained from the AXESOR tool, which states that the entity UNIVERSITAT
INTERNACIONAL VALENCIANA-VALENCIAN INTERNATIONAL UNIVERSITY, S.L. is a large company established in 2013, with a turnover of €1 in 2021.
FIFTH: On April 25, 2024, the Director of the Spanish Data Protection Agency agreed to initiate sanction proceedings against the respondent, pursuant to Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the commission of two alleged administrative infringements of Article Article 9 of the GDPR and Article 5.1.c) of the GDPR, as defined in Article 83.5 a) of the GDPR.
SIXTH: The aforementioned commencement agreement, in accordance with the LPACAP, was notified on April 29, 2024. The respondent requested an extension of time on April 30, 2024, which was granted by agreement dated May 7, 2024.
Finally, within the granted timeframe, the respondent submitted a statement of
allegations on May 21, 2024, in which, in summary, it alleges that the decision is manifestly unfair and contrary to law. It presents a preliminary allegation plus 10 grounds, which are set out below (including, for reasons of similarity, the preliminary and first allegations into a single ground):
Two categories of biometric data. Regarding the distinction between
verification/authentication and biometric identification.
They maintain that this is a manifestly unfair and unlawful resolution, since the verification/authentication carried out by their Program
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/225
***APPLICATION.1 does not involve the processing of biometric data according to the EDPB guidelines and existing regulations.
According to the University, both the European Data Protection Board (EDPB) and the Spanish Data Protection Agency (AEPD) have maintained for years a consolidated doctrine
on the distinction between biometric identification (1:n) and biometric verification/authentication (1:1), which has now changed. Article 9.1 of the GDPR only refers to biometric identification and does not include biometric verification in the list of high-risk processing activities, nor, consequently, in the list of special categories of data. This meant, according to the UIV that there are two categories of biometric data:
those that pose a high risk to the rights and freedoms of data subjects and those that do not.
According to their understanding, this interpretation has recently been changed by the European Data Protection Board (EDPB) in its Guidelines
EDPB 5/2022, according to which verification/authentication processes would also be considered biometric data, including high-risk and special category data.
The university disagrees with the new criterion expressed in these Guidelines,
stating that the extension of Recital
51 of the GDPR made therein contradicts Recital 91 of the GDPR—which states that there are two categories of biometric data: those that pose a high risk and those that do not—and Article 9.1 of the GDPR, which only includes biometric processing for unique identification as a special category, and not verification processing.
Furthermore, it understands that Guidelines 5/22 are not applicable to this
case, since they refer only to the context of the law and
police investigation, whereas the system ***APPLICATION.1 used by the
University is based on consent.
Moreover, the university points out that the Spanish Data Protection Agency (AEPD) maintained an
ambivalent position until November 2023, when it published a
"non-binding guide" on attendance control processing
using biometric systems (hereinafter, the Biometrics Guide), which follows
the new criteria of EDPB Guidelines 5/202. It understands that for a
period of 6 years there were no criteria, that these cannot be applied
retroactively, and that the guide is not a legal norm because it is not
binding.
They also indicate that, according to the new Artificial Intelligence Regulation (hereinafter, RIA), the biometric identity verification carried out by the UIV program
is considered excluded and is not considered data processing.
special category biometrics nor high-risk processing. They point out that the
RIA establishes two categories of biometric data: a) general data, which
do not pose a high risk; and b) biometric data that pose a high
risk. This corroborates the interpretation that excludes biometric verification
of special category data, according to the complainant.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/225
The system ***APPLICACION.1 contracted by the university to perform
continuous facial recognition of the student does not meet the characteristics of the
definition of biometric data referred to in section 2.1 of the Commencement Agreement.
Basically, it is emphasized that when registering a student, what the
UIV calls a “biometric pattern” is not saved. Instead, it is created and destroyed
during the verification process that takes place during the exam, which is
stored for a maximum of two seconds. This verification “is performed in real time
by comparing the biometric pattern created at that moment from the photo
taken by the student at the time of registration with the biometric pattern
created at that moment from the capture taken during the exam.”
Other technical characteristics of ***APPLICATION.1 are noted, such as that
it uses pseudonymized personal data, so the application does not
contain the student's identity, and that it uses a numerical code for
data processing. The process eliminates the possibility of
false positives or negatives.
There are no adverse risks. Since the sample taken to create the
biometric pattern is very small and limited, and insufficient to perform any
actions other than identity verification.
The application ***APPLICATION.1 does not comply with the characteristics of the
biometric templates established in section 2.2 of the Initiation Agreement.
It is emphasized that it does not store biometric patterns at the time of registration, and
that it only archives the biometric pattern for two or three seconds, as
demonstrated by the Roxburgh table. It is added that the first two DPIAs
carried out by the university followed the previous criterion maintained by the
EDPB and the Agency, which did not consider data obtained from
verification systems to be biometric data.
Exegesis of Article 9 of the GDPR: They provide the Roxburgh table published in
a 2017 book on fingerprinting by the U.S. Department of Justice to argue why there are no false positives or
negatives in their system, and to justify that biometric verification
with the data subject's consent radically eliminates the number of
false positives or negatives. In addition to reiterating that
biometric verification does not fall within the scope of Article 9.1
of the GDPR.
or Explicit consent as an exception to Article 9.2 of the GDPR and the legal basis
for processing.
The statement made in your initial response is amended, and it is noted that
the student provides consent in four phases:
a) Pre-contractual consent, in which, through the advertising offered
for the course and the general terms and conditions, which state that the course is
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/225
100% online, including exams, the student has the freedom to choose
whether to enroll with that University or another.
b) Contractual consent: in which the student expressly consents upon
registering and accepting the general terms and conditions.
c) Consent during the image registration process: by accepting the privacy policy.
d) Consent upon installing the application ***APPLICATION.1: which describes in a video and tutorial the entire verification process during the exam.
Being a 100% online university, any alternative that involves in-person exams is ruled out. Students are free to choose to enroll with another university. There is no power imbalance between the student and the university, and there are numerous benefits for the student, which are detailed below. The report on the balancing of interests attached to the DPIA is included as DOCUMENT 1.
However, the university also points out that consent is necessary to enroll and take the exams, since it is mandatory to verify the student's identity and ensure they are competing fairly and with the same opportunities as everyone else.
The essential public interest as an exception to Article 9.2 of the GDPR and the basis for processing.
After acknowledging that there is no pressing social need that justifies the existence of an essential public interest in preventing fraud in exams, the factors that the Agency has failed to consider in this regard are indicated.
• Existence of a legal basis under Article 6.1 of the GDPR.
There is a legal basis based on the free and full consent of the student and the legitimate interest of both parties, with the Agency bearing the burden of proof as it is a sanctioning body.
• The application of ***APPLICATION.1 is necessary, suitable, and proportionate: given the extent of the allegations made, they will be addressed in Legal Basis V, dedicated to their analysis.
• Regarding aggravating circumstances. The following is alleged:
Regarding the aggravating circumstance related to the “Nature, seriousness, and duration of the infringement,” it is argued that it is arbitrary and unfair for the Spanish Data Protection Agency (AEPD) to apply the duration of the processing, exceeding six years, as an aggravating circumstance, when practically the entire period coincided with the situation in which the AEPD itself did not clarify its position until November 2023, that is, after the reported events. Furthermore, it could be
understood that, by doing so, the AEPD is contradicting its own previous actions.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/225
Regarding the circumstance of “intentionality or negligence in the infringement,” it denies its existence, given that it has been
demonstrated that VIU acted diligently at all times,
carrying out the appropriate impact assessments, which were updated after
the publication of EDPB Guidelines 5/2022. VIU has understood at all times
that biometric authentication is not included in the scope of
Article 9.1 of the GDPR, since the data necessary to perform a
1:1 comparison are minimal and cannot be used for any other
purpose. This position has been confirmed by the new RIA. Therefore, the classification of gross negligence is
inadmissible when analyzing these Guidelines in
its impact assessment and considering that they were not applicable to it. It is further alleged that, according to the recent ruling of the Court of Justice of the EU of December 5, 2023, non-compliance with the GDPR can only be sanctioned in cases of intent or negligence. The burden of proof regarding intent or negligence lies with the administration, and the Agency has not proven it in this proceeding. Furthermore, they point out that the VIU has amply demonstrated its diligence by continuously verifying that the processing did not jeopardize the rights and freedoms of the students.
Regarding the connection between the infringer's activity and the processing of personal data, it is argued that this circumstance applies only to companies whose corporate purpose and main activity is the processing of personal data, and therefore is not applicable to the VIU, which is an international university dedicated to teaching.
Finally, regarding the application of the circumstance relating to the categories of personal data affected by the infringement, it reiterates
that the UIV does not process biometric data.
Along with its statement of allegations, the UIV provides the following documentation:
As Document 1, it includes the Legitimate Interest Assessment Report for the
processing, which is included as an update to the DPIA dated January 2024.
As Documents 2 to 4, it provides the invoices issued between August and November 2023 for the purpose of paying for the exams contracted with ***COMPANY.2, which were carried out in accordance with the program
APPLICATION.1 contracted in December 2022.
SEVENTH: On July 24, 2024, the University submitted a new document expanding on the allegations made in order to provide the expert report on the "Online Proctoring ***APPLICATION.1" tool prepared by
***COMPANY.3 on July 22, 2024.
EIGHTH: On July 22, 2024, the Director of the Spanish Data Protection Agency (AEPD) issued a change of investigator agreement, which was notified to the respondent on August 26, 2024.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/225
NINTH: On July 24, 2024, the UIV submitted a document, providing an expert report from the IT consultancy firm ***EMPRESA.3, which states the following:
“That, by means of this document, and in accordance with the “Additional Clause” in which the admission of the proceedings to trial was requested, an Expert Opinion on the monitoring tool ***APLICACIÓN.1, issued by A.A.A., on July 23, is hereby submitted.” 2024, along with a final certificate, and whose
conclusions are:
“The expert analysis carried out on the online proctoring tool ***APPLICATION.1
has demonstrated that it complies with the requirements established by the Spanish Data Protection Agency (AEPD) and the specific criteria defined
by VIU (***COMPANY.3). The tests and technical verifications ensure that:
1. No permanent biometric patterns of the
students are created or stored. 2. Biometric data is processed and destroyed immediately
after each real-time verification. 3. Multiple
verifications are performed during the exam to confirm the student's identity. 4. The
process includes human supervision to minimize errors and false positives.2.5. Data processing is carried out in a secure and encrypted environment
provided by AWS and by the configuration of the services that are part
of the application architecture, applying a shared responsibility model
between AWS and ***APPLICATION.1.
6. Student data is
pseudonymized throughout the process. Based on the results obtained,
it is concluded that the ***APPLICATION.1 tool meets all the
established compliance requirements and there are no less
intrusive alternatives that offer the same level of security and authenticity in the
verification of student identity. Therefore, a certificate of compliance is issued
in favor of the ***APPLICATION.1 tool for its continued
use by VIU (***COMPANY.3).
Along with said document, three documents signed by A.A.A., from the IT consulting firm ***COMPANY.3, are attached, dated July 23, 2024:
"Certificate of Final Expert Report on the Surveillance Tool ***APPLICATION.1".
"Security Report: technical report with a description of the tests performed and the results. - "Annex I: evidence collected during the tests.
TENTH: On December 16, 2024, the investigating officer issued a statement to add to the proceedings the updated Commercial Report for the Axesor tool, obtained on October 2, 2024, which states that the INTERNATIONAL UNIVERSITY OF VALENCIA has an annual business volume of €***AMOUNT.2 for the 2022 fiscal year.
ELEVENTH: On December 16, In December 2024, the investigating officer issued a report to record the data relating to the UIV's academic offerings published on its website, as well as the students enrolled in the UIV's undergraduate, master's, and doctoral programs between the 2019-2020 and 2023-2024 academic years.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 23/225
This information was taken into consideration to determine the scope of the infraction and the appropriate sanction.
TWELFTH: On January 15, 2025, an agreement was issued to open a probationary period, incorporating all documents contained in the file.
The reports on business volume and enrolled students issued on December 16 were attached. In 2024, the expert report submitted is admitted as evidence, and the UIV is required to provide the following within 10 days:
4.1. All contracts entered into with the entity responsible for the development of the
program ***APPLICATION.1, mentioned in the amending addendum of
19-12-22, which was submitted as Document 1 of its response to the second
investigation request made by this Agency.
4.2. Clarify the dates on which the
different modalities of ***APPLICATION.1 with facial recognition that were contracted and put into operation
with ***COMPANY.2 were contracted and put into operation, clarifying what the
version “***APPLICATION.5” submitted as Document 3.8 corresponds to, which is not
mentioned in the contractual addendum submitted.
4.3. Provide the technical specifications for each modality of
APPLICATION.1 that has been put into operation, issued by the
manufacturer/supplier or entity responsible for its development.
or 4.4. Since only two manuals are provided, corresponding to
***APPLICATION.4 and ***APPLICATION.5 and dated August 2023, please clarify and
provide proof of the dates of availability or delivery of the
training manuals and technical information corresponding to versions
***APPLICATION.4, ***APPLICATION.2, ***APPLICATION.5 and any others
that may have been used as a method of identity verification and
fraud control in university exams since May 2018.
THIRTEENTH: After requesting an extension and delivery of a copy of the
file (not requested until now) on January 29 and 30, 2025,
an extension is granted and the copy is delivered on February 4,
2025.
TENTH FOURTH: On February 6, 2025, the UIV submitted a written response to the request for evidence, providing the following documents and making the following allegations:
DOC 1. Contracts and addenda signed with ***COMPANY.2, which, according to the UIV, were in effect as of April 25, 2021.
a) Service contract signed on May 27, 2015.
b) Extension of the service contract of May 27, 2015, signed on March 18, 2020.
c) Amendment to the service contract of May 27, 2015, signed on June 14, 2021.
d) Amendment to the service contract of May 27, 2015, signed on December 20, 2021.
DOC 2. Report from ***COMPANY.2 on the program modalities
***APPLICATION.1 contracted by the UIV. It states that: “only
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 24/225
have three plans or versions of the ***APPLICATION.1 program, whose
names and technical characteristics are as follows:
“• ***APPLICATION.6: Designed for monitoring users' computers
in classroom environments. In this case, the system only monitors or
blocks the computer, while verifying the identity of the
students remains the responsibility of the teacher.
• ***APPLICATION.4: Includes all the functionalities of ***APPLICATION.6,
but adds an identity
authentication system using the computer's webcam.
• ***APPLICATION.7: Contains all the features of ***APPLICATION.4,
with the difference that it incorporates monitoring of the environment of the user, as
required by accreditation agencies. This requires the use of a
second camera.”
Two pieces of information provided in previous documents are corrected,
since the ***COMPANY.2 Report states that: “References to the
versions “***APPLICATION.2” or “***APPLICATION.5” are erroneous and should be understood
as referring to version ***APPLICATION.7, which incorporates monitoring of the user's environment
through a second camera. It is essential to highlight that the ***COMPANY.2 Report states that all the described versions function in the same way
with regard to the technical aspects of the system—as will be explained in the
following section—and that, in the case of VIU, in 2018 the system was upgraded from version
APPLICATION.4 to version ***APPLICATION.7:
Regarding the technical operating specifications of all versions of the
program: it states that it cannot provide them because the manufacturer/supplier
of the program indicates the following: “Finally, and in response to the request in the
section 4.3 of the AEPD agreement, we must clarify that no technical specifications have been published for each ***APPLICATION.1 modality, beyond the information available on our website.” To complete this evidence, in section 3, the ***COMPANY.2 Report outlines the technical specifications regarding the processing of biometric data, which are common to all three existing versions.
or DOC 3. Program Training Manuals.
The UIV points out that: “Given that these manuals are made available in the general virtual classroom, which technically always has the same URL, and since there are no records of when these manuals were uploaded, we cannot specify the exact date on which each version of the manuals was made available,” and provides as Document No. 3. The following versions of the manuals, in addition to those
already submitted in August 2023:
a) December 2020 version.
b) August 2022 version.
FIFTEENTH: On February 26, 2025, a new document was submitted
regarding the initial agreement by B.B.B., acting on behalf of and representing the UIV, stating that, as a result of
new facts, new allegations were made requesting the dismissal
of the case. In summary, the following was alleged:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 25/225
First. – The Disciplinary Proceedings are based on an erroneous premise:
biometric data for authentication/verification do not constitute a
special category of personal data under Article 9.1 of the GDPR.
The arguments made in the document of May 21, 2024, are reiterated, and a judgment is added.
Second. – The Artificial Intelligence Regulation (RIA) and Directive 2024/2831/EU 2024 ...
In addition to reiterating everything stated above regarding the regulation of the RIA, it is added that the new Directive 2024/2381 of 23 October, concerning the improvement of working conditions in platform work (hereinafter, “Directive 2024/2831”), points out that its recital 41 clearly distinguishes between “biometric data for identification purposes” and “biometric data for the purpose of verifying the identity of the person”, only prohibiting the processing of the former; and that Article 7.1.f) of the same
only limits the processing of biometric data for identification purposes, not biometric data for verification purposes: “1. Digital work platforms may not, through automated
tracking systems or automated decision-making systems: […]
SIXTEENTH: On March 6, 2025, a proposed resolution was issued for this case, which was notified on March 12, 2025, in which it was agreed to dismiss the allegations made by the defendant university, and it was proposed that:
“That the Director of the Spanish Data Protection Agency sanction UNIVERSITAT INTERNACIONAL VALENCIANA-VALENCIAN INTERNATIONAL UNIVERSITY, S.L., with Tax Identification Number B98585797, for committing two infringements:
or An infringement of Article 9 of the GDPR, classified under Article 83.5 of the GDPR, with a fine of €450,000.00 (four hundred and fifty thousand euros).
or An infringement of Article 5.1.c) of the GDPR, classified in Article
83.5 of the GDPR, with a fine of €550,000.00 (five hundred and fifty thousand euros).
SEVENTEENTH: On March 20, 2025, the UIV requested an extension of the deadline for submitting arguments to respond to the proposed resolution, and on March 24, 2025, said extension of the deadline for submitting arguments was granted for a period of 5 business days.
EIGHTEENTH: On April 1, 2025, the UIV submitted a document of arguments against the proposed resolution of the proceedings (hereinafter, AlegPR), which consists of 88 pages organized into the following arguments (issue
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 26/225
Preliminary objection, preliminary allegation, and allegations one through six), the statements of which are listed below (literal transcription):
"PRELIMINARY ISSUE: The Proposed Resolution violates the fundamental rights of VIU: violation of the principle of retroactive application of the most favorable law and the principle of double jeopardy.
1. Existence of new facts that lead to the dismissal of the Disciplinary Proceedings: the RIA and Directive 2024/2831 stipulate that biometric data for authentication/verification (1:1) do not constitute a special category of personal data. Retroactive application of the most favorable law.
2. Violation of the principle of double jeopardy: two infringements are imputed for the same facts.
PRELIMINARY ALLEGATION – Summary of the controversy raised.
" 1. Conduct attributed to my client: use of the program
***APPLICATION.1 in the administration of exams by students.
Statement of Proven Facts.
2. Infringements attributed to my client.
3. Summary of the grounds for opposition to the Proposed Resolution.
or FIRST ALLEGATION: The Proposed Resolution is based on an erroneous premise: biometric data for authentication/verification (1:1) does not constitute a special category of personal data under Article 9.1 of the GDPR.
The conduct attributed to VIU is not a crime.
1. Introduction.
2. Differentiation between the processing of biometric data for the verification/authentication of a person (1:1) and the processing of this data to identify a person (1:n). This distinction has been maintained following the approval of the GDPR, as recognized by the Spanish Data Protection Agency (AEPD).
3. – The processing of biometric data for verification/authentication (1:1)
is excluded from the special categories of personal data provided for in
Article 9.1 of the GDPR.
4. – Prohibition of retroactively applying unfavorable sanctioning rules.
5. – The RIA and Directive 2024/2831 confirm that biometric data for
authentication/verification does not constitute a special category of personal data.
In any case, these rules must be applied retroactively.
6. – The Proposed Resolution carries out an extensive interpretation “in malam parte”.
7. – Suitability of biometric verification systems and their lack of impact on
fundamental rights.
8. – Conclusions.
SECOND ALLEGATION: The Proposed Resolution violates the principle of double jeopardy (non bis in idem), established in Article 39.5 of the LRJSP (Law on the Legal Regime of the Public Sector), since it imputes the commission of two infringements for the same facts.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 27/225
THIRD ALLEGATION: Article 9 of the GDPR has not been violated: the consent given by the students is freely given and the processing is necessary for reasons of essential public interest.
1. Introduction.
2. The consent given by the students is freely given. The consent must be assessed at the time it is given, when the contract is finalized, and cannot be required subsequently.
3. – The processing is justified by reasons of essential public interest,
as recognized by the Spanish Data Protection Agency (AEPD) in previous cases.
4. Conclusions.
or FOURTH ALLEGATION. Article 5.1.c) of the GDPR has not been violated: the
processing is necessary and proportionate.
1. Introduction.
2. – There are no alternative measures that are adequate, necessary, and
proportionate in the strict sense. Therefore, the processing carried out by
VIU is necessary.
3. – The processing carried out by VIU is proportionate in the strict sense.
The (non-existent) benefits and harms arising from
the alternative measures should not have been weighed, since these are not suitable for achieving the
intended purpose.
4. – Conclusions.
or FIFTH ALLEGATION. The Proposed Resolution violates the principle of
culpability: given the interpretative doubts arising from the GDPR, it is not possible
to impose a sanction.
1. – Introduction.
2. – As this Agency has acknowledged, it is a
controversial issue whether the processing of biometric data for verification
constitutes a special category of personal data.
3. – The principle of culpability prevents the sanctioning of an
entity that has acted under a reasonable interpretation of the regulation. The
Proposed Resolution violates the doctrine of the Supreme Court and its
recent ruling in the LaLiga case.
4. VIU cannot be considered to have acted with gross
or very gross negligence for having maintained a different interpretation than that
upheld by the AEPD 2023 Guide.
5. Conclusions.
or SIXTH ALLEGATION: Incorrect application of the criteria for determining
the sanctions.
1. – Introduction.
2. – Incorrect determination of the penalty imposed for the alleged infringement of Article 9 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 28/225
3. – Incorrect determination of the penalty imposed for the alleged infringement of Article 5.1.c) of the GDPR.
4. Conclusions.
The written objection to the proposed resolution of the case file is accompanied by three documents:
Document 1. Report from the National Cryptographic Center, December 2024,
on Secure Biometric Technologies for Access Control.
Document 2. Resolution of sanctioning procedure no. PS 41/2022,
regarding the Foundation for the Open University of Catalonia (hereinafter
FUOC), from the Catalan Data Protection Authority.
Document 3. TESLA report “D5.3 – Instruments technical description
and development scheduling” dated July 29, 2016. In English, without a Spanish translation.
From the actions taken in this procedure and the documentation
contained in the file, the following have been established:
PROVEN FACTS
FIRST: It is established that the UIV uses the program/software for its online exams “***PROGRAM.1” employs facial recognition techniques, artificial intelligence, and automated decision-making mechanisms to verify the identity of students participating in online exams and monitor their behavior to prevent fraud/plagiarism and ensure academic quality and integrity. This system is implemented as a mandatory exam method for students, with no alternative offered.
The contracted tool is called ***APPLICATION.1 and was developed by
***COMPANY.2, with which the UIV formalized an initial service contract
and data processing agreement on May 27, 2015, which was subject to several extensions
and updates, the last of which was signed via a contractual addendum on
December 19, 2022.
According to clause one of the contractual addendum signed on December 19, 2022, between
***COMPANY.2 and UIV, submitted as Document 1 of the letter dated December 20, 2023, it is stipulated that: “Both parties entered into a service contract on May 27, 2015, for the online student authentication system ***APPLICATION.1,
under which the client has contracted the software system ***APPLICATION.1
from the supplier. Subsequently, on March 18, 2020, they signed an extension
to the aforementioned contract, and on December 20, 2021, an amending addendum to the same.” All these extensions and amending addenda were submitted by the university on February 6, 2025.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 29/225
According to the technical specifications submitted to the proceedings as Document 1.2 of the letter dated November 16, 2023, the operation of
***APPLICATION.1 - in any of its different modalities - includes the following three actions (phases):
a. Acceptance of the terms and conditions - During the registration phase, the student reads and accepts the terms and conditions that govern the use of the
***APPLICATION.1 system.
b. Identity registration - The system captures the student's image for the first time and formalizes their registration in the system with the corresponding installation of the software and peripherals. This process requires the student's cooperation in the contractual phase.
c. Monitoring of activities during the exam - The student is
continuously monitored and authenticated during the different
exam activities (...)
However, it has been established that the UIV has contracted various versions or
modalities of ***APPLICATION.1 from May 27, 2015, to the present,
with the main objective of expanding the tools for monitoring
activities during the exam.
According to the University's own statements, the manufacturer's report
from the company that developed the ***COMPANY.2 program dated January 30, 2025, the various
contractual documents signed with ***COMPANY.2, and the invoices submitted
as Documents 2 to 4 of the same document dated December 20, 2023, it is
proven that the UIV has contracted and implemented various modalities of the aforementioned
facial recognition and exam monitoring program:
o In 2015, the University contracted with ***COMPANY.2 a first
version of the program ***APPLICATION.1 that used facial recognition for
the identification of students participating in UIV exams, which
was renamed ***APPLICATION.4 as of the contract of 18-3-20, and
which remains in force and is currently being applied, as stated in the latest
contractual addendum of 19-12-22.
According to Annex I of the Contract signed on May 27, 2015, this
initial version of the contracted software already used a facial recognition system
as a means of verifying the identity of students participating in
online exams and monitored their activity through the webcam,
through desktop monitoring, and the recording of images and audio,
during their online exams, which were analyzed
automatically using artificial intelligence techniques, and were subsequently supervised
by a professor.
Until the signing of the contractual extension of On March 18, 2020, the University had contracted the initial version of ***APPLICATION.1, which was later renamed
APPLICATION.4. In this version, the monitoring phase of
activities during the exam was carried out using the following
tools, which are listed in Document 1.2 and coincide with
those indicated in the Training Manual for ***APPLICATION.4, submitted as
Document 3.6:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 30/225
- Monitoring via the computer's webcam: the system periodically captures
images from the user's webcam, which are analyzed
using AI algorithms. It is important to note that the analysis is performed without
storing any type of biometric data from the user. Furthermore, the
comparisons are always performed one-to-one, not one-to-many,
resulting in very little processing intrusive.
-Desktop monitoring: the system monitors the actions
(open programs, web browsing, etc.) that the student performs during the
online activity. This system guarantees that at no time is the user's
private information accessed. The student is aware of
the monitoring.
-Audio recording: this is one of the software's add-ons
and is based on a sound threshold that, if exceeded, will start the
audio recording. The recordings are made available to the
institution.
On May 31, 2019, ANECA issued a favorable report on the
proposed modification to the curriculum submitted by UIV regarding
the Master's Degree in Nutrition and Health, which is attached as
DOCUMENT 3.4 (p. 337 of the file). In this report, after UIV submitted
arguments concerning improved environmental control during the online exam,
proposing the inclusion of an environmental monitoring system using dual
cameras, ANECA considered that: “This system does not allow us to fully ensure
that the student does not receive any type of external assistance during
the exam. It is recommended that this issue be addressed. This
recommendation is mandatory, and compliance will be reviewed
especially during the monitoring and accreditation phases of the degree.”
It is established that the University—seeking to comply with the recommendations
of ANECA to ensure that no fraud occurred in the exams—modified
its Curriculum to include environmental monitoring via dual cameras, and
on March 18, 2020, extended the service contract and data processing agreement to
include a new environmental monitoring tool using dual cameras, contracting for this purpose a new version of this program
initially called ***APPLICATION.8, which was renamed
APPLICATION.2 upon signing the contract on June 14, 2021, and which remains
in effect today under that name following the signing of the addendum on December 19, 2022.
Contractual designations corresponding to the Plan version
***APPLICATION.7 of the program that the manufacturer developed starting in 2018,
as stated in its report of January 30, 2025.
According to the UIV's statement of December 20, 2023, and
the contract extensions and addenda submitted on February 6, 2025, the difference
between the initial modality (***APPLICATION.1, or ***APPLICATION.4) and the new
modality contracted from March 18, 2020 (which received various designations
such as ***APPLICATION.8, and ***APPLICATION.2) was limited to adding one more control tool
in the student monitoring phase, which corresponded to
the new environmental monitoring system through the installation of a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 31/225
Dual camera, which, according to Document 3.7 mentioned above, consisted of
the following:
“-Environmental monitoring via a second camera: by using a
mobile phone as an external camera, the software is able to monitor the
student's surroundings, providing a better viewing angle and being able to
detect the presence of other people or the use of items not permitted by
the student. The analysis of these images is performed using
AI algorithms without applying biometric analysis.”
Finally, in accordance with clause two of the latest contractual addendum signed on December 19, 2022, the offer from ***COMPANY.2 currently includes three service options. UIV indicated in its second written response to the research request that it has contracted the first two options and paid the invoices for the exams for the first half of 2023, according to the prices agreed upon in said addendum.
It is hereby stated that the options are as follows:
***APPLICATION.4
***APPLICATION.2
***APPLICATION.3
It is therefore established that from March 18, 2020, to the present, the UIV has been
contracting both modalities ***APPLICATION.4 and ***APPLICATION.2 (albeit with
different names), and that the combined version of both modalities
contracted on December 19, 2022, is referred to in the Training Manuals and
informational documentation published on the website as “***APPLICATION.5,” and corresponds
to what the program developer offers as Plan
***APPLICATION.7, as stated by the developer in its report of January 30, 2025. Thus, the UIV, in its letter of February 6, 2025, after the issuance of said
report from ***COMPANY.2, indicates that: “ii. That references to versions
“***APPLICATION.2” or “***APPLICATION.5” should be understood as referring to version
***APPLICATION.7, which incorporates user environment monitoring.”
SECOND: Regarding the facts stated in the complaint to which this proceeding refers, it is established that on the same day the last contractual addendum with the manufacturer of ***APPLICATION.1 was signed (December 19, 2022), the University informed students via email that the monitoring of the environment through the dual camera system would be mandatory for exams taken from January 16, 2023 onwards, and that they should download the necessary programs listed in document 3.4 of the complaint. In response to the students' complaints, it is established that the UIV replied that this decision had been made by the UIV Governing Council on May 3, 2022.
The invoices provided in the second written response (Documents 2 to 4)
confirm that the 2023 exams were administered using the version of the program ***APPLICATION.1 that employed facial recognition and monitored the environment, as they show that payment was made on August 9, 2023, to the service provider and data controller for the portion corresponding to the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 32/225
exams administered using the modalities ***APPLICATION.4 and
***APPLICATION.2.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 32/225 THIRD: It is also established that the UIV had the option to contract the
***APPLICATION.3 modality from the signing of the amending addendum of June 14, 2021,
which allowed for human supervision without using biometrics, but that this was
discarded by the UIV—without analyzing it in its 2020 Data Protection Impact Assessment (DPIA), nor in its subsequent updates
of 2023 and 2024—for the following reasons, which are expressed in its
letter of December 20, 2023:
“The Human Review service without biometric analysis has never been contracted
because it consists of a single human verification process of the student's
identity at the beginning of the course and before starting an exam, but this service does not
include continuous authentication during the exam and lacks the necessary
effectiveness in preventing identity theft in online exams.
The ***APPLICATION.3 service consists of students not going through
biometric
control, but rather They connect with an agent from ***APPLICATION.1, show their
face via webcam, and the ***APPLICATION.1 agent simply marks
that student as “checked” before starting the exam.
This is therefore an analog human identification process that is not
a valid alternative to biometric control and would not have received the same
consideration from the State Agency ANECA for granting official recognition of a
degree.”
FOURTH: Regarding the operation of the program ***APPLICATION.1, it is
established that it employs a facial recognition system for the purpose of
verifying the identity of students participating in university exams,
which, according to the information currently provided on the UIV website to
students—as documented in Annex I of the Master's Verification Report on “Identity Control and Plagiarism,” submitted as
Document 3.2 of the letter dated November 16, 2023—consists of two phases (emphasis added):
Phase 1: Onboarding Process:
The assurance of identity and to guarantee that
the person who enrolls is the one who actually accesses the campus and is
evaluated” is related to the “onboarding” process, that is,
the first access to the virtual campus. (...)
Once this process is completed and the document is signed, the University collects
the technical record of the process and Generates the certificate attesting to the video identification and signature of the document. (...) The provider of this solution is the company ***COMPANY.2.
Phase 2: Accrediting the authorship of the continuous assessment and supervision process for online exams:
(...)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 33/225
In this way, through this process, auditing and monitoring are carried out at three levels:
(...)
Furthermore, it is accredited that, as indicated in the report from ***COMPANY.2 dated January 30, 2025: (...)
The report from ***COMPANY.2 states: “Therefore, we want to make it clear that the use of biometric data is not affected at any time by the choice of one plan or another.” (…)”.
Despite the lack of supporting documentation for this assertion, it is considered
proven, given that it coincides with what is described in Document 1.2 and
the submitted Data Protection Impact Assessments (DPIAs), which, in describing the four monitoring tools of the
program ***APPLICATION.1, refer to the fact that the process of verifying
the student's identity through 1:1 comparisons and photographs
taken is carried out solely within the tool for “Monitoring via the computer's webcam”.
FIFTH: The UIV has provided a Data Protection Impact Assessment (DPIA) for the processing dated September
2020 and two updates to the DPIA dated July 2023 (as Document 5
of the letter dated November 16, 2023), and January 2024 (Document 1 on
“Legitimate Interest Weighing Report” submitted with the letter of
allegations to the initiation agreement).
None of these DPIAs appear The document is unsigned, and the name of the person responsible for its approval is not indicated.
Its sections do not appear in the order and with the names indicated in the index, so it is not documented on what specific dates they were carried out, nor that they were signed by the data controller.
The essential content of the DPIA and its updates, as contained in these documents, is as follows:
5.1. The first DPIA, from September 2020, was submitted first among the documents included in Document 5, entitled “Facial Recognition and Desktop and Environment Control in Online Exams. September 2020” (p. 552). Its essential content is as follows:
-The index indicates that the DPIA consists of 30 sections, the last of which is the “evaluation update appendix.” However, the sections do not appear in the indicated order, the DPIA is not paginated, there is no update appendix, and other sections are included. Documents such as “evidence” that are not
listed in the index and whose date of creation is unknown.
- The name and description of the processing is: “Facial recognition and control
of the desktop and environment in online exams.”
- The purposes of the processing are listed as: 1. To verify that the student taking the exam is who they claim to be. 2. To prevent identity theft, and
3. To prevent fraud or copying in exams.
- In the systematic description of the processing operations, the data subject to processing in each operation and the data controller are specified:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 34/225
a) In the actions subcontracted to ***COMPANY.2, related to the registration of the
student on the virtual campus, biometric data is not processed, but rather the personal
data (facial image) of the students, since it is stated that “(…)”.
b) But in the Actions sub-tasked to ***APPLICATION.1 indicate that the student's facial pattern is processed and that the following is performed: (i)
***APPLICATION.1 (Platform Registration): it is indicated that the facial pattern is the data processed, and that “(…)”; (ii) and ***APPLICATION.1 (Taking an Exam)
it is stated that the facial pattern and facial expressions are processed in the following way:
“(…)”
- Although the systematic description of processing operations does not
refer to desktop or environment control, a section is dedicated
to “desk and environment control” (p. 616), which corroborates the fact that in
September 2020 the UIV was already using environment monitoring
corresponding to the ***APPLICATION.7 Plan and contractual modalities
***APPLICATION.2 and ***APPLICATION.5.
- In section 11, it states that no special category data is processed. And In analyzing the legal bases, it is noted that: “The explicit consent of the data subject is the first legal basis presented when discussing special categories of data. Although biometric data is not considered a special category of data, VIU has been requesting the consent of prospective students since 2018, through the acceptance of the general terms and conditions before formalizing enrollment.”
- Subsequently, the Data Protection Impact Assessment (DPIA) analyzes four legal bases applicable to this processing: data subject consent, performance of a contract, legitimate interest, and public interest.
- An analysis of the inherent risks of the processing is included, both for the rights and freedoms of the data subjects and for the security of the personal data processed. It concludes that there are risks of a high probability and a very high impact, providing an action plan that incorporates the following controls and preventive measures. An analysis of the residual risk is also performed, concluding that it is acceptable.
- An assessment of the necessity and proportionality of the processing is carried out,
scattered across various sections, without expressly referencing the
suitability assessment of the processing. This assessment includes an
analysis of alternatives to the use of facial recognition technologies
for evaluating students, mentioning the alternatives
analyzed by the Spanish Data Protection Agency (AEPD) in report 0036/2020 from the
Legal Department of this Agency, in response to a query from
a distance learning university regarding the use of
a program called ***PROGRAM.1 that used facial recognition in its
online exams, in a scenario very similar to the present one:
5.2. The 2020 EIPD was updated in July 2023, and this document is also included
with Document 5, entitled “Facial recognition and
desktop and environment control in online exams. (...). September 2020 - Updated in July 2023, dated July 2023” (p. 693 exp).
Regarding which the following should be noted:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 35/225
Its index comprises 30 sections (pp. 693 to 839), and two annexes in
sections 31. II - update of the assessment (p. 840), and
section 32. Annex II – update of the assessment (evidence) (p. 842) Exp.
In the first 30 sections, the UIV makes the following essential modifications
compared to the previous one from 2020:
The description of the processing, although it refers to the assessment date
of “September 2020”, does not coincide with the one carried out
on that date, since the name of the processing is
“User facial recognition and fraud prevention in
online exams”, and the purposes of the The processing activities are now 5: 1.
Verify that the student taking the exam is who they claim to be,
2. Prevent identity theft,
3. Prevent fraud or cheating on exams,
4. Guarantee academic quality and integrity,
5. Ensure compliance with the requirements of certifying bodies (ANECA).
The 3 monitoring actions assigned to
COMPANY.2, which were not included in the 2020 systematic description of data processing operations, are added:
it is specified that in webcam monitoring operations, the facial pattern is processed; in desktop monitoring, the user ID is processed; and in environmental monitoring via a second camera, only the image is processed.
A new section on processing related to
“Monitoring student activity” is included, which serves the purpose of fraud prevention.
The 4 previous legal bases for processing are maintained. However,
a “weighting table of legitimate interest” is added to the basis of the legitimate interest, and a sensitivity analysis of the biometric data used in the processing is included, along with several sections dedicated to the
differentiation between authentication and identification, in which the
university references this Agency's legal reports
0036/2020, 0047/2021 and EDPB Guidelines 05/2022 to reach
the conclusion that its program does not process special category data
because it is based on an authentication process that performs
1:1 comparisons. (p. 739 exp).
or In the update annexes, evidence of the pre-contractual information provided as the legal basis for the consent given by the
student is added, as referenced in Finding Ten, and of the
adoption of certain security measures for the processing.
5.1. Finally, it is noted that a final update to the DPIA was carried out in January 2024, in order to include the Legitimate Interest Balancing Report, which is attached as Document 1 of the statement of allegations to the initiation agreement (p. 1081 of the file), an 18-page document that refers to the following phases of the “balancing procedure”:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 36/225
First phase. - Identification of the legitimate interest and assessment of compliance with the requirements established in the GDPR and local regulations.
Second phase. - Assessment of the suitability of the processing.
Third phase. - Assessment of the necessity of the processing.
Fourth phase. - Assessment of the balance between the legitimate interest of the controller and the fundamental rights and freedoms of the data subjects.
Once this assessment is completed, the weighting will be carried out and the final decision will be made, concluding whether or not the processing can be carried out, based on the company's legitimate interest.
SIXTH. It is hereby established that the UIV adopted the following technical measures aimed at ensuring a level of security appropriate to the risks of the processing carried out, which are included in all versions of its ***APPLICATION.1 program, as stated by the program developer in its report of January 30, 2025:
6.1. First, the measures referenced in the technical specifications document for ***APPLICATION.1, provided in Document 1 (whose authorship and date are unknown, as there is no date or signature), are considered to be in place. These measures were included in the 2020 Data Protection Impact Assessment (DPIA) and its updates:
- All recommendations and best practices in code development and web vulnerability review, such as those of (...) among others, are followed.
Certification ***CERTIFICATION.1 is available.
- Annual external audits are conducted. The most recent audit, carried out in 2024, was submitted.
- Anonymized data storage: ***COMPANY.2 never knows the identity of the users it is monitoring. ***APPLICATION.1 does not handle identities, and all incoming data is linked to an alphanumeric code. The relationship between codes and the identity of individuals resides on the servers of the data controller.
-The biometric processing performed is for authentication
(comparisons 1.1) and not identification (comparisons 1.N).
- The processing has been designed to ensure that biometric data
is not stored. The image capture and analysis procedure
is described in the manufacturer's report of January 30, 2025:
1. User Identity Registration: Before being monitored,
each student must complete a registration process. During this
step, the system captures an image of their face, which will later be used
for identity authentication.
2. Activity Monitoring: Once the monitoring process has begun,
the system periodically captures images of the user via the webcam.
a. Each image received is compared with the previously registered photo.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 37/225
b. To perform the comparison, biometric data is extracted from
both images (registration + captured image) and analyzed.
c. This data is not stored at any time; only the result of the comparison is saved.
d. This procedure is repeated for each image obtained
during the monitoring.
- The aspects monitored by the tool while the student is
taking their exam are, according to the EIPD:
***APPLICATION.1 does not record video, (...).
6.2. Furthermore, according to the Preliminary Investigation Report for this procedure, and in accordance with Documents 6.1 to 6.8, there is evidence of having adopted the following security measures:
o Certification ***CERTIFICATION.1 from ***COMPANY.2 with an initial certification date of
July 28, 2023.
o Security best practices defined by AWS.
AWS Infrastructure Security Measures (…)
System Security Measures ***APPLICATION.1 at the user level.
Certificate from ***COMPANY.2, signed on July 3, 2023, confirming that it does not perform user profiling and that the monitoring of the
second camera does not use biometric data.
Information Security Policy of ***COMPANY.3.
Information Systems Usage Rules of ***COMPANY.3.
SEVENTH: The UIV has acknowledged that all modalities of the program
***APPLICATION.1 implemented by the UIV process personal biometric data (facial pattern), as evidenced by the following documentation:
The RAT submitted to the procedure as Document 2 indicates that the following categories of data are processed:
“identification data, student image, biometric data—facial pattern, behavior during the exam, and assessment content.”
This is confirmed by the 2020 Data Protection Impact Assessment (DPIA) and its 2023 update, in which
the systematic description of processing operations shows that the
Virtual Intelligence Unit (UIV) identifies the concept of “biometric data” with the image or photograph of the
student's face captured during the student registration phase on the
virtual campus, and distinguishes it from the concept of “facial pattern,” which is processed by the
sub-processor ***APPLICATION.1 during the “platform registration” and “exam” phases, and by the data processor
COMPANY.2 during the ***APPLICATION.1 “webcam monitoring” phase, as stated in Finding Five.
EIGHTH: From the Proven Facts One through Seven, it is deduced that it has also been established that the software ***APPLICATION.1 used by the UIV, in all
the contracted modalities since its implementation to date, employs a
facial recognition system to perform continuous authentication of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 38/225
identity of the students participating in its online exams, which meets the
following characteristics:
8.1. It takes samples of the physical, physiological, or behavioral characteristics of the
students who register in the system (the selfie images provided by the
student and those captured by the implemented monitoring system), and
processes them technically to generate a biometric template or pattern (alphanumeric code) obtained from them.
8.2. Secondly, it is established that the software used by the UIV performs a
technical processing of biometric data (images of the student's face), and
generates a biometric template (facial pattern) of the students' faces, which is used
to perform student identity verifications every two seconds during the
exam. The generation and use of the biometric pattern to perform the
identity authentication process begins with the exam and is repeated every
two seconds throughout its duration, being retained only for the time
necessary to perform the one-to-one verification of the student, without being stored in the
system.
This is deduced from the following evidence provided by the UIV:
(i) First, from the continuous references to the generation of a
facial biometric pattern throughout the documentation, under the name of “facial recognition algorithm” or “alphanumeric code”
in Document 1.2, 6.1 and 6.2 on technical information for the program
***APPLICATION.1, or as a “personal mathematical model”.
(ii) Second, from the references made to the facial pattern and the
comparison of the student's initial pattern with the one generated during the exam
contained in Document 3.2, which is provided as an Example of a Master's Verification Report, and in the EIPDs provided as Document
5.
(iii) Third, from the statements made in the expert report
of July 23, 2024, issued by A.A.A. from the IT consultancy
***COMPANY.3 dated July 23, 2023, which, after carrying out the
appropriate checks and verifications, states that:
or “(…)”
(ii) The same is stated by the entity supplying the program
APPLICATION.1 and responsible for the processing ***COMPANY.2 in the report
prepared on January 30, 2025, in order to respond to the request
made during the testing phase, in whose third section reference is made
to the image capture and analysis procedure that has been
referred to in the sixth proven fact, relating to the security measures of the processing.
8.3. And finally, there is no doubt that the purpose of the system is, and always has been, the
unique identification of the student (confirming the student's unique identification) who
presents themselves and participates in the exam throughout its duration, whose actions
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 39/225
are monitored by a video surveillance system that combines facial recognition techniques, artificial intelligence, and automated decision-making mechanisms
in order to prevent fraud or plagiarism.
This is evidenced in the purposes described by the EIPD, as well as in the process itself, as detailed in Annex I of the Master's Verification Report published on the University's website and submitted as Document 3.2 to the proceedings. This document, which regulates "Identity and Plagiarism Control," establishes that during Phase 2 (called "enrollment"), it is recorded that, to verify authorship of the continuous assessment and online exam supervision process, the technology ***APPLICATION.1
"Uses an automatic facial recognition algorithm to verify the user's identity and detect inappropriate behavior throughout the entire content test (exam) process."
NINTH: As indicated in the Preliminary Actions Report and stated in Documents 3.1 to 3.11 of the letter dated November 16, 2023, the UIV provides its students with specific information regarding the processing of Biometric data collected by ***APPLICATION.1 through various documents provided to the student at different stages: pre-contractual, contractual, and post-contractual.
Or prior to the enrollment process (pre-contractual phase),
as it has been established that the UIV warns of this evaluation method in various documents that are publicly available on the university's website, as stated in the Inspection Report.
Specifically, information regarding the processing of personal biometric data is available in the links about the operation of the virtual campus and frequently asked questions, and in documents 3.1 to 3.5, and 3.11, corresponding to the Enrollment Conditions, Sample Master's Thesis, Sample Study Plan, ANECA Report, Evaluation Standards 2019 to 2022, and Sample Master's Catalog.
Among these, the Assessment Regulations, published on the website, are noteworthy.
The Assessment Regulations of February 25, 2019, and October 10, 2020,
state in Chapter IV, Article 11 et seq., that online exams will be conducted
mandatorily through “a facial recognition technology system that allows for monitoring of effective participation in the exams and tests.” The Assessment Regulations approved on May 3, 2021, and October 21, 2022,
make the same statement in Article 2. These are regulated in Chapter IV -
Online Assessment Tests. Article 11, Technical Instructions (Page 377
EXP).
Furthermore, it is noted that the Assessment Regulations of 21-10-22 include Annex I
on grounds for invalidating the online assessment test, in which the following paragraph (page 409 EXP) stands out, as it is the only one that mentions the
APPLICATION.1 environmental monitoring system with a dual-camera system
that had been contracted through the addendum of December 19, 2022
mentioned above:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 40/225
“14. In degree programs where, due to their needs, the tool
APPLICATION.1 is applied with the typology ***APPLICATION.5 (image report,
Monitor Control Report, and External Camera Report), and this is included
in their verification reports, all the previous sections will apply, and
external monitoring will be added, and compliance with the following requirements must be observed as required in sections
2 and 3 regarding the external camera.
It is also established that detailed information is provided in this regard
at the time of enrollment: General Conditions of Enrollment Document
3.1, which is available before and during the enrollment process,
acceptance of which constitutes consent to the processing.
And subsequently, after this formalization (post-contractual phase), this
information is expanded, providing, after enrollment, the Manuals,
Guides, and Training Protocols for the ***APPLICATION.1 program, which are
provided as Documents 3.6 to 3.9 of the first written response, and as
Document 3 of the document dated February 6, 2025, responding to the evidence.
TENTH: It has been established that the UIV has been collecting, between 2019 and 2022,
the explicit, informed, and unequivocal consent of the user, expressed both
through the acceptance of the General Conditions, at the time of formalizing the
enrollment (phase that the UIV calls contractual), as well as at the time
of registering in ***APPLICATION.1 by accepting the privacy and usage policy of
this software; and downloading the program (phase that the UIV calls post-contractual).
This is evidenced by the submission of the following documents in the letter dated November 16, 2023:
a) “Contractual consent: in which the student expressly consents
upon formalizing enrollment and accepting the general conditions. This is referred to as the Learning Contract.”
This is evidenced by Document 3.1, regarding Enrollment Conditions in effect between 2019 and September-October 2022, considered
as the “Learning Contract.” Article 9 of this document states that UIV uses
facial recognition techniques to monitor the actual participation of
students in the exams and tests administered by the center.
a) Post-contractual consent: which is given during the student's
registration process in the ***APPLICATION.1 program by accepting the privacy policy
and downloading the program.
This is evidenced by the Training Manuals for the program
***APPLICATION.4 and ***APPLICATION.5, provided as Documents 3.6 and 3.7,
as well as the Installation Guide for ***TOOL.1.
Both Training Manuals describe the operation of the program
***APPLICATION.1, correspond to an August 2023 version, and
fully describe the facial recognition and monitoring system,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 41/225
including the dual camera. The Training Manuals
provided to students between 2019 and 2022 are not included.
According to evidence 4 submitted in the complaint, the Manual submitted as
Document 3.7 was sent to
students along with the email dated December 19, 2022, urging them to
download the program ***APPLICATION.5. This Manual states that it is necessary to accept this privacy policy
in order to download the programs and register their biometric data
during the enrollment phase.
The UIV Privacy Policy, submitted as Document 3.10, warned
of the biometric processing carried out in the evaluations.
However, it is established that the consent given by the student in each
of these phases is not freely given, as can be deduced from the following evidence:
(i) First, the University itself acknowledges in its Data Protection Impact Assessment (DPIA) that “the regulations
relating to university education appear to create a clear imbalance between
the position of the university and that of the student, so it could be
considered that the consent given by the student would not be freely given,” after
analyzing Recitals 92 and 93 (when there is no
true freedom of choice, and when there is a clear imbalance between
the data subject and the data controller), and although it subsequently reaches the
erroneous conclusion that there is no imbalance between the University and
the student because the latter has the option of choosing this method or not
enrolling, or waiving the right to be assessed at four different times.
(i) The documentation proving both consents (contractual and pre-contractual) indicates that the student has no freedom of choice:
since consenting to biometric processing through facial recognition is a mandatory condition for enrollment, taking the exam, and being evaluated, as well as for passing it, as acknowledged by VIU in its letter of November 16, 2023.
Specifically, regarding contractual consent, it is demonstrated
by Document 3.1 on the general enrollment conditions
in effect between 2019 and September-October 2022, that students had to consent to the following clause as a requirement for enrollment:
“The student is informed and consents to the use by VIU of a facial recognition technology system that will allow monitoring of their
effective participation in the exams and tests conducted by this university. This system will be used solely and exclusively for this monitoring function and never for any other purpose.
The student acknowledges that The possibility of taking a fully online course, without travel or in-person exams, is an essential element for choosing VIU, since the benefits offered by this exam and test format outweigh the enhanced preventive controls required for online assessments and the processing of data related to facial patterns and peripheral elements.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 42/225
The student confirms that they have chosen this university because these control systems offer sufficient guarantees that all students will have equal opportunities to pass and that there will be no control gaps that allow other students to pass subjects with less effort.
The same applies to post-contractual consent, in which it is mandatory to accept the privacy policy provided as Document 3.10 to register for the ***APPLICATION.1 program and download the applications. and
the necessary tools for performing facial recognition, as stated in
the Training Manuals provided as Documents 3.6 and 3.7, which
contain the operating information for the program provided to the
students.
(ii) It is also established that the UIV—despite being aware of the criteria
expressed by this Agency in Report No. 0036/2020—did not offer any
comparable alternative (either in-person or online) to students who did not
wish to consent to the use of this facial recognition software, since
it had not provided any alternative.
(iii) Because it is also established that the failure to provide consent or
subsequent refusal to use the evaluation method with the software
APPLICATION.1 had negative consequences for the individuals concerned, which are
openly acknowledged by the UIV. In the University's words, in its
sixth allegation, point 4:
“If the student withdraws consent regarding the application
***APPLICATION.1, it will not be possible to verify if they are the person who signed the
tuition contract, and they will not be able to take the exam. Similarly,
if a student withdraws consent for the processing of
data related to their exam, their exam cannot be graded or
evaluated. And, likewise, if a student withdraws consent for the
processing of data related to the language test and the other
tests in the admissions process, they will not be able to enroll. Consequently,
the student's consent is always essential in all
aspects of enrollment, the registration process, and obtaining the degree
(...)”
ELEVENTH: In addition to what has been stated regarding the exception of consent,
the UIV has not demonstrated that any of the exceptions provided for in
Article 9.2 of the GDPR apply, which would allow lifting the general prohibition on the processing of
biometric data for the Purpose of the processing.
TWELFTH: It is established that there are other alternative, non-biometric means
of verifying the identity of students suitable for fulfilling the purpose of the
processing described by the UIV, effectively and securely protecting the rights and freedoms
of the students, and that the UIV was aware of their existence but ruled out their application.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 43/225
First, it is noted that, in accordance with both DPIAs, other possible alternative means proposed by this Agency, which could be used to conduct 100% online assessments, individually or in combination, were analyzed and discarded (Page 767 of the file):
(...)
Next, the DPIA analyzes and discards other alternative means proposed by the Dutch supervisory authority, which adds further possibilities that could be used—individually or in combination—to conduct fully online exams, as the UIV intends.
(…)
Furthermore, as mentioned in the Third Proven Fact, it is established
that the UIV had a real opportunity to contract a version of the
program ***APPLICATION.3, which involved “human review without biometrics,”
through which it was also possible to conduct an online evaluation of its
students, and it rejected it.
Finally, the technical report submitted as an expert opinion by the UIV,
prepared on July 23, 2024, by an expert from the IT consulting firm
***EMPRESA.3, performs an “Analysis of Less Intrusive Alternatives”
in Section 1.9 of the “security expert report” document, stating the following:
“The use of real-time biometric verification techniques, combined with
human supervision at the end of the exam, is the best available alternative
to guarantee the authenticity of students in the online exams of the
VIU (International University of Valencia - ***EMPRESA.3) and complies with
the security and privacy requirements established by the Spanish Data Protection Agency (AEPD) and VIU.”
Potential less intrusive alternatives for the student identity verification process during exams were evaluated.
Manual verification of student identity: Less efficient and impractical for a large number of students in an online exam format.
Use of access codes: Less secure and less efficient.
Verification of identity using identity documents: Less efficient and more intrusive (requires linking to personal data).
Verification using security questions: Less secure and less efficient.
Alternatives such as manual verification of student identity, the use of access codes, or verification using security questions do not offer the same level of security and authenticity in student identity verification and may be more intrusive and/or less efficient in an online exam environment with a large number of students. Therefore, it is concluded that the tool ***APPLICATION.1 is the best
available alternative to guarantee the authenticity of students in the
online exams of VIU (International University of Valencia -
***COMPANY.3) and complies with the security and privacy requirements
established by the Spanish Data Protection Agency (AEPD) and VIU.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 44/225
THIRTEENTH: Regarding the proportionality requirement for processing, it is noted that
the UIV has carried out different balancing tests of “legitimate interest” where it lists
benefits and drawbacks arising from the use of biometric systems for
facial recognition.
o First, it is established that the 2020 DPIA and its 2023 update included the following “legitimate interest balancing table” (Page 593 of the file).
(…)
o Subsequently, the DPIA was updated in January 2024 to include a “Legitimate Interest Balancing Report” submitted as Document 1 of the 18-page statement of objections to the initiation agreement, indicating that the following phases of the “balancing procedure” exist:
First phase. - Identification of legitimate interest and assessment of compliance with the requirements established in the GDPR and local regulations.
Second phase: Assessment of the suitability of the processing.
Third phase: Assessment of the necessity of the processing.
Fourth phase: Assessment of the balance between the legitimate interest of the data controller and the fundamental rights and freedoms of the data subjects. Once this assessment has been carried out, the balancing will be performed and the final decision will be made, concluding whether or not the processing can be carried out based on the legitimate interest of the company.
The following table is included on page 15 of said document: “Legitimate Interest Balancing Table”.
(…)
FOURTEENTH: In the privacy policy provided as Document 3.10 of the letter dated November 16, 2023, and Annex I of the contractual addendum provided as Document 1 of the letter dated December 20, 2023, the UIV is listed as the data controller. and as the data controller, the entity
***COMPANY.2.
FIFTEENTH: In accordance with the official report issued on December 16, 2024,
it is established that the (UIV) is a large company incorporated in 2013, with a turnover of €2 for the 2022 fiscal year.
SIXTEENTH: In accordance with the official report issued on December 16, 2024, the following data is established for students who, according to the Valencian Institute of Statistics of the Generalitat (hereinafter, IVE), are registered as enrolled in undergraduate, master's, and doctoral programs at the UIV between the academic years 2019-2020 and 2023-2024. This data is taken into consideration to determine the scope of the infringement and the corresponding penalty. impose.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 45/225
A. Master's students at the UIV: a total of 65,163 students.
B. Bachelor's students at the UIV: a total of 23,221 students.
C. Students enrolled in doctoral programs: only 5 students.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 46/225
LEGAL BASIS
I. Jurisdiction and Procedure.
In accordance with the powers conferred by Article 58.2 of the GDPR and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data The Office of the President of the Spanish Data Protection Agency (AEPD) is competent to resolve this procedure under the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, "LOPDGDD").
Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, on a subsidiary basis, by the general rules on administrative procedures."
II. Preliminary Issues Regarding the Processing Carried Out by the UIV.
2.1. Personal Data Subject to Processing.
Definition of Personal Biometric Data.
Biometric data processing systems are automated methods that are based on collecting and processing personal data relating to the physical, physiological, or behavioral characteristics of natural persons, among which which includes the
neural characteristics of these individuals, using devices or sensors, creating
biometric templates (also called signatures or patterns) that enable the
identification, tracking, or profiling of these individuals.
As already noted in Opinion 4/2007 of the Article 29 Working Party (Article 29 of
Directive 95/46/EC, as an independent, advisory body of the EU), on the concept of personal data (WP136), dated 20/06/2007,
biometric data can be defined as:
“…biological properties, physiological characteristics, personality traits, or tics, which are both attributable to a single person and
measurable, even if the models used in practice to measure them technically involve a certain degree of probability. Typical examples of biometric data include fingerprints, retinal patterns, facial structure, voices, hand geometry, vein patterns, and even deeply ingrained skills or other behavioral characteristics (such as handwriting, heart rate, a particular way of walking or speaking, etc.). A particular feature of biometric data is that it can be considered both as information about a specific person (John Doe has these fingerprints) and as a means of linking information to a specific person (this object has been touched by someone who has these fingerprints, and these fingerprints belong to John Doe; therefore, John Doe touched this object). As such, they can serve as "identifiers." Indeed, since they correspond to a single person, biometric data can be used to identify that person.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 47/225
This dual nature also applies to DNA data, which provides information about the human body and allows for the unequivocal identification of one, and only one, person.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 47/225 Article 4.14 of the GDPR defines biometric data as a category of personal data,
stating that it is: “personal data obtained from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or fingerprint data.” (emphasis added).
For its part, Article 4.1 of the GDPR, in defining personal data, emphasizes this same purpose of uniquely identifying the individual, stating that “1. Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, or cultural identity of the data subject.” or social of that person.”
Therefore, in accordance with the GDPR, to determine whether we are dealing with personal biometric data, the following requirements must be met, derived from the joint interpretation of Article 4.14 (definition of biometric data) and Article 4.1 of the GDPR (definition of personal data):
(i) The nature of the data: it must relate to the physical, physiological, or behavioral characteristics of a natural person.
If the processing requires the prior recording of an image, fingerprint, voice, iris, etc.; takes into account behaviors; or differentiates characteristics such as race, sex, etc., it meets this initial requirement, even if it does not store them and only uses them to generate the biometric pattern.
(ii) The purpose of the processing: the biometric data must allow or confirm the unique identification of that person.
In this sense, biometric data, when it allows for the identification of a person, as is the case analyzed here, constitutes personal data according to the definition in Article 4.14 of the GDPR and, therefore, its processing is subject to the guarantees and safeguards established therein.
In short, biometric systems designed to enable or confirm the unique identification of a person do process biometric data of a personal nature.
Biometric technologies allow the use of two main types of systems
biometric systems that aim to uniquely identify individuals, as
stated in Opinion 3/2012 on the evolution of biometric technologies of
27/04/2012 by the Article 29 Working Party, -the independent European advisory body
on data protection, the predecessor of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 48/225
current European Data Protection Board- (hereinafter, Opinion
3/2012):
“-Biometric identification: the identification of an individual by a biometric system is normally the process of comparing their biometric data
(acquired at the time of identification) with a series of biometric templates
stored in a database (i.e., a one-to-many matching process). (Hereinafter, 1:N)
-Biometric verification/authentication: The verification of an individual by a biometric system is normally the process of comparing their biometric data (acquired at the time of verification) with a single biometric template stored on a device (i.e., a one-to-one match process). (Hereinafter, 1:1).
While this issue has been the subject of various guidelines and opinions,
since the adoption of the GDPR, it is understood that references to "enable" can be understood as referring to identification, and "confirm" as referring to authentication. In both cases, whether verification-authentication or identification, the techniques used are based on an estimated match between templates: the one being compared and the reference template(s). From this point of view, they are probabilistic techniques: the comparison deduces a higher or lower probability that the person is indeed the one to be authenticated or identified. And if this probability exceeds a certain threshold
in the system, defined by its user or developer, the system
will understand that a match exists.
But, regardless of the differences between the two biometric systems
regarding the probability of errors, or from the point of view
of security measures, the fact is that the purpose of both techniques
is the same, since both aim to uniquely identify
a person, and both are considered to process biometric data of a
personal nature. This issue will be discussed further below.
(iii) The means and forms of processing: data “obtained from a
specific technical processing”; that “allow or confirm the unique identification
of said person”.
The Article 29 Working Party Opinion WP80 already
indicated that biometric systems are: “applications of biometric technologies
that allow the automatic identification, and/or the
authentication/verification of a person.” Authentication/verification applications are commonly used for various tasks in very different fields and under the responsibility of a wide range of different entities.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 49/225
And any biometric system designed to enable or confirm the unique identification of individuals must, in order to be used, first register the user's identity in the system by capturing a series of raw biometric parameters.
It is important to clarify that biometric information about individuals (regarding physical, physiological, or behavioral characteristics) can be processed and stored in different ways:
a) Sometimes, the biometric information captured from a person is stored and processed in raw form, allowing the source to be recognized without specialized knowledge; for example, a photograph of a face, a photograph of a fingerprint (sample), or a voice recording. These will be considered personal data, but according to Article 4.14 of the GDPR, they will not be considered biometric personal data because the requirement that the raw biometric data has been processed by a technical method that allows its identification by a machine through automated processing is not met.
For this reason, images of a person appearing in a video surveillance system are personal data according to Article 4.1 of the GDPR, but they cannot be considered biometric personal data (and special category data according to our GDPR) if they have not been specifically processed technically to contribute to the unique identification of that person through a system. As stipulated in Recital 51 of the GDPR,
it also expressly refers to this, stating that:
“The processing of photographs should not be considered
as systematically processing of special categories of
personal data, since they are only
included in the definition of biometric data when the
fact of being processed by specific technical means allows
the unique identification or authentication of a natural person.”
Similarly, digital images or samples taken of a
fingerprint (whether in its entirety or in part)
will also not be considered biometric personal data unless
they are processed to allow the identification of the person through
automated processing.
b) Another option—the one used by biometric systems such as the
present one—is that this biometric information is expressed in the form of a
biometric template or biometric pattern (alphanumeric code).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 50/225
In these cases, the raw biometric information captured is processed
technically by software so that only certain characteristics or features (such as fragments of the
fingerprint sample or points in the facial image, etc.) are extracted
and saved
as a biometric template, called a “vector” or “biometric pattern,”
which allows for the automated identification of its owner.
The Guidelines on the use of facial recognition technologies
issued by the Council of Europe on 28/04/2021 (Guidelines on Facial Recognition, Council of Europe) define the biometric template
as “a digital representation of the unique characteristics that have been
extracted from a biometric sample and stored in a biometric database.”
A biometric template or biometric pattern is a form of writing
of a human biometric characteristic, such as a face or fingerprint,
represented as an alphanumeric code,
in a way that can be efficiently and effectively interpreted by a machine for a specific purpose or purposes. The biometric template
is not intended to be interpreted by a person, like
a photograph, but rather to be processed in an automated process,
that is, to be efficiently and effectively interpreted by
a machine. This form of storage would allow for the identification of
an individual and the automatic execution of actions, profiling, or inference of
information about a subject, such as attitudes or behavioral patterns, etc.
In other words, the biometric template or pattern is the method of
measuring the “physical, physiological, or behavioral characteristics of
a natural person” that are processed to assign a unique
identifier code to each individual, so that it can be
automatically interpreted upon each reading by the software and
hardware devices associated with a biometric identity verification/identification system, allowing for the
comparison of data and automated identity verification.
Ultimately, according to Article 4.14 of the GDPR, for the processing of personal biometric data to exist, it is precisely required that
a technical processing (software or
a program like the one used in this case) be applied to the raw biometric information (digital image of the
fingerprint, face, voice recording, etc.) to obtain a
“biometric pattern” from the collected samples. Therefore, the biometric pattern or
biometric template is truly the biometric personal data
referred to in Article 4.14 of the GDPR, since the raw sample of
a person's fingerprint, face, iris, voice, etc., would be personal data
based on biometric features but not biometric personal data because it does not
allow for automated identification.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 51/225
Consequently, whenever an identity verification system is used (whether through 1:1 or 1:N comparison) that generates a biometric template based on raw personal data obtained from an individual, derived from their physical, physiological, or behavioral characteristics (such as fingerprints, facial photographs, voice recordings, etc.), in order to uniquely identify an individual, this constitutes the processing of personal biometric data as defined in Article 4.14 of the GDPR, and will be considered a special category of data as defined in Article 9.1 of the GDPR.
The following issues raised by the UIV in its
various submissions regarding biometric templates should be clarified:
(i) That whenever the technical system used by a data controller
generates a biometric template, it is because it is processing biometric data.
Regardless of whether or not it stores the template, and for how long, if the facial recognition program generates a template or facial pattern for the purpose of verifying a person's identity, it is processing personal biometric data.
(ii) That the biometric template is stored as an alphanumeric code.
Therefore, if the system chosen by the data controller generates a "mathematical model" or an "alphanumeric code" from a sample of a person's raw biometric data, it is generating a biometric template.
This is also the case, as has been demonstrated, in the present
case.
(iii) The biometric template or pattern acts as a unique identifier
of the person and is considered to be the biometric personal data referred to in Article 4.14 of the GDPR (and
not the raw biometric data from which it is obtained, such as the
facial image, fingerprint sample, etc.), because it implies
that this raw personal data has been technically processed, assigning a unique identifier code to each
person to allow for their unambiguous identification by an
automated system. For this reason, the fact that, from
a biometric template, for example, a fingerprint or
facial pattern, the original cannot be reconstructed is irrelevant, since it is the biometric pattern that acts as a unique identifier that unambiguously distinguishes the individual, at least
within the framework of automated processing. That is, this
mathematical model or facial pattern that is the biometric template
allows the person to be identified by a machine in an automated
manner.
Analysis of the present case: processing of personal biometric data by the UIV
In light of the documentation provided, there is no doubt that the requirements of Article 4.14 of the GDPR are met, and that the software tool called
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 52/225
***APPLICATION.1 contracted by the University as a biometric system designed to verify the identity of enrolled students participating in its online exams and prevent fraud/plagiarism by monitoring them (which it refers to as the
“Identity and Plagiarism Control System”) processes personal biometric data.
In its submissions to the Initial Agreement and the Proposed Resolution, the University denies processing special category biometric data, but does not deny processing biometric data or that the program generates a facial pattern (biometric template).
Evidence in its documentation refers to this, as referenced in the Seventh Proven Fact of this Resolution:
The clearest evidence is in the RAT (Reported Activity Report) submitted to the proceedings as Document 2, which leaves no doubt about the processing of biometric data of a personal nature, indicating that the following categories of data are processed: “identification data, student image, biometric data – facial pattern, behavior during the exam, and content of the evaluation.”
This is confirmed by the Data Protection Impact Assessment (DPIA) prepared in September 2020 and its 2023 update, the latter adding that “The conclusion of the analysis was
that VIU must carry out an impact assessment regarding the analyzed processing,
for the following reasons:
1. New technological solutions are used.
2. Biometric data will be used.
3. Technologies are used that may be perceived as particularly
intrusive to privacy, such as the combination of biometric data and
artificial intelligence.
4. The processing may cause the student to fail the exam or receive
a negative mark on their academic record.”
In addition to these explicit mentions, the analysis of the processing described in the
documents provided, as stated in the eighth finding of fact,
leads to the existence of the three circumstances/characteristics/requirements that determine
that the University has been processing personal biometric data in the sense
provided for in Article 4.14 of the GDPR:
1. First, the data that the program uses to perform the
identity checks are based on physical, physiological, or
behavioral characteristics of a natural person.
Since it starts with raw images provided by the student
selfie) during the registration phase (onboarding and enrollment processes) that are
used to generate the biometric template; and the biometric matching or
identity verification during the exam is carried out through images or
screenshots captured by the cameras monitoring the exam. And
in addition to capturing physiological characteristics (facial image), they even capture
behavioral characteristics, since the EIPDs prepared by the University
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 53/225
indicate that the program analyzes certain behaviors it identifies as anomalous,
such as potential fraud, through artificial intelligence techniques and includes
automated decision-making mechanisms that are supervised by a teacher.
2. Secondly, it is established that the program performs a technical
processing of this data and generates a biometric template or facial pattern of the
students, which is used throughout the exam to verify
the student's identity.
The University states in its written objections to the Commencement Agreement (second objection) that “the application ***APPLICATION.1 does not create a biometric pattern at the
time of student registration,” and that “it does not store the student's biometric pattern,” but rather that it “is created and destroyed at the time of the exam verification.”
In light of the information provided in the RAT and the EIPDs submitted to the
proceedings, it is observed that the UIV is operating under a conceptual error in
distinguishing between the processing of “biometric data” and “facial patterns,” since
the images stored during the registration phase in ***APPLICATION.1
and those generated during the exam are not biometric data, but rather personal
data based on biometric features. The only personal biometric
data are the facial patterns generated during the exam, and these are
used to perform the comparisons carried out during identity
authentication.
Furthermore, the allegations against the initial agreement were based on the erroneous premise
that since biometric data (facial patterns) is not stored,
personal biometric data is not being processed, which is not true, as has already
explained in the Proposed Resolution. Regardless of whether the
university has implemented a security measure by design and by default
that prevents biometric data from being stored, the fact remains
that it has contracted facial recognition software that generates a facial pattern
of the student extracted from the images stored and captured during
the exam, and uses it to verify the student's identity throughout the
exam every two seconds. This has been confirmed by the reports prepared
by the IT consultancy ***COMPANY.3 and the supplier that developed the
program ***COMPANY.2, all as stated in the eighth finding of fact.
In its response to the Proposed Resolution, the UIV makes no reference to
the lack of storage of biometric templates, nor does it address
the arguments presented on this matter, based on the
indisputable fact that its program processes biometric data since it generates
and uses facial patterns of its students, and acknowledging that the requirements of Article 4.14 of the GDPR are met in
this case, although it continues to dispute
whether the personal biometric data processed can be classified as
a special category.
3. Thirdly, it is acknowledged in the documentation that the purpose of the
processing is “to confirm the unique identification of students” (or, in other words,
in the words of Article 9 of the GDPR, the unambiguous identification of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 54/225
students) to verify that the registered individuals take the exam
and that they are present throughout the entire exam process.
The University maintains in its arguments against the Proposal, as has been
stated, that its program does not process special category biometric data since
it is based on identity authentication processes, performing
1:1 comparisons between the images provided by the student and those captured
by the cameras used by the system, and the biometric template generated
by the system.
According to the established facts of this
procedure, and despite the University's insistence that the processing is
high-risk and includes special category biometric data, the fact is
that the documentation in the proceedings indicates otherwise. Furthermore, in
its submissions to the initiation agreement, no new documents were provided
to substantiate this disputed issue regarding the legal nature of the
processing carried out, as only Document 1
(Weighing of Interests and Benefits Report) was included, which has nothing to do with this
issue but rather with the proportionality requirement for processing under Article
5.1.c) of the GDPR. Nor do the documents submitted in the objections to the
proposed resolution prove that the software used does not process special category
biometric data, for the reasons that will be indicated in
the response to these objections in Legal Basis V.
The analyzed documentation shows that the University is processing
biometric data and that this data is intended to uniquely identify the
students participating in its online exams in order to control
fraud and guarantee academic quality. As described in
the program's operation in documents 3.2 (Master's Report) and 5 (2020 Data Protection Impact Assessment
and 2023 and 2024 updates), there is no doubt that the
biometric data processed by the program ***APPLICATION.1 (in all versions
contracted by the University) uses a continuous student authentication system whose purpose is the unique identification of the student, in order to
verify that the enrolled student is the one present and taking the
exam.
Therefore, there is evidence that the purpose of facial recognition is the
unique identification of the student, which is carried out in several phases: (...).
Thus, it is clear that the purpose is to identify that the student
taking the exam is the one enrolled and registered on the virtual campus, and that this student is present throughout the entire exam process. This is true regardless of whether the biometric matching process
is performed through 1:1 or 1:N comparisons.
In conclusion, as stated in Findings Seven and Eight of this Resolution, it has been established that the company has been processing the personal data of students who participated in its online exams through the facial recognition and exam monitoring program.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 55/225
***APPLICATION.1, which requires the processing of personal biometric data in accordance with the provisions of Articles 4.14 and 4.1 of the GDPR.
2.2. Characteristics and risks of processing personal biometric data.
Systems that process personal biometric data employ a technology that can be truly intrusive and requires a calm ethical and legal debate,
since it can have very adverse effects on fundamental values and human integrity. Consider just a few of the special characteristics of biometric systems in general and think about the significant impact they produce when this data is compromised—generating additional risks to the rights and freedoms of the data subjects—compared to when other types of personal data are processed:
- Biometric systems are closely linked to a person, since they can use a specific, unique property of an individual for identification. Each individual has unique fingerprints that show specific characteristics that can be measured to determine if a fingerprint matches a registered sample. Therefore, they are unique, permanent, and the person cannot be freed from them; they can never be changed, not even with age. Thus, the damage caused in the event of a compromise—loss or intrusion into the system—is irreparable. Unlike a password, in case of loss, the data of our fingerprint or face cannot be changed.
- Furthermore, because biometric data is unique to a person and
permanent, the user can use the same data across different systems.
- While traditional authentication methods such as
passwords require a 100% character-for-character match
to allow the user to access, for example, an account or application (deterministic methods),
biometric methods are called “probabilistic” because
they are based on the probability that the user attempting to access a
specific device or application is the same person as the registered
user. We can measure the performance of a biometric system based on
three main characteristics. These are: false rejection rate (FRR), false acceptance rate (FAR), and equal error rate (ERR).
The false rejection rate represents the probability of detection errors by
a biometric system, meaning it cannot recognize a user
whose biometric characteristics are already in the database. In case of rejection, the person must verify their identity again. From a security perspective, this rate does not necessarily mean a negative outcome. Each biometric method, whether facial recognition, fingerprint scanning, palm print scanning, iris scanning, etc., has different values for different rates based on which a system rejects or accepts input.
... As the report from the National Cryptographic Center (CCN) of December 2024 points out, a new type of biometric system exists, which uses what are known as
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 56/225
Renewable Biometric References (RBRs), which do not all possess the following characteristics, created by the standard ***CERTIFICATION.2, which, according to the CCN:
“Standardizes additional security protections for biometric references
creating what are called “Renewable Biometric References (RBRs)” or “RBR biometric reference templates,” which have the following characteristics:
• Multiplicity. An almost infinite number of different “RBR” templates can be obtained for each person's face.
• Irreversibility. It is impossible to obtain a person's biometric traits from an RBR template.
Non-interoperability. A specific RBR template is created for each use case, starting from the same traits but using different sorting factors.
• Revocability. In case of a system compromise, RBR templates can be revoked and replaced with others.
• Non-permanence. The specific numerical expression of a template
“RBRs” can be modified through system changes.
However, it should be clarified that the use of these new RBR templates implies the adoption of a security measure whose use is recommended, but in no case does it
justify on its own the necessity and proportionality of processing, nor does it eliminate
all the risks that the use of these biometric techniques generates for the
rights and freedoms of the data subjects whose biometric data is processed by them. And its use cannot be invoked in this case, since it is not stated in the
technical documentation provided that the software used by the UIV—whose
contract predated the ***CERTIFICATION.2 that created them—used this
type of RBR template, as will be pointed out later.
It should also be noted that among the methods that use biometric data, those
based on facial recognition (implemented in the present case) can be
even more intrusive than fingerprint detection. exponentially increasing the risks to the fundamental rights and freedoms of data subjects, given the uses of facial recognition, especially when combined with artificial intelligence as an automated system for recognizing human features.
This was already highlighted in Guidelines 05/2022 of the European Data Protection Board (hereinafter, EDPB) on the use of facial recognition technology (FRT) within the scope of law. The EDPB, an independent advisory body and the highest authority on the matter, states the following (emphasis added):
“Much of the increased interest in FRT is based on its efficiency and scalability. With this comes the inherent disadvantage of the technology and its application, even on a large scale. While thousands of personal datasets can be analyzed at the touch of a button, even the slight effects of algorithmic discrimination or misidentification can create a large number of people whose behavior is severely affected.” and in their daily lives. The large scale of the
processing of personal data, and in particular biometric data, is
possibly another key element of the FRT, since the processing of personal data
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 57/225
constitutes an interference with the fundamental right to the protection of personal data
in accordance with Article 8 of the Charter of Fundamental Rights of the European Union (hereinafter, "the Charter").
The application of the FRT of the LEA will have, and to some extent already does,
significant implications for individuals and groups of individuals, including
minorities. These implications will also have considerable effects on the way
we live together and on our social, political, and democratic stability,
valuing the great importance of pluralism and political opposition. The right to the
protection of personal data is often key as a prerequisite for
guaranteeing other fundamental rights. The application of the FRT is
considerably prone to interfere with fundamental rights beyond
the right to the protection of personal data.”
In this context, the EDPB considers it important to remember that facial recognition technology (FRT), whether for
authentication or identification purposes, does not provide a definitive result, but rather
relies on the probability that two faces, or images of faces, correspond to the
same person. This result is further degraded when the quality of the
biometric sample input to facial recognition is low. Blurry
input images, low camera resolution, movement, and poor
light can all contribute to low quality. Other aspects with a significant
impact on the results are prevalence and spoofing, for example,
when criminals attempt to avoid passing through cameras or deceive the FRT.
Numerous studies have also highlighted that such
statistical results of algorithmic processing can also be subject to bias,
particularly as a result of the quality of the source data, as well as the
training databases or other factors, such as the choice of deployment location. Furthermore, it is worth highlighting the impact of facial recognition technology on other fundamental rights, such as respect for private and family life, freedom of expression and information, freedom of assembly and association, etc. (…)
(…) Often, facial recognition technology uses components of artificial intelligence (AI) or machine learning (ML). While this allows for large-scale data processing, it also introduces the risk of discrimination and false results (…).
Finally, it should be noted that Opinion 11/2024 of 23 May 2024 of the EDPB on the use of facial recognition to streamline passenger flow at the airport reiterates and confirms the need to consider the high level of risk involved in this type of biometric processing and emphasizes the need to assess its risks and impact, and in particular, to determine whether there are less intrusive alternative means to achieve the objective in question (verifying the identity of students taking the exam in this case), with references such as the Next:
“As a preliminary observation, the Committee recalls that the use of biometric data, and in particular facial recognition technology,
entails greater risks to the rights and freedoms of data subjects. This refers to the processing of biometric data that is afforded special protection under Article 9 of the GDPR. Before using such technologies, even if they are considered particularly effective, controllers must assess the impact on the fundamental rights and freedoms of data subjects and consider whether less intrusive means can achieve the legitimate purpose of the processing.”
2.3. Biometric data as special category and high-risk personal data.
As noted, in accordance with Article 4.14 of the GDPR (in conjunction with Article 4.1 of the GDPR), biometric personal data includes all data that: (i) relate to the physical, physiological, or behavioral characteristics of a natural person; (ii) their purpose is to enable or confirm the unique identification of a natural person (including 1.1 authentication systems and 1:N identification); (iii)
and are subject to specific technical processing aimed at enabling or confirming the unique identity of individuals (resulting in the generation, storage, use, and destruction of biometric templates obtained from samples of the raw data captured).
Following the adoption of the current GDPR, whenever personal biometric data is processed, as defined in Article 4.14 of the GDPR, this data will be (i) considered special category personal data under Article 9 of the GDPR, and (ii) its processing will be considered “high risk” under Article 35 of the GDPR.
It is important to bear in mind that technological development in this area is progressing rapidly. The growth has been enormous and unstoppable, especially in recent years, as biometric technology can be combined with artificial intelligence techniques, as demonstrated by the program ***APPLICATION.1. The regulations prior to the current GDPR dated back to 1995, when biometric technologies were not yet applied in the field of personal identification. Therefore, the previous “Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data” made no reference to the concept of biometric data. It only contained a definition of what was considered personal data in Article 2 of the Directive. And since biometric data did not exist at that time, it was not included among the special categories of personal data whose processing was prohibited—with exceptions—by the previous Article 8.
In this regard, it is important to note Note that the approval of the GDPR has brought about a paradigm shift in personal data protection, aiming to further guarantee citizens control over their personal data by establishing high protection standards adapted to the digital environment in which we live.
Whenever personal data of any kind is processed, the data controller must comply with the principles and obligations set forth in data protection regulations applicable to all types of personal data.
However, when the personal data to be processed is biometric and its purpose is the
unique identification of individuals, it must also be considered that—unlike
what occurred under the regime prior to the GDPR—since the entry into force of the
GDPR on May 25, 2018, according to its Article 99, biometric personal data that fall within the definition of Article 4.14 of the GDPR are considered
as special category personal data as provided for in Article 9 of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 59/225
GDPR, the processing of which is generally prohibited, unless one of the
exceptions provided for in Article 9.2 of the GDPR applies. This does not exempt anyone from the fact that
there must always be a legal basis as provided for in Article 6 of the GDPR,
among many other requirements and principles that must be met by anyone who decides to opt
for this type of processing.
According to Article 9.1 of the GDPR, the processing of biometric data is prohibited when it consists of: “biometric data intended to uniquely identify a natural person.”
Regarding the concept of special category personal biometric data, two definitional issues raised by the University in its submissions to the initiation agreement and the proposed resolution should be clarified:
1. Regarding the inclusion of authentication and identification systems in the definition.
The new Recital 51 of the GDPR clarifies that both identification (1:N) and authentication (1.1) procedures are included within this concept, stating that: “(…) they are only
covered by the definition of biometric data when the fact
of being processed by specific technical means allows for the unique identification or
authentication of a natural person. Such personal data should not be
processed unless their processing is permitted in specific situations
provided for in this Regulation.”
The respondent argues—as the main reason upon which most of the allegations against the initial agreement and the proposed resolution are based—that its facial recognition program does not process special category biometric data, and insists on applying the criterion contained in Opinion 3/2012 of the Article 29 Working Party, which was issued under the previous Directive 95/46/EC, and which, in examining the previous Directive, reached the following conclusion:
“(…) Taking into account the aforementioned distinction, it can be interpreted that, in accordance with Article 4 of the GDPR, the concept of biometric data would include both identification and verification/authentication. However, and in general, biometric data will only be considered a special category of data in cases where it is subject to technical processing aimed at biometric identification (one-to-many) and not in the case of biometric verification/authentication.” (one-to-one)
It should be clarified that this consideration was made within the framework of the previous regulations
in which Article 2 of the Directive did not define the concept of biometric data,
but only that of personal data, and Article 8 of the Directive did not
include biometric data as special category data. However,
the situation is now very different, as the GDPR does define the biometric data that is considered personal data, and includes it as a special category
in Article 9 of the GDPR, and furthermore, has clarified in its Recital
51 that both authentication and identification are special category personal biometric data.
It should be clarified that this consideration was made within the framework of the previous regulations
in which Article 2 of the Directive did not define the concept of biometric data
in which Article 8 of the Directive did not
include biometric data.
... C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 60/225
Therefore, the criterion contained in Opinion 3/2012 cannot be considered
equivalent to the regulatory situation existing since the entry into force of the
current GDPR (May 25, 2018). From that date, the respondent should have been
aware that the processing of biometric data it had been carrying out
previously with its facial recognition program had become
considered a special category of personal data processing, and
high-risk, for the purpose of implementing the relevant actions
necessary to adapt to the new requirements of the GDPR. The
Guidelines of the new highest advisory body on data protection
(EDPB) (Guidelines 3/2019 and 5/2022, which will be referred to
later) merely confirmed that the regulation had included
both biometric processing systems. But it should not be forgotten that the obligations established by the GDPR regarding special category biometric data were applicable to both authentication 1.1 and identification 1.N processes from the day after the regulation came into force.
A separate issue is whether the University can be considered negligent for failing to correctly interpret these provisions, given that it believes its 1:1 identity verification process does not process special category personal biometric data. This issue will be addressed in Legal Grounds III and IV, when responding to the University's arguments.
2. On the alleged difference between the concepts of personal biometric data and special category data.
The University's arguments on this matter will be addressed later.
However, it should be noted in this section that, contrary to what
the UIV indicates, the GDPR does not distinguish between personal biometric data and special category personal biometric data. Since
the adoption of the GDPR, all personal biometric data
that falls under the definition in Article 4.14 of the GDPR will be considered
as special category personal data under Article 9 of the GDPR.
This is because the concept of biometric data considered to be
a special category in Article 9 of the GDPR coincides with the definition of personal
biometric data in Article 4.14 of the GDPR, given that both refer
to “biometric data,” and both definitions refer to the same purpose of
processing.
... This interpretation is confirmed by EDPB Guidelines 05/2022, which
state the following: “(…) While both functions—authentication and
identification—are distinct, both relate to the processing of
biometric data concerning an identified or identifiable natural person and, therefore,
constitute the processing of personal data and, more specifically,
the processing of special categories of personal data.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 61/225
In other words, there may be biometric data that is not personal data
because it does not meet the requirements of Article 4.14 of the GDPR, but
whenever we are dealing with personal biometric data, we will be
dealing with special categories of personal data under our current GDPR. Since,
unlike the previous regulations, the concepts of
biometric personal data and special category biometric data are
equivalent in the new GDPR.
Therefore, if it is proven, as in this case, that the University processes
biometric personal data intended to uniquely identify a
individual, this will imply that it also processes special category personal data.
Having clarified both issues, it is necessary to emphasize that classifying
biometric data as special category data necessarily implies
the exercise of special caution by the data controller when determining whether it is possible
to carry out data processing of this nature. Among other things, and in addition to
the existence of an exception that allows for circumventing the prohibition in Article 9.1 of the GDPR,
the existence of a legal basis under Article 6 of the GDPR, and compliance with the
principles of the GDPR, the entity intending to implement biometric data systems (in this case, UIV) should have previously analyzed the concurrence of the
mandatory criteria of necessity, suitability, and proportionality of the processing.
That is, anyone intending to establish personal data processing of this
nature must, first and foremost, ensure that it passes what has been
referred to in case law as the “triple proportionality test,”
considering in particular whether the processing of biometric data is suitable,
proportional, and above all, necessary. If other non-biometric systems exist
that can effectively and securely achieve the same goal of identifying and verifying the identity of individuals,
it will not be necessary to initiate biometric processing,
and therefore, implementing such a system will be considered contrary to the GDPR. This assessment must
be the starting point of your analysis, since only if these methods
pass the aforementioned three-part test will compliance with other requirements or
guarantees be required.
Furthermore, in addition to being special category data, the processing of biometric data is always considered high risk, in accordance with paragraph 4
of Article 35, which states that “The supervisory authority shall establish and publish a list of the types of processing operations which require a data protection impact assessment pursuant to paragraph 1,” given that it is included among the processing operations listed in the List of Types of Data Processing Operations Requiring a Data Protection Impact Assessment, published by the Spanish Data Protection Agency (AEPD) in accordance with the provision in paragraph 4 of the aforementioned Article 35.
There is no doubt about the high-risk nature of biometric data, given that all biometric data intended to uniquely identify a person meets at least two of the three criteria contained in that list, since criteria 4, 5, and 10 of that document apply to it. (those involving the use of special categories of data; the use
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 62/225
of biometric data and those involving the use of new technologies or an
innovative use of established technologies).
Therefore, since the entry into force of the GDPR, when processing is of “high
risk”, as is the case with attendance or access control methods based on
biometric timekeeping methods, it is always mandatory to carry out a
data protection impact assessment (DPIA), in accordance with the provisions of Article 35.1 of the GDPR.
This DPIA must be carried out before the start of processing, but also on an
continuous basis. And it is not enough to simply carry it out; it must be considered valid
because it meets the requirements set out in the aforementioned article, in particular, that it
contains at least the information required by Article 35.1. Article 35.7 of the GDPR states the following:
“The assessment shall include at least:
(a) a systematic description of the envisaged processing operations and
the purposes of the processing, including, where appropriate, the legitimate interest
pursued by the controller;
(b) an assessment of the necessity and proportionality of the
processing operations in relation to their purpose;
(c) an assessment of the risks to the rights and freedoms of the
data subjects referred to in paragraph 1; and
(d) the measures envisaged to address the risks, including safeguards,
security measures and mechanisms to ensure the protection of personal data,
and to demonstrate compliance with this Regulation, taking into account
the rights and legitimate interests of data subjects and other
affected persons.”
In conclusion, the controller processing personal biometric data must be aware that this processing is classified as high-risk, requiring the prior preparation and successful completion of a Data Protection Impact Assessment (DPIA), and that it involves processing special category data. Therefore, the controller must justify that one of the exceptions in Article 9.2 of the GDPR applies before initiating or continuing such processing.
This is the case here, where it has been established that the program ***APPLICATION.1, contracted by the University, processes personal biometric data. This implies, as already stated and as established in the eighth finding of fact of this Resolution, that this data will be considered special category and its processing will be deemed high-risk.
2.4. On the processing of biometric data and the controller.
Article 4.2 of the GDPR defines the “processing of personal data” as: “any operation or set of operations performed on personal data or sets of personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 63/225
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;”
If the processing consists of attendance control for the purpose of verifying the identity of natural persons using biometric identification/authentication systems, implementing such processing will necessarily require the controller to carry out a diverse set of operations that require the processing of biometric personal data, as defined in Article 4.2 of the GDPR. These include:
The physical processing of biometric data in a biometric system typically
consists of different processes such as registration, storage, and its
exploitation or use.
This encompasses various processing operations such as the collection or capture of
the student's image, its processing to convert it into a vector or
biometric template, its registration, storage, the identification and authentication
of the student in the biometric matching process, in which the stored template is compared with the raw data of the person (face, fingerprint, or voice), the
recording of time and other possible data, as well as processing to
determine certain consequences or results, detect anomalous
behavior, etc. Processing operations also include those aimed at its
deletion, restriction, etc. All of these constitute processing operations of
biometric personal data of special categories and high risk.
The design of the biometric processing itself is also considered a
processing operation that must comply with the Principles and
obligations set forth in the GDPR. This is because, according to
the European Data Protection Board in its Guidelines
7/2020 on the controller and processor of July 7, 2021,
and the Court of Justice of the European Union (in judgments such as that of October 5,
2023, C-659/2022), Article 4.2 of the GDPR establishes a broad concept of
personal data processing. This broad concept begins with the
design of the processing, from which the obligations to
respect the data protection principles and other obligations provided for
in the GDPR arise.
In the present case, according to the RAT provided by the University, the processing activity is described as “Online exam proctoring,” the purposes of which are:
1. To verify that the student taking the exam is who they claim to be.
2. To prevent identity theft. 3. Prevent cheating or plagiarism on exams.
4. Guarantee academic quality and integrity.
5. Comply with the requirements of certifying bodies (ANECA).
Although the 2020 Data Protection Impact Assessment (DPIA) only referred to the first three purposes, its 2023 update refers to these same five purposes of the processing. As stated in Finding Five, the processing is described as “Facial recognition and desktop control” in the September 2020 DPIA, and as “User facial recognition and fraud prevention in online exams” in the DPIA prepared in July 2023.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 64/225
Based on the above, we can say that we are dealing with a personal data processing activity carried out by the University whose purpose is to establish a unique identification system for the identity of students participating in its exams as a means of controlling attendance and monitoring the exams to prevent plagiarism and fraud. themselves.
Specifically, the following biometric data is processed:
• (...)”.
Therefore, this processing combines various technological systems used to achieve the purpose of the processing: (i) a facial recognition system, which involves the processing of biometric data aimed at uniquely identifying the student taking the exam throughout its duration; (ii) a monitoring system using video surveillance (webcam, desktop recording, audio recording, and ambient recording via dual cameras), which captures images that are compared with the student's stored biometric data; and (iii) an artificial intelligence system that, in accordance with the DPIA, is used to detect behaviors considered “suspicious” for the purposes of fraud.
In conclusion, according to the documentation in the proceedings, and what the University itself stated in the three documents submitted throughout the proceedings, it is recognized and proven that it implemented a special category biometric personal data processing in accordance with the provisions of Articles 4.14 and 9 of the GDPR, which is considered a high-risk processing activity in accordance with the provisions of Article 35 of the GDPR.
With regard to responsibility, Article 4.7 of the GDPR defines: “7) ‘controller’ or ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law.”
As explained above, it is established that the University entrusted the processing of data to the entity ***COMPANY.2, with which it signed a service contract to contract the program ***APPLICATION.1 in 2015, the last addendum to which dates from December 19, 2022, and has been submitted to the proceedings. The attached Addendum,
as Annex I, contains a processing agreement, clause 3.5 of which states that the
“supplier” (data processor) will process personal data in accordance
with the instructions of the UIV, and clause 4 establishes the “powers of the UIV
as data controller.” Therefore, there is no doubt that in the present case,
the UIV is the data controller—despite the existence of a data processor,
and even though the DPIA indicates that the processing of several
actions was subcontracted to two other entities, ***APPLICATION.1 and ***COMPANY.2—since it is the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 65/225
that defines the purposes and means of the processing, for the purposes set out in Article 4.7
of the GDPR.
Consequently, based on the evidence currently in the file,
following the investigation, it is deduced that the UIV has committed two
administrative infringements of the GDPR, which persist to this day, as set forth
below in the Legal Grounds of this
Resolution.
III. On the Admission and Assessment of Evidence.
In its submissions to the initiation agreement, presented by the University on May 21,
2024, the UIV submitted and requested the admission of the following evidence:
o Along with the submissions, it included Document 1, on the “Legitimate Interest Balancing Report,” to demonstrate that the program
***APPLICATION.1 is proportionate, as it provides more benefits than harm
to the data subjects. However, it should be noted that this document is presented as an
update of the DPIA, which had not been submitted to date in the
procedure.
And by means of a “furthermore I state first” the following is requested: “that by virtue of Article
53.1.e. and Article 77 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, and other applicable legal regulations, the admission of the proceedings to evidence is requested in order to demonstrate that the elements required for the imposition of a sanction are not present, as well as the facts that demonstrate the appropriateness of dismissing the present sanctioning proceedings, which is stated
for the purpose of making the right of defense effective. Specifically, an expert report on the technical characteristics described in points 3, 4, 8, 9, and 10 of the Second Allegation and points 2 and 3 of the Fourth Allegation would be submitted, and given that, due to the short timeframe for submitting allegations, it has not been possible to submit it with this document.”
Subsequently, on July 24, 2024, the UIV submitted a document attaching the aforementioned expert report issued by the IT consultancy firm ***EMPRESA.3.
In accordance with the provisions of Articles 77 and 78 of Law 39/2015, of October 1,
on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), this investigating officer issued an order for evidence on January 15, 2025, admitting the evidence presented by the university. Two official documents issued on December 16, 2024, by this investigating officer were added to the proceedings to verify the university's business volume and the number of students enrolled. The university was also requested to provide information on the proven facts
in dispute in the proceedings that are considered relevant to determine whether the UIV is processing special category personal biometric data in this case, specifying when and why the processing has undergone changes, and, therefore, whether it has failed to comply with the obligations referred to in these proceedings.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 66/225
The university, after requesting an extension and copies of the two official documents issued, which were provided, responded to the request for evidence on February 6, 2025, submitting three additional documents and making arguments regarding them. These three documents, referenced in the fourteenth factual background, are as follows:
DOC 1. Contracts and addenda signed with ***COMPANY.2, which, according to the UIV,
"were in effect as of April 25, 2021."
DOC 2. Report from the manufacturer ***COMPANY.2 regarding the modalities of the
APPLICATION.1 program contracted by the UIV, dated January 30, 2025.
DOC 3. Other training manuals for the program, versions 2020 and 2022.
On February 26, 2025, a new statement of objections to the
initiation agreement was submitted by B.B.B., acting on behalf of the UIV,
stating that, as a result of new facts,
new objections were being made requesting the dismissal of the case file, although no document was
attached to this statement.
All these documents submitted in the various briefs presented by the UIV
were admitted as evidence in Legal Basis III of the proposed resolution, and were added to the rest of the documents submitted and actions taken by this administration.
These means of proof have been assessed by the proposed resolution in accordance with the criteria established in Law 1/2000, of January 7, on Civil Procedure, establishing as proven the following disputed facts of the proceedings, which are considered relevant to determining the UIV's responsibility for the commission of the alleged infractions, namely:
o The description of the processing carried out by the UIV, specifying the life cycle
of the processing, with the dates of contracting and implementation of each of the modalities of the ***APPLICATION.1 program.
o The description of the operation and technical characteristics of the various
modalities of the ***APPLICATION.1 program that were applied by the UIV.
The issue concerning the storage of biometric templates by the program ***APPLICATION.1.
Once the evidence has been presented and assessed in the Proposed Resolution, the written objection to the proposed resolution of the case file includes three documents:
Document 1. Report from the National Cryptographic Center, December 2024, on Secure Biometric Technologies for Access Control.
Document 2. Resolution of sanctioning procedure no. PS 41/2022, concerning the Foundation for the Open University of Catalonia (hereinafter FUOC), issued by the Catalan Data Protection Authority.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 67/225
Document 3. TESLA Report “D5.3 – Instruments technical description and development scheduling” dated July 29, 2016. In English, without an accompanying Spanish translation.
However, these three documents do not refer to “new facts,” nor do they prove facts related to the present proceedings, as they consist of a Resolution from the APDCAT (Catalan Data Protection Authority) and two reports issued in relation to legal issues related to the present case. Therefore, they cannot be admitted as evidence of facts, but rather as support or reinforcement of its legal basis. Therefore, it is not appropriate to include them in the assessment of evidence carried out, although the arguments related to them will be addressed and their content discussed when responding to the allegations against the Proposal in Section V of this Resolution.
Therefore, the assessment of evidence carried out in the proposed resolution, which is transcribed below, should be upheld:
<<3.1. Description and lifecycle of the processing carried out.
It is a recognized fact that the UIV currently uses a software tool called ***APPLICATION.1, which has been developed and contracted by
the entity ***COMPANY.2, to verify the identity of students taking online exams at its university and to monitor their exams for the purpose of controlling fraud/plagiarism.
This program combines biometric facial recognition techniques based on authentication processes that perform 1:1 comparisons with artificial intelligence technologies that allow for the analysis of anomalous or suspicious behaviors, and even decisions based on automated treatments supervised by professors.
Currently, as stated in Document 1.2 submitted with the first written response to the research request (and as stated in other documents submitted, such as the Data Protection Impact Assessment (DPIA) submitted as Document 5, and other documents such as the Master's verification report submitted as Document 3.2), it is established that currently "The operation of ***APPLICATION.1 includes the following actions (phases):
or "(...).
Throughout the proceedings, the UIV has provided documentation and made statements indicating that the processing of personal data involved in the implementation of the ***APPLICATION.1 program went through several phases. The UIV progressively implemented its different functionalities in its exam evaluation method, the dates and content of which must be reflected in the Data Protection Impact Assessment (DPIA) and must be certified by the data controller.
However, to date, the university has still not provided proof of the contracting and implementation dates for each of these program modalities, nor has it provided the technical specifications that could actually demonstrate the technical operation of each one and correctly describe the lifecycle of the processing.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 68/225
provided the technical specifications that could truly demonstrate the technical operation of each and correctly describe the lifecycle of the processing.
Regarding this matter, the UIV has provided the following incomplete and contradictory information:
In its initial written response during the investigation phase, the University states: “It is a well-known fact that its exams are 100% online and that it has been using facial recognition technology to verify the identity of students participating in its exams since 2017.”
Along with its written response, it provides the following documentation related to the operation of the program ***APPLICATION.1.
- Documents 1.1 to 1.3 contain technical and graphical information provided by the manufacturer/supplier regarding the operation of
***APPLICATION.1. Doc 1.1 is a PowerPoint presentation of the program, and Doc 1.2 is a descriptive document of the program ***APPLICATION.1.
Neither document includes the date, format, or signature indicating who created it and when. And Doc 1.3 already refers to the
“Information on the operation of ***APPLICATION.4
(***APPLICATION.4)”.
-Document 3.2. Example of Master's Verification Report for students, whose Annex I describes the “identity and plagiarism control” system.
-Documents 3.6 to 3.8 of the first written response. It provides the training manuals that, according to the UIV, were given to the students, which are dated August 2023. Specifically, 3.6 corresponds to the ***APPLICATION.4 Manual of August 2023, 3.7 to the ***APPLICATION.5 Manual of August 2023, and 3.8 to an undated installation guide for
***APPLICATION.10.
-Document 5 of the first written response. It provides two EIPDs for the treatment,
one dated September 2020, and its update from July 2023, which do not
identify the modality of ***APPLICATION.1 that is being analyzed.
or In the second research request, it was asked to provide the
commissioning and development contract for the ***APPLICATION.1 program, and it provided
only the latest addendum to the contract signed with ***COMPANY.2 on December 19, 2022,
clause one of which states that: (I) the original contractual relationship
dates back to 2015 (and not 2017, as the University indicates), (ii) and
that several extensions and addenda to the contract had been made
in 2020 and 2021, which are not included.
Specifically, the addendum signed by the UIV with ***COMPANY.2 on December 19, 2022
(the same date the email was sent to students informing them
that the dual-camera environmental monitoring system would be
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 69/225
mandatory starting with the January 2023 exams), states that: “The offer
from ***COMPANY.2 includes three service options:
***APPLICATION.4.
***APPLICATION.2
***APPLICATION.3.
In this second response, the University indicates that it decided
to contract the ***APPLICATION.4 and ***APPLICATION.2 options,
rejecting the ***APPLICATION.3 option, as it considered that it did not allow
the fulfillment of the processing purpose because it was not a secure verification system.
And it They provide the invoices that prove payment for the services
contracted for the exams carried out in the first half of 2023,
indicating that: “As can be seen in the sample invoices provided
as DOCUMENTS 2, 3, and 4, the services contracted and invoiced are limited
to Monitor Control and Biometric Control, which appears on the invoices as
GM, and the external camera surveillance service, which appears on the invoice
as External.”
However, the UIV does not provide the technical documentation that proves
the technical operation of each modality of the program, nor does it clarify
when its implementation began.
And subsequently, in its arguments against the initial agreement of May 21, 2024, it provides
only Document 1, entitled “Legitimate Interest Assessment Report,” which was included as an update to the 2024 DPIA. And
it requests that the submission of an expert opinion be admitted for processing, which is
submitted Finally, dated July 24, 2024, a document was submitted describing the
operation of the current version of the program ***APPLICATION.1, which
coincides with what is indicated in Document 1.2, without specifying which modality has been
analyzed or since what date it has been implemented.
This documentation was considered insufficient to prove on what dates and which
versions of the program had been implemented, and what the differences were in
technical operation between them, since:
(i) On the one hand, the University provided commercial information
supplied by the program vendor regarding the
operation of modality ***APPLICATION.4, but did not
provide the technical specifications for it, nor any other
technical documentation on modality ***APPLICATION.2, but rather
on another modality, called ***APPLICATION.5, which seemed
to include the features of ***APPLICATION.4 and ***APPLICATION.2, without
giving any explanation in this regard. Modality “***APPLICATION.5” that
is not mentioned in the contract and the invoices provided.
(ii) Furthermore, only the latest addendum to the service and commission contract signed with ***COMPANY.2 for the implementation of the RF identity verification system, dated December 19, 2022, was provided. Neither the original service contract signed in 2015 nor any of the other addenda or extensions mentioned therein were provided.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 70/225
(iii) Finally, two training manuals dated August 2023 were provided, referring to versions ***APPLICATION.4 and ***APPLICATION.5, without specifying the date on which the training manuals for each version were made available.
In order to determine the processing lifecycle and its description, as well as the duration of the Regarding the alleged infractions, the probationary agreement issued
required UIV to: (i) provide the technical specifications of all
versions of the ***APPLICATION.1 program that it had implemented, and
all contracts signed with ***COMPANY.2 mentioned in the 2022 addendum; (ii) clarify the dates from which it implemented the different
versions of the program, and what version ***APPLICATION.5 corresponded to, which
did not appear in the contract but did appear in the Training Manuals; (iii) and furthermore,
clarify when it had made the different
versions of the Program's Training Manuals available to students.
On February 6, 2025, the University responded to this requirement made in the probationary agreement by providing the contracts and addenda signed with ***COMPANY.2
mentioned in said addendum. December 19, 2022, as Document 1, attaching a
report issued by the program provider, ***COMPANY.2, as
Document 2, and two Training Manuals for the program dated 2020 and 2022
as Document 3, although it states that it does not know when they were made available
to the students.
The report issued by ***COMPANY.2 on January 30, 2025, expressly states that it
"complements the report submitted in 2024," and that its purpose is "to provide the Spanish Data Protection Agency (AEPD) with a complete
and accurate understanding of the actual operation of the system
used by the VIU during the period covered by the aforementioned file." It contains
statements that directly contradict the statements and
documentation previously provided by the UIV:
Regarding the program versions, the report indicates that there are only
3 versions (***APPLICATION.6, ***APPLICATION.4 AND
***APPLICATION.7):
“***APPLICATION.6
***APPLICATION.4
***APPLICATION.7”
The report does not deny that these same plans may have been marketed
under other names, although it does not justify it: “To better understand this
issue, it is important to explain that ***COMPANY.2 offers the three plans that
are referred to below, without marketing plans with the
names “***APPLICATION.2” or “***APPLICATION.5” indicated in
the AEPD agreement, which probably refer to version
APPLICATION.7,”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 71/225
Furthermore, it is repeatedly emphasized that the program does not store the
biometric data generated when performing the RF scan of the students participating in the
exam, a matter to which we will refer subsequently.
It is noted that the program lacks technical specifications beyond what is published on the website of ***COMPANY.2—which is not provided—and includes a description of the program's technical operation, which, according to the company, is common to all versions.
Finally, it is noted that the UIV had contracted version ***APPLICATION.4 and that, starting in 2018, it "began its evolution" toward ***APPLICATION.7, which is the version that included dual-camera monitoring. This contradicts all the information provided to date and the evidence contained in the complaint.
As a result, the UIV states in its latest document of February 6, 2025, that it must correct several aspects arising from the content of the report from ***COMPANY.2,
regarding what it had previously stated in its earlier documents, and concludes that:
i. That ***COMPANY.2 only has 3 different plans, and that
the choice of one plan or another does not affect the technical specifications regarding the
processing of biometric data.
ii. That references to versions “***APPLICATION.2” or
“***APPLICATION.5” should be understood as referring to version
APPLICATION.7, which incorporates user environment monitoring.
iii. That since 2018—a year already beyond the statute of limitations—VIU has been using version
***APPLICATION.7. Prior to that date, version
APPLICATION.4 was used.
iv. That version ***APPLICATION.7, in accordance with its technical specifications
does not carry out any type of storage of biometric data, complying with data protection regulations.”
However, these new statements made by the UIV are not
accompanied by any supporting documentation to prove that these were the dates and
names of the contracted versions, or that the program's technical specifications
are the same and coincide with what is stated in the report that ***EMPRESA.2 issued
ad hoc to respond to this Agency. The only supporting documentation is the report itself,
which is not accompanied by any evidence or objective data that would allow
verification of the claims made therein.
Furthermore, the dates and program names listed in the contract,
extensions, and addenda submitted with the document dated February 6, 2025, do not coincide
with those indicated in the report from ***COMPANY.2, since:
- According to the original contract of May 27, 2015, it refers
to the contracting of the facial recognition authentication program service “***APPLICATION.1”. Annex I of the contract specifies
the “technical requirements” of the contracted program, which
includes a brief description of how the program works; From which it is
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 72/225
It is deduced that the first version of the program contracted in 2015,
which was then called “***APPLICATION.1”, corresponds to the
modality currently called ***APPLICATION.1 +
(***APPLICATION.4):
“(…)
- In the contract extension of 18-3-20, it is observed that the different prices of three contractual modalities are already mentioned: ***APPLICATION.1,
***APPLICATION.1+, and “***APPLICATION.9”, therefore it is considered
proven that from 18-3-20 onwards, the environmental monitoring system was contracted for the first time
under the name ***APPLICATION.8, combined
with the two previous ones. And that all of this corresponded to the
plan ***APPLICATION.7 referred to by the manufacturer/supplier.
- In the amending addendum of June 14, 2021, the prices for the
modalities ***APPLICATION.1+, ***APPLICATION.2, and ***APPLICATION.3 already appear,
which are the same modalities listed in the addendum of December 19, 2022, initially provided by the UIV. Therefore, it is proven that, as of June 14, 2021, it was already possible to contract these 3
versions, which have been maintained to this day.
- The amending addendum of December 20, 2021, has identical content to the
previous one, although there are three signatures instead of two issued
electronically, the last signature being dated January 21, 2022. The University does not explain why two identical addenda are signed, nor does it provide the
invoices that prove what Services were paid for during that period.
-The amending addendum of December 19, 2022, refers to the same modalities
contracted since June 14, 2021. However, unlike the previous contracts,
the university does provide invoices proving that the
modalities ***APPLICATION.4 and ***APPLICATION.2, corresponding to the
exams taken in the first semester of 2023, were implemented.
From the information presented in the software supplier's report and the contracts signed
by the UIV, it can be deduced that:
o First, the names of the plans developed by the
manufacturer/supplier (***APPLICATION.6, ***APPLICATION.4, and
***APPLICATION.7) were not the same as those subsequently used when establishing
the names of the contracted modalities, nor were they the same as those stated in the
informational or commercial documents provided by the software manufacturer/supplier. to the UIV, in which there is no mention of
***APPLICATION.7, but rather of ***APPLICATION.2 (…), and ***APPLICATION.5
(training manuals).
or That according to the contracts and addenda provided, it is not true that the UIV
contracted the initial version of the facial recognition program of
***APPLICATION.1 (***APPLICATION.1, or ***APPLICATION.4) in 2017 and that from
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 73/225
2018 the UIV began using the PRO version as indicated by ***COMPANY.2.
Since these dates do not coincide with those reflected in the contractual documents signed between the parties, nor with the statements in the ANECA report
issued in 2019, which are the ones that must be considered proven in
This procedure (first proven fact), considering that the initial version
of ***APPLICATION.1 was contracted in 2015, and the evolution to
***APPLICATION.2/***APPLICATION.7 or ***APPLICATION.5 occurred from
18-3-20, as stated in the contracts provided.
Thus, we have that from 18-3-20, two different modalities were agreed upon
***APPLICATION.4 and ***APPLICATION.8 or ***APPLICATION.2) to reflect the
different prices of the ***APPLICATION.7 plan that the UIV contracted from 18-
3-20, which has remained in effect to this day. That is, a contract is signed for
the PRO Plan, in which the prices for paying for the ***APPLICATION.4 modality (version that includes the initial tools for
webcam, desktop, and recording monitoring) and the prices for paying for the modality are distinguished. ***APPLICATION.2 (which only includes monitoring of the
environment). And this has remained the case to this day, as evidenced by the second
signed addendum, although the prices paid and/or the
program names have changed.
In short, based on the documentation in this file, it can be considered
proven that, as stated in the first and second established facts:
• The UIV contracted the first version of ***APPLICATION.1, which
used a facial recognition system as a method of
authenticating students participating in its exams, and included
desktop monitoring, webcam monitoring, and
audio recording; on May 27, 2015, and not in 2017.
• As of March 18, 2020, the UIV extended the scope of the contract,
maintaining the previous services—under a modality that became
called ***APPLICATION.4—and contracting the new modality
initially designated as ***APPLICATION.8, which included the system for
monitoring the environment using dual cameras. The combination of
both contracted modalities was designated, according to the
manufacturer/supplier, as ***APPLICATION.7, and is listed in the training manuals as ***APPLICATION.5.
• As of June 14, 2021, the designation of
APPLICATION.8 was changed to ***APPLICATION.2 (environmental monitoring using
dual cameras).
• Regarding the 2022-23 academic year to which this file refers, according to the evidence provided with the complaint, which
coincides with what is stated in the invoices provided by the university and the
contractual addendum signed on December 19, 2022, it is recorded that by decision of the governing
council in May 2022, the University contracted the modalities
APPLICATION.4 AND ***APPLICATION.2, excluding ***APPLICATION.3,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 74/225
and informed the students on 19-12-22 that
monitoring of the environment using dual cameras would be mandatory starting with the exams
held on 16-1-23.
Finally, it is verified that the exams administered during the
first semester of 2023 were conducted using the program
APPLICATION.1 in its modalities
APPLICATION.4 and
APPLICATION.2 (Plan
APPLICATION.7 according to the
manufacturer/supplier and
APPLICATION.5 according to the training manuals that were sent to the students in the aforementioned email of December 19-22).
... However, since the obligations whose breach is being analyzed in this
procedure are only enforceable from the date the GDPR came into force, which was
May 23, 2018, the duration of the alleged infringements is considered to be:
or Calculated from the day following this entry into force,
it being irrelevant for the purposes of determining liability in this
procedure whether the processing began on the date indicated in the
original contract (2015) or the date indicated by the University in its submissions (2017),
since the only relevant proven fact in this regard is that,
in any case, the facial recognition system for verifying the identity of students in
the online exams conducted by the University was already operational when the GDPR came into force, and it is from then on
that the UIV should have complied with the obligations applicable to the processing of
special category biometric data.
Furthermore, in light of the report from the software manufacturer/supplier
submitted on February 6, 2025, it is also established that all
versions of the software contracted performed facial recognition
using the desktop webcam, and not the ambient camera. Therefore, the exact date on which the dual-camera system began to be used is irrelevant
for the purpose of determining the duration of the infringements alleged in
this case (Article 9 and Article 5.1.c of the GDPR), since no special category biometric data was processed through it.
All of this is without prejudice to the need for the lifecycle of the
processing described in the DPIAs and their updates to always
reflect the reality of what happened and describe all the changes made to the
description and purposes of the processing, which is not the case here
in light of the DPIAs prepared, as established in the fifth proven fact, since, upon analysis, it is observed that the contracted processing activities were not
correctly described, given that
it is established that:
o The UIV carried out an initial DPIA for the processing of “Facial recognition and
control of the desktop and environment in online exams” in September 2020,
which: (i) included the functionalities of the latest version of the program
***APPLICATION.1 contracted from 18-3-20 (***APPLICATION.7/
***APPLICATION.2/***APPLICATION.5), since it mentioned The
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 75/225
Desktop and environmental monitoring via dual cameras in the
treatment description, and dedicated a section (ii) that indicated from the
outset that the treatment actions consisting of the student's discharge and the
administration of the exam addressed the student's facial pattern.
And subsequently, the UIV approved two updates to said DPIA in 2023 and
2024 in order to complete the data that had not been included in the original
DPIA, modifying the name of the processing, its description,
purposes, applicable regulations, analysis of legal issues, and including
the complete description of the exam monitoring operations that
were not previously included, but which had been carried out since 2020.
The university's negligent actions in implementing the
processing have become evident, since the requests made and the university's responses have shown that it does not have adequate control over the documentation
of compliance with its obligations, since the practice of the exam has
revealed that the UIV is even unaware of the modalities of the program
it has contracted, when it implemented them, as well as the versions and dates
on which it provided its students with the training manual for the program they were to use
to take the exam, and did not reflect adequately and prior to the system's implementation, and what processing operations were actually being carried out when it prepared its first 2020 Data Protection Impact Assessment (DPIA),
correcting this situation in the 2023 update. And yet, in responding to the testing phase, they state that they implemented a program without having the technical specifications from the supplier who developed it, as we will see below.
3.2. Regarding the technical characteristics and operation of the program
***APPLICATION.1 used by the UIV.
The following technical characteristics of the software
***APPLICATION.1 used by the UIV to verify the identity of students participating in its online exams are considered proven, as stated in the first and sixth proven facts and are based on the documentation provided by the University.
First, it is a fact acknowledged by the UIV and stated in
Document 1.2, as well as in the 2020 EIPD and its 2023 and
2024 updates, that the technical operation of ***APPLICATION.1 in all its
versions or modalities is structured in three phases (acceptance of terms and
conditions during the student registration phase, identity registration upon
system login, and monitoring of student activities
during the exam).
Although the UIV has contracted various versions of the identity authentication program ***APPLICATION.1, the essential difference between them, as stated in section 3.1, is as follows:
(i) While the initial versions contracted on May 27, 2015,
named ***APPLICATION.1 or ***APPLICATION.4,
monitor the exam using the first three tools
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 76/225
described in Document 1.2:
-Monitoring via the computer's webcam;
-Desktop monitoring; and
-Audio recording.
(i) Subsequent versions of the ***APPLICATION.7 plan, contracted from 2020 onwards (***APPLICATION.5, which included the contractual modalities ***APPLICATION.4 and ***APPLICATION.2), included as their only new feature compared to previous versions: “Environmental monitoring via a second camera mentioned in Document 1.2: using a mobile phone as an external camera, the software is able to monitor the student's environment, providing a better viewing angle and detecting the presence of other people or the student's use of prohibited items. The analysis of these images is performed using AI algorithms without applying biometric analysis.”
It should be clarified that the fact that the system
used by ***APPLICATION.1 to verify the student's identity was
based on an authentication system using 1:1 comparisons, and not
1:N comparisons, has never been disputed, as this is stated in the technical documentation
provided (Document 1), and was taken into account from the outset when determining the
initial penalty, starting from a lower amount than
would have been applicable had the system been based on 1:N comparisons.
This will be explained in the response to the allegations.
Furthermore, in the fourth proven fact, it is established that on the date
of filing the complaint, the UIV had the following system for
“identity and plagiarism control” of exams, which was applied to the student evaluation process in a mandatory manner (without the possibility of other
evaluation alternatives). According to the update
of the EIPD of July 2023 (Doc. 5), Annex I of the Master's Verification Report
submitted as Document 3.8, and in the Training Manual for
APPLICATION.5 submitted as Document 3.7, it consisted of two phases and was
as follows:
A) Phase 1: Onboarding Process: This corresponds to the first
access to the virtual campus and is aimed at “ensuring identity and
to guarantee that the person who enrolls
is the one who actually accesses the campus and is evaluated.”
The documentation states, literally, that during registration on the
virtual campus, “the process to authenticate your identity is carried out
using a biometric recognition system and comparing it with your ID card.”
But the truth is that the documentation is based on a misconception
of biometric data, since the process described below is not actually biometric processing carried out
through facial recognition of the student, but rather,
according to the record, it is as follows:
“(…)”.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 77/225
This is later clarified in the expert report submitted in the
proceedings, which indicates that no biometric patterns are generated during the student registration process,
as we will see later.
B) (…)
Where two sub-phases are intertwined (student enrollment in the exam
which is carried out in ***APPLICATION.1 only once, or “enrollment”, and
taking the exam), and statements are made from which it can be deduced that the program generates a biometric template (personal mathematical model) that is then compared with the one obtained by
performing facial recognition during the exam. This has subsequently
denied the UIV, providing two reports that rectify these
statements.
Thus, in the master's degree verification report published by the
UIV on its website, to which the fourth proven fact refers,
the following description of phase 2 of authorship accreditation
of the exam appears, from which it can be deduced that the program generates an initial facial pattern
of the student with which comparisons are made with the
facial pattern obtained by the program from the images captured
during the exam. It is expressly stated that:
“(…)”.
From the system description provided above and that contained in the 2020 Data Protection Impact Assessment (DPIA)
and its updates, it follows that, as confirmed by the expert report
of July 23, 2024, and the report from supplier ***COMPANY.2 of
January 30, 2025, which we will refer to later, there is no doubt
that the tool ***APPLICATION.1 generates biometric patterns (which it refers to as a personal mathematical model, algorithm, or facial patterns,
depending on the case) during phase 2 of the identity and plagiarism control system
for the exams.
Although there are discrepancies between the process described in the EIPD and the identity and plagiarism control process, information about which is published on the UIV website,
regarding the controversial issue of biometric pattern storage, what is certain and undisputed is that the program
***APPLICATION.1:
o The purpose of the facial recognition system used by
***APPLICATION.1 is the unambiguous identification of the student, since it is
designed to verify that the student is the one taking the exam from
beginning to end.
o And it is also undisputed that, to fulfill this purpose, the
tool continuously generates biometric patterns throughout
the entire exam and every two seconds, comparing in real time the
images captured by the webcam with those previously recorded by the
student.
Furthermore, it is also considered proven, in the absence of evidence to the contrary, by application of the Principle of Presumption of Innocence, and more specifically, the Principle of in dubio pro reo, that the statement contained in the report of ***COMPANY.2 dated January 30, 2025, is true.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 78/225
regarding that the technical processing of students' biometric data for the purpose of verifying their identity is carried out in the same way in all the modalities of ***APPLICATION.1, without any changes having occurred upon the inclusion of environmental monitoring through dual cameras: This is
shown in the following excerpts from the report of ***COMPANY.2:
“As can be seen, the transition from one plan to another implies
only the incorporation of new tools within the monitoring process, without affecting its essential operation. of the
system. Specifically, since 2018, the evolution in the use of
APPLICATION.1 by VIU has consisted of the transition from
APPLICATION.4 to
APPLICATION.7. However, in both
cases, and as will be discussed below, the monitoring of
students via the computer's webcam remains unchanged: biometric data is never stored and is only processed for the time strictly necessary (a maximum of
2 seconds) to authenticate the students.(...)
(...) Therefore, we can state with complete certainty that the system has
always functioned in the same way at VIU with regard to the
processing of biometric data: without storing it and processing it
only for the time strictly necessary.
Finally, it is established that, as indicated in the report from
***COMPANY.2 dated January 30, 2025: the student identity verification process using facial recognition is carried out solely
through the computer's webcam, and not through the second camera (mobile phone or tablet) that monitors the surroundings.
The report from
***COMPANY.2 states: “Therefore, we want to make it clear that the
use of biometric data is not affected at any time by the
choice of one plan or another. The only difference between the two is the incorporation
of a second camera (generally a mobile phone) to improve
surveillance of the surroundings. However, in both plans, student
monitoring continues to be carried out through the computer's webcam, which is
where the biometric data is involved.”
Despite the lack of supporting documentation for this assertion, it is considered
verified, given that it coincides with the description in Document 1.2 and
the submitted EIPDs, which, in describing the four monitoring tools of the
APPLICATION.1 program, indicate that the student identity verification process
through 1:1 comparisons and photographs
is carried out solely within the "Monitoring via the computer's webcam" tool.
3.3. Specifically, regarding the storage of biometric templates or patterns.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 79/225
A key issue raised by the UIV from the outset of the proceedings, which
is reiterated in all its submissions and which it seeks to substantiate through the two reports
submitted during the testing phase, is whether or not the contracted software stores
the biometric templates generated by the ***APPLICATION.1 program, which the UIV denies.
According to the process described in the Data Protection Impact Assessment (DPIA) for the processing, as well as in the documents
published by the UIV, such as the aforementioned Master's Thesis and the training manuals
that it claims to have provided to students, the program ***APPLICATION.1
processes facial patterns used for identity verification, without
stating that the patterns are not stored, nor the fact, later alleged,
that the pattern is generated at the moment of comparing the images
during the exam each time identity verification is performed during the
exam. Recall that the Master's Thesis quotes the following verbatim (emphasis added):
“(…)”.
Therefore, in this last paragraph, the information published by the UIV indicates
that during exam registration or enrollment, a “personal mathematical model” is generated
that could correspond to what is defined as a biometric template or pattern
obtained from the three images captured during registration. And that during the exam, images are captured and compared with the student's initial biometric pattern. From this, it is initially deduced that this initial biometric pattern is created during the registration phase and is stored within the program:
***APPLICATION.1.
This interpretation is confirmed by the systematic description of processing operations carried out in the 2020 Data Protection Impact Assessment (DPIA), which indicates that among the personal data processed by ***APPLICATION.1 is the student's facial pattern and that the following actions are sub-tasked to it: (i) ***APPLICATION.1
(Platform Registration): it is indicated that "to register, the student must take
3 photographs of their face (frontal photograph, left profile photograph, and right profile photograph), and the Platform assigns them a user identification code"; (ii) and
***APPLICATION.1 (Taking an exam) states that facial patterns and facial expressions are processed as follows: “The user is authenticated facially
through the identifier code that the Platform assigned to the user during registration. In
this case, the user is authenticated by comparing the interested party's facial pattern with the one
associated with the ID (one-to-one). Once the student accesses and takes the exam, a control is carried out
to prevent fraud or copying during the exam (checking for
anomalous behaviors or facial expressions, etc.).” The 2023 DPIA update
confirms this aspect and adds that facial patterns are also processed during the webcam monitoring phase
assigned to ***APPLICATION.1.
However, this became a point of contention in the procedure when
the UIV argued that facial patterns were not stored, based on what is indicated in
the aforementioned document 1.2 on technical specifications of ***APPLICATION.1 - which
lacks a date and signature, so it is unknown whether it was issued by the
program developer or the UIV itself, and on what date it was created - which states:
“No biometric data is stored. ***COMPANY.2 has always kept in mind
all concepts related to minimizing risks and protecting the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 80/225
privacy of users. Therefore, the system has been designed to work without
storing any biometric data. When the ***APPLICATION.1 system receives an
image, it extracts the biometric data from it and from that user's record and The system compares the data, obtaining a result. This data is then destroyed, so it is not stored and remains in the system for only a few seconds.
To substantiate this claim, the UIV has provided the following reports issued by third-party companies (an IT consultancy and the software provider), which state the following:
First, an expert report dated July 24, 2024, issued by A.A.A., is provided. From the IT consultancy firm ***COMPANY.3, dated July 23, 2023,
comprising three documents, the first of which, the expert report itself, states the following:
“The objective of the expert assessment was to verify compliance with the security and privacy requirements established by the Spanish Data Protection Agency (AEPD) and the specific criteria defined by VIU (***COMPANY.3)
for the use of the tool in VIU's online exams
(International University of Valencia) regarding the capture, processing,
automatic analysis, and storage of students' facial images
during the student registration process, exam administration, and
result verification, declaring the conformity of the system implemented
by the University.”
After registering for an exam and taking the exam through the ***APPLICATION.1 system, the expert
verifies the following points, which are relevant to the biometric data:
"At the time of registration, a biometric pattern is not created for the student. Only the image is recorded through the photographs (selfies) taken by the student.
***APPLICATION.1 uses a numerical code for the ephemeral processing of biometric data.
The ***APPLICATION.1 application does not store the student's biometric pattern.
The biometric pattern is created and destroyed at the time of the verification performed during the exam.
The verification is performed in real time by comparing the biometric pattern created at that moment from the photo taken by the student at the time of registration with the biometric pattern created at that moment from the capture taken during the exam.
The processing of biometric data has a maximum duration of 2
seconds in each verification.”
The expert report includes two documents that refer to this same
issue in greater detail:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 81/225
1. Expert report on tool ***APPLICATION.1, with a description of the tests performed and the results obtained.
Regarding data storage, it is noted that the software
has an Image Store (which does not contain biometric data),
but it is also verified that there is a metadata store in which
an alphanumeric system code is stored that could
match the students' biometric pattern, the report stating the following: “The registration process metadata is
stored in the REG-D Metadata Store, with a reference to the
image (to locate it in the image store) and a
numeric code that identifies the student, along with the entity (VIU) and another
alphanumeric code to link it to the
exam/activity code. The metadata does not include biometric or
identifying data.” EVID007 is provided as evidence of this.
2. List of evidence collected during testing: In section
1.2.7. EVI007 - Registration metadata without evidence of biometric pattern creation, it is noted that:
“The student codes include only a generic entity code (corresponding to ***COMPANY.3) and an alphanumeric student code. No student identification data is observed.
Student code hash:
4c427a7ca3643e28096785e784ce6347e1ee5903ac3b63906fc67d969fb
bac87”.
Therefore, although the expert report states that this code is not a biometric pattern, the report does not provide any details or objective data
that would allow verification that the hash of the student code referred to in this evidence does not correspond to the student's biometric pattern. Since it is neither explained nor justified how this code is formed, what it corresponds to exactly, or what information it intends to associate with the student and their exam.
... Subsequently, the UIV provides a report from the software supplier
***APPLICATION.1, the entity ***COMPANY.2, dated January 30, 2025, which
was issued specifically to respond to the evidence request made
in this proceeding, the third section of which addresses this issue,
and states the following:
“3. Biometric data is not stored.
As detailed in the reports submitted in 2024, the
APPLICATION.1 system has been designed from the outset under the principles
of privacy by design, which guarantees that biometric data is not stored at any time in any type of
system.
Although this process has already been explained previously, the image capture and analysis procedure is reiterated below:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 82/225
a. (…).
Given this operation, And as mentioned, the
biometric data is only used briefly during the
analysis process, with a maximum processing time of 2 seconds per
image. It is important to note that this data cannot even be considered
deleted, since it is never stored in the
system. (...)
As already stated, the supplier's report is not
accompanied by any evidence or supporting documentation to substantiate
the claims made and mentions the report submitted in
2024, referring to the previous expert report, as if it had been
issued by the same company.
The aforementioned reports should be assessed in accordance with the rules set forth in Article 348
of the Spanish Civil Procedure Law (hereinafter, LEC), applicable to
evidence in contentious-administrative proceedings, and therefore,
to administrative proceedings such as this one, which states that: “The court
shall assess the expert opinions according to the rules of sound judgment.”
As the Madrid Provincial Court, Section 19, stated in its ruling of December 17, 2020, when assessing evidence through expert opinions (party expert reports in administrative proceedings), the following issues, among others, must be considered:
“1. The reasoning contained in the expert opinions and that presented during the hearing or examination of the experts, with the court being able to reject or accept the outcome of an expert opinion, or even accept the outcome of an expert opinion because it is better substantiated than another: Supreme Court Judgment of February 10, 1994
(/848).
2. The court must also take into account the agreed and majority conclusions resulting from both the expert opinions issued by experts appointed by the parties and those issued by experts appointed by the court, providing the reasons for their conclusions.” decision when it disagrees with the majority conclusions of the expert reports:
Supreme Court Judgment of December 4, 1989 (/8793).
3. Another factor to be considered by the Court must be the examination of the expert operations carried out by the experts who participated in the proceedings, the means or instruments used, and the data on which their reports are based:
Supreme Court Judgment of January 28, 1995 (/179).
4. The court must also consider, when assessing the expert reports, the professional competence of the experts who issued them, as well as all circumstances that give rise to a presumption of their objectivity. This may lead the court, under the new Civil Procedure Law (LEC), to give more weight to the reports of experts appointed by the court than to those submitted by the parties: Supreme Court Judgment of March 31, 1997 (/2542).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 83/225
Taking into account the rules established in the aforementioned Judgment, the reports submitted by the parties should be assessed, considering that:
First, the statements and conclusions made in both reports are not accompanied by evidence that irrefutably proves them, as explained above. Although the first of these reports (from ***COMPANY.3) does conduct a professional expert assessment based on
objective tests and verifications, but ultimately fails to prove that the hash
appearing in EVID007 of its report is not actually the biometric pattern. And
the second report (from ***COMPANY.2) does not conduct any checks,
provides no evidence, nor any supporting documentation to substantiate its claims.
Furthermore, it should be noted that the report from ***COMPANY.2 does not even provide
the technical specifications for the development of the program ***APPLICATION.1,
stating that they do not exist, and that the program's technical documentation is that
already submitted to the proceedings, including a summary of the program's
technical requirements in its report.
It should be noted that when personal data is to be processed
through a system or technical processing, it is advisable,
if not necessary, to have the technical specifications or requirements of
the same beforehand, in order to prepare a Data Protection Impact Assessment (DPIA) of the processing that analyzes
the real impact that the implementation will have This software infringes on the rights and freedoms of the data subjects. The UIV was required to prepare its Data Protection Impact Assessment (DPIA) based on this document and decide whether its program processed special category biometric data, assess the associated risks, and determine the necessary measures based on the program's actual technical characteristics.
In this case, it is clear that the DPIA was prepared based on the interpretation it could make of the technical and commercial information provided by the supplier in documents already analyzed, such as Document 1.2 and Documents 3.6 to 3.8. The description of this information was clearly incomplete and contradictory, as these documents did not mention that the facial recognition program functioned by comparing stored images with those captured during the exam and generating a facial pattern for each image every two seconds to make the comparisons. For this same reason, the prepared DPIA also failed to address this issue, referring instead to biometric recognition performed during the exam, which was then compared with the “Initial student pattern.”
Had the required technical specifications or requirements been provided
during the testing phase, and had it been verified that these were
prepared by the program developer and delivered to the UIV
before the implementation of each program version, and that they
state that the biometric processing of the data is carried out as
indicated in these reports, it could be considered proven that the
program does not store facial patterns, but rather generates them at the
moment and uses them for the time necessary to make the comparison.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 84/225
However, these specifications were requested as evidence by this instructor,
and have not been provided. The supplier itself states that they do not
exist, and that only the information on the website of
COMPANY.2 is available, which is not provided. Instead, the UIV This report-certificate, prepared ad hoc by the supplier to respond to
this evidence request, provides a brief description of what it claims are the program's technical requirements common to all
modalities. This report cannot, under any circumstances, have the probative value that
the original document, which should have been prepared before contracting the
program, would have.
Furthermore, it should be noted that there is a substantial difference between the
expert report and the report from the supplier who developed the program.
The former possesses greater credibility and demonstrates competence,
since the expert's professional competence is accredited and
the tests and verifications performed are detailed, providing evidence for
each aspect verified (although the evidence regarding the storage of the biometric pattern is incomplete). However, the report from ***COMPANY.2 does not indicate the
qualifications or position of the signatory, nor does it perform any tests or
technical assessments, nor does it provide any analysis or data study to substantiate its
statements.
In addition, the level of objectivity of The assertions in both reports must
adhere to the standard that can be applied to expert opinions issued by
technicians contracted by the data controller. Furthermore, it should be noted
in this case that ***COMPANY.2 has a contractual relationship and a clear
interest in this matter, given that it is the one that developed the program
whose application is being questioned, and has stated in its
documentation that its program does not process biometric data
of a special category, and therefore does not need to comply with the requirements established by
the GDPR for this type of processing. And, while greater objectivity can be given
to the expert report of ***COMPANY.3 because there is no record of a
prior contractual relationship or interest on its part in the proceedings, the fact remains
that the report of ***COMPANY.2 begins its assertions with the phrase:
"as indicated in the report previously submitted in 2024,"
adopting the assertions made by the consultancy that carried out the
expert analysis, since The only report submitted by the UIV during 2024 has been the expert report from the IT consultancy we are referring to, which makes the objectivity of the claims made in both reports even more questionable.
However, it is true that the first report provides a professional expert analysis that lacks the necessary evidence to prove that the program
***APPLICATION.1 does not store the biometric pattern. However, it does offer reasonable indications that its claims are true, raising a reasonable doubt that, although not documented, the program
***APPLICATION.1 used by the UIV generates biometric patterns and uses them to authenticate the student's identity during the exam. However, it does not store or destroy these patterns; rather, it generates and retains them for the time necessary to perform the authentication.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 85/225
Therefore, given that not storing students' biometric templates is a
security measure for the processing, the adoption of which is alleged but not conclusively proven
by the UIV, and there is also no evidence to the contrary, the principle of in dubio pro reo should be applied, and it should be considered that the UIV adopted this
security measure and that the program did not store biometric data, considering it proven that the operation and technical characteristics of the facial recognition
used by the program ***APPLICATION.1 conform to what is stated in
both reports provided by the UIV, interpreting the lack of evidence in favor of the
defendant.
However, as has already been mentioned on several occasions throughout this document,
the fact that the biometric template was not stored implies that the UIV adopted an
appropriate measure to reinforce the security of the processing, in order to comply with the
obligation stipulated in Article 32 of the GDPR, but this does not exempts from
liability for non-compliance with the obligations set forth in Articles 9 and 5.1.c) of the
GDPR, since it has been proven that the program used to verify the
identity of students processes special category biometric data, it being
irrelevant whether it stores them, since the important factor is that the program generates them
and uses them to perform the unambiguous identification of students continuously
throughout the exam.
Since, as stated, the determining factor for the processing of special category personal biometric data is the generation and use of the
biometric pattern to identify the student, regardless of whether it is stored
it.
IV. Response to the Objections Against the Commencement Agreement
Having addressed in the preceding Legal Basis the objections
made regarding the evidence of the disputed facts of the proceedings (and
in particular, those contained in the document of July 24, 2024, submitting the expert report of July 23, 2024, and the document of February 6, 2025, responding to the
evidence agreement of January 15, 2024), Legal Basis IV of the
Proposed Resolution proceeded to address the remaining objections made
against the commencement agreement submitted on behalf of the UIV on May 21, 2024, and February 26, 2025, as transcribed below (between <<..>>):
<< 3.1. Response to the objections of May 21, 2025.
Before addressing the allegations made, it is worth making special reference
to the nature of the position of the person who drafted and signed the first statement of
allegations dated May 21, 2024, submitted on behalf of the UIV. As
observed in said document, the allegations were prepared and signed by
C.C.C., ***POSITION.1.
This fact compels us to recall, albeit briefly, the different functions and
roles that the GDPR attributes to a data protection officer and a data controller.
Our GDPR:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 86/225
Thus, Article 4, paragraph 7 of the GDPR defines the “controller” or
“controller” as: the natural or legal person, public authority, agency or other body
that, alone or jointly with others, determines the purposes and means of the processing; if Union or Member State law determines the purposes and means of the processing, the controller or the specific criteria for its appointment may be established by Union or Member State law.
For its part, the figure of the Data Protection Officer (hereinafter DPO) is regulated in Section IV of Chapter IV of the GDPR (Article 37 et seq.) as well as in Chapter III of Title V of the LOPDGDD (Articles 34 to 37). The explanatory memorandum of the latter law emphasizes the prominent importance of this role, both in the GDPR and in the Organic Law itself, which is based on the principle that it may be mandatory or voluntary, be integrated or not within the organization of the controller or processor, and be either a natural person or a legal person.
Recital 97 of the GDPR states, in fine, that: “Such data protection officers,
whether or not they are employees of the controller, must be able to perform their duties and tasks independently.”
Among the functions of the DPO, as outlined in Article 39 of the GDPR, the following stand out:
informing and advising the controller or processor and employees
carrying out processing of their obligations, monitoring compliance with the GDPR, other data protection provisions of the Union or Member States, and the policies of the controller or processor on personal data protection, as well as cooperating with the Data Protection Authorities.
The nature of the DPO thus implies special autonomy and independence from the controller, as established in both Article 38.6
of the GDPR and Article 36 of the LOPDGDD, since it is imperative to “guarantee the independence of the data protection officer.” data protection within the organization,
and must avoid any conflict of interest.”
On the other hand, specifically regarding the submission of allegations in
a sanctioning procedure, it should be noted that, as stipulated in
Article 5.2 of the GDPR, it is the data controller who must guarantee and
demonstrate compliance with the obligations required by the article.
Taking into account the aforementioned provisions, it must be the data controller
who, in the case of this sanctioning procedure, submits the allegations they
deem appropriate against the initiation agreement in order to demonstrate their compliance
with the regulations. This may be done directly or through a representative
appointed for this purpose.
Conversely, the submission of such allegations by the DPO on behalf of and
representing the party against whom the complaint was filed could lead to a conflict of
interests, given that it affects the special autonomy and independence to which
the DPO has previously referred. If the DPO assumes the defense of the controller in a
sanctioning procedure, its independence is compromised, since in such a case
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 87/225
it is acting in the interest of the controller and not in its neutral supervisory role. Therefore,
allowing or assigning a Data Protection Officer (DPO) the defense in sanctioning procedures in
data protection matters implies interference with their functions,
generating, as noted, a potential conflict of interest.
However, regarding the relevance of the allegations presented, by virtue of the
principle of in dubio pro actione and in order to avoid any kind of defenselessness for the
respondent, it is considered appropriate to assess the allegations presented, without prejudice to
any subsequent allegations that may be made during the hearing process that
follows this resolution.
Thus, turning to the content of the statement of allegations on May 21 In 2024,
it is observed that the University includes a preliminary allegation and a total of 10 grounds for
allegation, which revolve around the three basic legal issues raised in the
present proceedings: the legal nature of the processing, the existence of an
exception under Article 9.2 of the GDPR that allows for the processing of special category data, and the passing of the triple proportionality test of the processing. The final ground is dedicated
to the allegations against the criteria for determining the sanction
that were taken into account in the Initiation Agreement.
For the appropriate clarification, the allegations made
and evidence attached to these proceedings are grouped around the following 4 issues
raised:
1. Regarding the legal nature of the processing referred to in Basis II
of the Initiation Agreement. This is developed in sections BEFORE through FIFTH of the
statement of allegations.
2. Allegations against Basis III of the Initiation Agreement. Regarding the Concurrence
of an infringement of Article 9 of the GDPR, and the concurrence of an exception under
Article 9.2 that allows the processing of special category data.
- SIXTH. - Explicit consent as an exception under Article 9.2 and as
the legal basis for processing.
- SEVENTH. - The substantial public interest as an exception under Article 9.2 and as
the legal basis for processing.
- EIGHTH. - Concurrence of a lawful basis under Article 6.1 of the GDPR.
3. Allegations against Basis IV of the Initiation Agreement, regarding the
non-compliance with Article 5.1.c) of the GDPR, because the processing of
biometric data is neither necessary nor proportionate to fulfill the purpose of the
processing.
Only allegation NINTH is included. “The application
***APPLICATION.1 is necessary, suitable, and proportionate.”
4. Arguments against the F.D. regarding the determination of the sanction.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 88/225
Grouped under allegation TEN. “In relation to the aggravating circumstances.”
The central issue around which the arguments revolve is the denial of the legal nature or classification of the processing as biometric data processing
of a special category.
As previously mentioned, the University acknowledges that the program
***APPLICATION.1 (in its initial version of ***APPLICATION.4 and the subsequent version of
***APPLICATION.2/***APPLICATION.7/***APPLICATION.5) processes biometric data, but denies that (i) the program ***APPLICATION.1 stores biometric templates that
meet the characteristics indicated in Basis 2.1 of the Initiation Agreement, (ii) that the program processes special category biometric data, and (iii) that this data is “high risk.” Its reasoning is based on several fundamental conceptual errors that lead to this conclusion, such as:
Applying an interpretative criterion from the former Article 29 Working Party in Guidelines issued prior to the entry into force of the new GDPR, which considered identity verification systems based on facial recognition, referred to as “authentication” systems because they rely on identity comparisons. 1.1, do not process special category biometric data, but only those “identification” systems based on
identity comparisons 1.N.
Also understand that the program ***APPLICATION.1, although it uses a
facial recognition system to verify the identity of students and
generates a facial pattern of them during the exam, does not process
special category personal biometric data because it does not store the facial patterns, but rather generates and retains them for the time necessary to
perform the verification, and for a maximum of 2 seconds.
To understand that current regulations differentiate between personal biometric data and special category biometric data.
To understand that this Agency is applying the criteria contained in Guidelines 05/2022, of April 26, 2023, and the Guide approved by this Agency in November 2023, retroactively, which is contrary to law.
And to understand that the processing carried out is not high-risk because it processes biometric data that, in its opinion, is not considered high-risk, arguing that its program uses artificial intelligence, and therefore the new Artificial Intelligence Regulation, which differentiates between high- and low-risk biometric data, should be applied.
In detail, the following issues are raised in the preliminary and fifth allegations of the statement of allegations, which can be dismissed based on the following:
Preliminary and first allegations. Regarding the existence of two categories of biometric data
and the distinction between verification/authentication and biometric identification
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 89/225
Following the same line of reasoning expressed in its previous submissions, the University
insists that imposing a sanction would be a manifestly
unjust and unlawful decision, since, according to the established doctrine
contained in Opinion 3/2012 of the Article 29 Working Party on the
evolution of biometric technologies, a distinction can be made between “authentication” and
“identification,” considering that identity verification carried out by the Program
***APPLICATION.1 is not included within the concept of special category biometric data. And they consider that imposing a sanction would be inappropriate
for several reasons that should be rejected based on the following:
Regarding the inclusion of both processing systems (authentication and identification) among the special category biometric data.
Basically, the UIV insists on applying a concept of special category and high-risk biometric data that is no longer in force since the entry into force of the GDPR, insisting on ignoring the new regulation contained in Article 9 of the GDPR and its Recital 51, and applying a criterion from the former Article 29 Working Party contained in Opinion 3/2012, whose inapplicability to the case of online assessment systems by universities using facial recognition and camera and audio recording devices was already clarified in 2020 for a case equivalent to the one in question, in which Report 0036/2020 was issued by the Legal Department of this same Agency. And the
University was aware of this, since in its Data Protection Impact Assessment (DPIA) of September
2020 it mentions Report 0036/2020, deciding, on its own initiative, to continue
considering that its processing did not include special category biometric data, acting against the new regulation provided for in the GDPR, and the
Agency's own criteria.
Furthermore, they disagree with the interpretation made in this regard by the highest
advisory body on data protection (EDPB) in Guidelines
5/2022 on the use of facial recognition in the application of
the law of April 26, 2023, which has confirmed that the GDPR includes both
processing systems (authentication and identification) among special category biometric data.
First of all, it must be pointed out that the University is contradicting itself
between what it states in its written submissions and response, and
its own actions, since it prepared a Data Protection Impact Assessment (DPIA) in September 2020,
which was updated in July 2023, and in January 2024, where it acknowledges
that an impact assessment is necessary because the processing is
high-risk.
Having made this clarification, the arguments made by the University regarding this matter, which it has maintained since its initial responses, must also be dismissed. These arguments assert that the distinction between authentication processes (1:1 comparisons) and identification processes (1:N comparisons) must be maintained. This distinction was highlighted in Opinion 3/2012
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 90/225
Article 29 Working Party, which analyzed the regulations prior to the current GDPR.
And indeed, identity authentication processes that
perform 1:1 comparisons of the legal nature of special category biometric data cannot be excluded, since:
As noted in section 2.3 of this Proposal,
the distinction between authentication and identification advocated by the
University is based on an interpretative criterion that has been
superseded and is no longer applicable since the GDPR came into force. It is
that an Article 29 Working Party Opinion is being cited
dating from 2012, which interpreted the previous regulations on
personal data protection (in which biometric data
did not exist and therefore could not be considered as
data requiring special protection). Therefore, it is not applicable since the
entry into force of the new GDPR (May 2018), where all
biometric data aimed at the unique identification of a person
were elevated to a special category in Article 9 of the GDPR, and it was
clarified in Recital 51 of the GDPR that this concept includes
both 1:1 authentication and 1:N identification.
It is not denied that the biometric systems that the aforementioned Opinion
of 2012 refers to as “authentication” systems, based on
1:1 comparisons, generate fewer risks to the rights and
freedoms of the data subjects than those referred to as “identification” systems, based on 1:N comparisons. The configuration of
this identity verification system assumes that the program
was equipped with a technical security measure whose adoption
has been considered in the established facts, and was taken
into account when defining the infringements and determining the penalty to be imposed.
However, its use does not change the legal nature of the personal
data being processed when using this program, which in
both cases, is personal biometric data aimed at
unique identification. With this argument, the University
confuses the category of the data processed with the possible security measures
that are advisable to adopt to address the risks
presented by the processing, one of which is precisely
to implement biometric processing systems based on
1.1 comparisons, since they only need to compare the biometric data
and images captured with the biometric template of a single
person (the student who has registered and accessed the virtual campus
to take the exam).
The University cannot claim ignorance or confusion when
interpreting the regulations, since it has a duty to be aware of them
as the data controller, nor can it excuse itself based on the lack of
interpretative instructions or general guidelines issued by
the advisory and data protection authorities, since this is not a
requirement or suspensive condition for compliance with its
obligations, which arise from the entry into force of the GDPR.
Since the new Principle of Proactive Responsibility provided for in
Article 5.2 of the GDPR obliges every controller to thoroughly analyze
its processing and diligently determine how
the obligations contained therein should be applied. Thus,
Article 5.2 of the GDPR states the following: “2. The controller shall be responsible for compliance with paragraph 1 and be able to demonstrate such compliance (“proactive responsibility”),”
and may not transfer its responsibility for compliance to the advisory or data protection authorities.
But, in addition, in this specific case, it is on record that the University
was aware since 2020 that this Agency had already stated
that in the specific case of online exam assessments
through facial recognition processes carried out by
1:1 comparisons, it is considered a special category of biometric data processing.
As stated in the fifth finding of fact of this
proposal, it is established that the University was aware, since
September 2020, when it prepared the first Data Protection Impact Assessment (DPIA)
of the processing, that this Agency had already issued an express
opinion on this matter through Report 0036/2020
from the Legal Department.
As explained in the Initiation Agreement for this procedure,
it is true that said report assumed that the distinction between
authentication/identification and the general rule of considering that
authentication processes were not biometric data of a special category
was not applicable, but it also indicated that this should be assessed in each specific case,
and that this exclusion of authentication/identity verification processes was not applicable to
processing aimed at uniquely identifying students
participating in online assessment systems carried out by
universities through facial recognition and camera and audio recording devices. And therefore, in this specific case—the processing of biometric data through 1:1 comparison systems performed by facial recognition software (PROGRAM.1)—it is also considered a special category,
and is generally prohibited by Article 9 of the GDPR. Despite this,
it decided to act against the interpretive criteria of this
Agency.
Thus, while it is true that Report 36/2020 indicated that the
general rule was that:
“(…) Considering the aforementioned distinction, it can be interpreted that,
in accordance with Article 4 of the GDPR, the concept of biometric data would include both scenarios, both identification
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 92/225
and verification/authentication. However, and in general,
biometric data will only be considered a
special category of data in cases
where they are subject to technical processing aimed at
biometric identification (one-to-many) and not in the case of
biometric verification/authentication (one-to-one)”
But, subsequently, the aforementioned Report determined that the specific case should be considered, and analyzing an “E
Proctoring” system used by the University requesting the report (UNIR),
which is virtually identical to the one used by UIV, stated
expressly that although an authentication system was used,
1.1 biometric data was of a special category, given that the
purpose was the unique identification of the student. Specifically, it stated
the following:
“However, this Agency considers this to be a
complex issue, subject to interpretation, regarding which
no general conclusions can be drawn. Each
case must be considered individually, taking into account the data processed, the
techniques used for its processing, and the resulting
interference with the right to data protection.
Until the European Data Protection Board
or the courts issue a ruling on the matter,
in case of doubt, the interpretation most favorable
to the protection of the rights of the data subjects must be adopted. (emphasis added).
In the present case, as we have indicated, the
consultant does not identify the facial treatment techniques
referred to in the query. However, as the Technology Assessment and Studies Unit has informed
the Legal Department,
different techniques are currently being
employed:
The queries raised establish
measures for identification and control during the online test
that These range from the least to the most intrusive:
• Access to the student's image and microphone, including:
o Recording the student's image and sound during the exam.
o Multi-camera viewing of the student from different perspectives.
o Recordings of the student's personal environment before and/or during the test.
• Access to the student's system.
o Access to the student's screen.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 93/225
o Control of the student's system (at least by blocking the execution of applications other than educational applications).
o Recording of the student's interaction with the system.
• Processing of biometric information.
o Identification through facial recognition and other biometric parameters of the student (such as typing profile).
o Processing of biometric data to profile attitudes, gestures, moods, anxiety levels, etc.
It should be noted that, as acknowledged in the aforementioned
Second Online Workshop for Sharing Experiences on
Evaluation Models, universities are
combining different systems to verify the identity of
students and prevent potential identity theft. Furthermore,
one of the characteristics of the ***PROGRAM.1 systems
currently available on the market is that they guarantee student identification
through facial recognition, preventing
identity theft, not only at the outset, but also
throughout the entire activity. To this end, the activity is recorded
and various captures are taken and compared
with the biometric information previously stored in their
databases. These systems also include, as
mentioned, the processing of other types of biometric data
(such as keystrokes) and non-biometric data,
such as recordings of the student's surroundings,
as well as microphone access for sound recording.
Therefore, considering the specific circumstances, which involve
the processing of different types of biometric data and in which
facial recognition is not performed at a specific
moment but is carried out continuously, which
may also involve the processing of biometric data
of a third party for comparison with that of the student in order
to identify possible impersonation, it must be concluded that the
facial recognition processes used for conducting
online assessments involve the processing of
biometric data for the purpose of uniquely identifying a
natural person.
In this same vein, it is worth recalling that the European Data Protection Supervisor, in its “Guidelines 3/2019 on processing of personal data through video devices” of July 10, 2019,
considers the use of video surveillance with facial recognition as a special category of data under Article 9 of the GDPR:
76. The use of video surveillance including biometric recognition functionality installed by private entities for their own purposes (e.g., marketing, statistical, or even security) will, in most cases, require explicit consent of all data subjects (Article 9(2)(a)), however, another suitable exception in Article 9 could also be applicable. Example: To improve its service to a private company
replaces passenger identification check points within an airport
(luggage drop-off, boarding) with video surveillance systems that
use facial recognition techniques to verify the identity of the
passengers that have been chosen to consent to such a procedure.
Since the processing falls under Article 9, the passengers, who
will have previously given their explicit and informed consent, will
have to list themselves at for example an automatic terminal in
order to create and register their facial template associated with
their boarding pass and identity.
(The use of video surveillance, including biometric recognition functionality, installed by private entities
for their own purposes (e.g., marketing, statistics, or
even security) will, in most cases, require the
explicit consent of all data subjects (Article 9(2)(a)). However, another appropriate exception to Article 9 might also apply.
For example: To improve its service, a
private company replaces passenger identification checkpoints
within an airport (baggage return,
boarding) with video surveillance systems that use facial recognition techniques
to verify the identity of
passengers who have opted to consent to this
procedure. Since the processing is governed by Article 9,
passengers, who will have previously given their
explicit and informed consent, will need to register, for example, at an
automated terminal to create and register their facial template
associated with their boarding pass and identity.)
Therefore, this Agency shares the consultant's view,
in the sense that the facial recognition systems in question
involve the processing of special categories of data.
... Therefore, for the processing of biometric data to be lawful, one of the exceptions that lift the prohibition on its processing must apply, in accordance with paragraph 2
of Article 9 of the GDPR…” (emphasis added)
In light of the content of this report cited by the UIV, there is
no doubt that there is a clear parallel between the biometric processing analyzed in report 0036/2020 of this
Agency and the processing of personal data carried out by the UIV
throughout the student evaluation process (capture of
images of the student's face through the computer's webcam and
analysis with AI algorithms using biometric analysis, as well as
detection of incorrect behavior; monitoring of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 95/225
desktop, audio recording; monitoring of the environment through
a second camera using a phone mobile phone as an external camera
with the analysis of these images performed using
AI algorithms without applying biometric analysis).
Therefore, there is no doubt that the UIV should have already concluded
since the entry into force of the GDPR in 2018, and at least since
the date of approval of said Report in 2020, that it was
carrying out biometric data processing identical to that
analyzed in said Report, and was therefore processing data of
a special category. Furthermore, it is established that when
it prepared the first DPIA of 2020, it was already aware of this
Agency's criteria for the specific case of facial recognition for the
administration and monitoring of online exams in universities, and
that the Legal Department of this Agency had expressly indicated
that there were possible alternatives for carrying out
adequate attendance and fraud control in the evaluation of its
students, which did not involve biometric processing.
Therefore, the Principle of Legitimate Expectation cannot be invoked, and
it cannot be understood that the The university was unaware that the old criteria of
Opinion 3/2012 no longer applied under the new regulations, at least
since 2020, when it carried out its first DPIA.
The UIV claims that the EDPB did not issue instructions on this matter until
2022 and that the Agency maintained an ambivalent stance on the issue until
the publication of the Guide on attendance control processing using
biometric systems in November 2023.
The UIV maintains that this interpretation was recently changed by the
EDPB in EDPB Guidelines 5/2022, according to which verification/authentication processes would also be considered
biometric data, included as high-risk and special category data.
Furthermore, the university points out that the Spanish Data Protection Agency (AEPD) maintained an
ambivalent position until November 2023, when it published a
non-binding guide on attendance control processing presence
through biometric systems (hereinafter, Biometrics Guide), which follows
the new criteria of EDPB Guidelines 5/2022. It understands that for a
period of 6 years there were no criteria, that these cannot be applied
retroactively, and that the guide is not a legal norm because it is not
binding.
It is true that the aforementioned EDPB Guidelines 05/22 are clear and determine
that the new GDPR regulation includes both biometric processes of
authentication and identification:
“10. Like any biometric process, facial recognition can
fulfill two different functions:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 96/225
• the authentication of a person, intended to verify that a person
is who they claim to be. In this case, the system will compare a
pre-recorded biometric template or sample (e.g., stored
on a smart card or biometric passport) with a single face, such as
that of a person presenting themselves at a checkpoint, in order to
verify if it is a single person. Therefore, this functionality is
based on comparing two templates. This is also called
one-to-one verification.
• The identification of a person, intended to find a person within
a group of people within a specific area, an image, or a database.
In this case, the system must process each captured face to
generate a biometric template and then check if it matches a
person known to the system. Therefore, this functionality is based
on comparing a template with a database of templates or samples (baseline). This is also called one-to-many identification. For example,
you can link a record of personal names (surname, first name) to a face if the comparison is made with a database of photographs associated with surnames and first names. It can also involve tracking a person through a crowd without necessarily establishing the link to the person's civil identity.
11. In both cases, the facial recognition techniques used are based on an estimated match between templates: the one being compared and the baseline(s). From this perspective, they are probabilistic: the comparison deduces a higher or lower probability that the person is indeed the person to be authenticated or identified. If this probability exceeds a certain threshold in the system, defined by the user or the system developer, the system will assume a match.
12. Although both functions—authentication and identification—are distinct, they both relate to the processing of biometric data concerning an identified or identifiable natural person and, therefore, constitute the processing of personal data, and more specifically, the processing of special categories of personal data. (Emphasis added)
However, it is not true that there has been a change in criteria since
the issuance of the aforementioned EDPB Guidelines 05/2022, nor since the Guide
approved by this Agency in November 2023. Rather, these guidelines
confirm the change in position adopted by the GDPR itself, by
elevating all biometric data aimed at the unique identification of
natural persons to the status of special category personal data.
There is no retroactive application of the rules, since the
obligations whose non-compliance is being examined in this procedure were
imposed by the GDPR and are enforceable from its entry into force, not from
the issuance of the aforementioned Guidelines 05/2022 or this Agency's Guide.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 97/225
It is important to remember that, as the UIV itself points out in its submissions, the
EDPB Guidelines (and the previous Article 29 Working Party), as well as the Guides and
Reports issued by this Agency, are not binding regulations, but rather
contain mere interpretative criteria that are not mandatory.
Therefore, they cannot replace or condition the application of binding
legal regulations such as the GDPR, which is a European regulation whose
provisions are mandatory from the moment of its entry into force. The
failure to adopt guidelines or a guide is not an excuse for the data controller
to fail to comply with the obligations set out in the GDPR.
The regulatory criteria that data controllers and processors
of personal data subject to the GDPR must apply are established by the provisions of the GDPR, its implementing regulations approved by the Government,
European regulations, and sector-specific Spanish laws.
The legal criteria that limit the interpretation of data protection regulations
are established in the rulings of the Court of Justice of the European Union,
Spanish case law, EDPB guidelines, AEPD circulars,
or AEPD legal reports. However, those issued by the EDPB or the AEPD
are not a source of law, without prejudice to their value as general
guidelines, and therefore the data controller is not obliged to
comply with them, although doing so is recommended or advisable.
Specifically, the EDPB offers general guidance (such as guidelines,
recommendations, and best practices) for informing about the GDPR. Publishes
guidelines to ensure that national authorities and stakeholders
guarantee the consistent interpretation of the GDPR.
And in accordance with Article 57(d) of the GDPR, this Agency has the function of
promoting awareness among data controllers and processors
of their obligations under the GDPR. This
function is configured as a power, not an obligation, so
it is not required that interpretive guidelines be approved for all
issues arising from the application of a new regulation, much less that they be
approved within maximum timeframes from its approval, especially considering
the evolving scope of biometric technologies.
In the case at hand, the “AEPD Guide on Access Control Processing
through Biometric Systems” compiles the regulations and criteria established, among others, in the GDPR (in force since 2018), the Constitutional Court Judgment 76/2019, the List of types of data processing
requiring a Data Protection Impact Assessment (DPIA), published by the AEPD and approved
in 2019 by the EDPB, EDPB Guidelines 3/2019 on the processing
of personal data using video devices, Guidelines 4/2017
on data protection impact assessments (DPIAs) and for
determining whether processing “is likely to result in a high risk” for the purposes
of Regulation (EU) 2016/679, EDPB Guidelines 5/2020 on
consent, and the AEPD Guide to Labor Relations of 2021, the
Risk Management and Impact Assessment Guidelines for Personal Data Processing
of the Spanish Data Protection Agency (AEPD) of 2021, the Opinion of the European Data Protection Supervisor on its recommendations for biometric attendance controls in the European Parliament (Case 2022-1318)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
98/225
Data Protection on its recommendations for biometric attendance controls
in the European Parliament (Case 2022-1318) and the EDPB Guidelines
05/2022, on the use of facial recognition in the field of
law enforcement.
Therefore, the Guide does not alter the legal sphere of data subjects, nor does it
establish new regulatory criteria. The Guide establishes the “appropriate guidelines for compliance with obligations,” as established in the
Eighteenth Additional Provision of the LOPDGDD, and fulfills the
AEPD's obligations to “promote compliance,” as established in the
AEPD Statute.
They maintain that the change of criteria contained in the EDPB's Guidelines 05/2022 is not applicable to the present case.
The university disagrees with the criteria expressed in these EDPB Guidelines 5/2022, stating that the extension made therein of
Recital 51 of the GDPR is contradictory to what is stated in
Recital 91 of the GDPR and with Article 9.1 of the GDPR, which only includes
biometric processing for unique identification as a special category,
and not authentication processing.
In this regard, the University mistakenly believes that, according to Recital 91 of the GDPR, there are two categories of biometric data: those that pose a high risk and those that do not.
However, Recital 91 of the GDPR, which refers to the circumstances under which a DPIA must be carried out, states the following:
“(…) A data protection impact assessment should also be carried out where personal data are processed to make decisions concerning specific natural persons based on a systematic and comprehensive evaluation of personal aspects of those natural persons, based on profiling of such data or as a result of the processing of special categories of personal data, biometric data or data relating to criminal convictions and offenses or related security measures.(…).”
It is true that Recital 91 of the GDPR distinguishes between the processing of special categories of personal data and biometric data, separating them with a comma. But this is not because it considers some to be high-risk and others not, nor because it understands that authentication is not
considered special category biometric processing.
As already mentioned in Legal Basis 2.1,
there is a distinction between personal biometric data that
meets the criteria included in the definition of Article 4.14 of the GDPR
—which will always be considered special category according to Article
9 of the GDPR, and whose processing is high-risk according to Article 35 of the
GDPR—and biometric data that does not meet the criteria contained in
that definition, as would be the case, for example, with programs that identify
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 99/225
that the movements of a computer mouse are being made by a
human and not a machine. These latter data are also biometric, but
are not considered personal data because they are not intended to uniquely
identify individuals, and therefore will not be considered special category personal data. However, they may be considered high-risk if they meet two of the
criteria contained in the list of data processing types requiring
a data protection impact assessment, published by the
Spanish Data Protection Agency (AEPD) pursuant to the provision in section four of
Article 35, which states that processing
that meets at least two of the three criteria in
said list will always be considered high-risk, since those corresponding to numbers 4,
5, and 10 of said document apply (those involving the use of special categories of data; the use of biometric data; and those involving the
use of new technologies or an innovative use of established technologies).
Therefore, according to Article 35.4 of the GDPR and the List of
processing activities requiring a DPIA referenced above,
the processing of biometric data that is not a special category because it does not
uniquely identify a person or generate a biometric template
could be considered high-risk and require a DPIA if
it employs new technologies, as is the case in this program, which
employs artificial intelligence techniques in addition to biometrics. This is
what Recital 91 refers to, which in no way contradicts
Recital 51 of the GDPR.
Furthermore, the UIV understands that EDPB Guidelines 05/22 are not
applicable to this case, since they refer only to the context of
law enforcement and police investigations, when the system ***APPLICATION.1 used by the
University is based on consent. However, it is not Guidelines
5/22 that determines that the processing of biometric data is of a
special nature, but rather the GDPR itself, as already stated. And these Guidelines are not being applied
to determine whether the possible
concurrent exceptions of Article 9.2 of the GDPR apply, so it is not appropriate
to question their application in the present case.
Regarding the categorization of biometric data by the new Artificial Intelligence Regulation.
It is also noted that, according to the new Artificial Intelligence Regulation (hereinafter, RIA), REGULATION (EU) 2024/1689 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 June 2024 (published in OJEU 1689 of 12/07/24), the biometric identity verification performed by the UIV program is not considered special category biometric data processing nor high-risk processing. They point out that the RIA establishes two categories of biometric data: a) general data, which do not pose a high risk; and b) biometric data that pose a high risk. This, in their opinion, corroborates the interpretation that excludes biometric authentication processes from special category biometric data, according to the complainant.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 100/225
It is true that the new RIA regulates artificial intelligence systems and
establishes a distinction between artificial intelligence systems that process
general biometric data and those that process high-risk
biometric data, noting the following:
Article 3(a) defines "AI system" as: a machine-based system
designed to operate with varying levels of
autonomy and capable of adapting after
deployment, and which, for explicit or implicit objectives, infers from the
input information it receives how to generate
output results, such as predictions, content, recommendations, or decisions,
that can influence physical or virtual environments.
Article 6 refers to the fact that there are two types of AI systems that will be
considered high-risk: those related to security mechanisms
in products listed in Annex I (harmonization lists), and those
listed in Annex III (point 1 of which includes certain biometric systems such as “Remote Biometric Identification Systems” with
exceptions; “AI Systems intended for use in biometric categorization based on sensitive or protected attributes or characteristics based on inference from those attributes or characteristics”; and “AI Systems intended for use in emotion recognition”).
However, this distinction does not apply to the present case, since
:
(i) This distinction did not come into force until 2/2/2025,
given that Article 113 of the RIA provides for a phased implementation
of its provisions, stipulating that the chapter in which this distinction is defined will not be applicable until
2 February 2025: “Chapters I and II will be applicable
from 2 February 2025.” Therefore, in any case, it would not be
applicable to the processing carried out by the UIV prior to that date.
(ii) The application of the RIA does not preclude the application of the criteria
contained in the GDPR, which governs the obligations of
the processing of personal data considered to be high
risk in its Article 35.
This is because Article 2.7 of the RIA has declared that
both sets of regulations must coexist and are applied
independently, expressly stating that: “Union law on the protection of personal data, privacy and confidentiality of communications shall apply
to personal data processed in relation to the rights and
obligations established in this Regulation.” This
Regulation shall not affect Regulations (EU) 2016/679 or (EU) 2018/1725 or Directives 2002/58/EC or (EU) 2016/680, without prejudice to Article 10(5) and Article 59 of this Regulation.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
101/225
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
This is confirmed by Recitals 39 and 63 of the RIA, which
state:
“39) All processing of biometric data and other personal data
associated with the use of AI systems
for biometric identification, except for that associated with the use of
real-time remote biometric identification systems
in publicly accessible spaces for the purpose of ensuring
compliance with the law regulated by this
Regulation, must continue to comply with all the requirements
derived from Article 10 of Directive (EU) 2016/680.
Article 9(1) of Regulation (EU) 2016/679 and
Article 10(1) of Regulation (EU) 2018/1725
prohibit the processing of biometric data for purposes
other than ensuring compliance with the law, with
the limited exceptions provided for in those Articles.” In
the application of Article 9(1) of Regulation (EU)
2016/679, the use of remote biometric identification for
purposes other than ensuring compliance with the law
has already been subject to prohibition decisions by
national data protection authorities.”
“63) The fact that an AI system is classified as
a high-risk AI system under this
Regulation should not be interpreted as indicating that its
use is lawful under other acts of
Union law or national law compatible with
Union law, for example, in the area of personal data protection or the use of polygraphs and similar
tools or other systems to detect the emotional state
of natural persons. Any such use must continue to be carried out
exclusively in accordance with the
appropriate requirements arising from the Charter and the applicable
acts of Union secondary law and
national law. This Regulation should not be understood as
providing a legal basis for the processing of
personal data, including special categories of
personal data, where applicable, unless this
Regulation specifically provides otherwise.”
(iii) Due to the existing distinction between the processing of biometric
personal data and biometric systems.
According to the 2023 DPIA (p. 702 exp.), the program contracted
by the University employs technologies that combine biometric
data with artificial intelligence, since the monitoring that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 102/225
is carried out during the exam in order to prevent
fraud/plagiarism is said to incorporate techniques to detect
“anomalous” behavior and make automated decisions
based on it, which are subsequently supervised by
the assigned professor.
But this only implies that the processing uses
biometric systems and artificial intelligence systems to carry out
some of its operations Processing. The concept of
high-risk processing, as defined in Article 35 of the
GDPR, is broader than the concept of systems or methods of
technological processing by which the decision is made
to carry out the processing.
As explained in Legal Basis 2.1,
the processing of biometric data can be carried out through
various types of technologies, implementing different
technological systems, some of which may be
biometric and artificial intelligence systems simultaneously, as
appears to be the case in the “E-Proctoring” system used by the
University.
When all the provisions of the RIA applicable to this matter come into force, there will be certain biometric systems
using artificial intelligence that do not pose a
high risk according to the RIA definition, but the processing, in its entirety, will continue to be classified as high risk
from a data protection perspective, provided that
the whole is considered high risk according to the
definition in Article 35.4 of the GDPR. And as stated,
according to the List of Processing Activities Requiring a Data Protection Impact Assessment (DPIA) that
was approved by this Agency, there is no doubt that the
processing of biometric data will always be considered
high risk under the GDPR, even if it employs an
artificial intelligence system that is not considered high risk by the
RIA.
... In other words, the application of the RIA means that when
we are dealing with biometric processing of data of a
special category aimed at the unique identification of
individuals, a Data Protection Impact Assessment (DPIA) will always be required, and in the case
that it is based on an artificial intelligence system that is
classified as high-risk under Article 6 of the RIA, the documentation referred to in Articles 11 and 27, among others, of the RIA must also be prepared. This is because both regulations protect
different perspectives of the law.
In short, it can be said that the fact that an
artificial intelligence system is used that is not classified as high
risk by the RIA does not imply that the processing of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 103/225
personal data carried out is not high risk, as clarified in Recital 63 of the RIA, and therefore this claim can also be dismissed.
Second Allegation. The system contracted by the university to perform continuous facial recognition of students does not meet the characteristics of the definition of biometric data referred to in section 2.1 of the Initial Agreement.
Furthermore, the University denies that its system possesses the characteristics that section 2.1 of the Initial Agreement identified as inherent to biometric processing. These characteristics imply additional risks beyond those posed by systems for the unique identification of individuals that are not based on biometric processes.
Essentially, it is emphasized that when registering a student, what the UIV refers to as a "biometric pattern" is not stored. Instead, this pattern is created and destroyed during the verification process performed during the exam, and is stored for a maximum of two seconds. Verification that “is performed in real time
by comparing the biometric pattern created at that moment from the photo
taken by the student at the time of registration with the biometric pattern
created at that moment from the capture taken during the exam.”
This issue has already been resolved in the Legal Basis prior to
evaluating the evidence, understanding that it has not been proven that the program
APPLICATION.1 stored the biometric patterns during the student registration phase
and the enrollment phase in the program to take the exam. Therefore,
the principle of In Dubio Pro Reo must be applied, and this lack of
evidence must be interpreted in favor of the university. It is true that, as
indicated in the expert report submitted on July 24, 2024, and the
report issued by the manufacturer that developed the program on January 30,
2025, the program
APPLICATION.1 generates the student's facial pattern and uses it
to perform continuous identity authentications of the student
during the exam (every two seconds), without needing to
store it.
However, as also stated, this only implies that the UIV
adopted a technical security measure that contributes to reducing the risks
arising from processing of this type, but does not exclude the university from
liability for having processed special category personal biometric data,
since both the system design and the
generation and use of a biometric pattern are biometric data processing operations that must be authorized by an
exception under Article 9.2 of the GDPR, and be necessary and proportionate
in accordance with the provisions of Article 5.1.c) of the GDPR.
The UIV also points out that there are other technical characteristics of
APPLICATION.1, such as the use of pseudonymized personal data,
so that the application does not contain the student's identity, and the use of a
numeric code for data processing. That the process eliminates the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 104/225
possibility of false positives or negatives. Characteristics
inherent to most biometric systems which, as explained
in Basis 2.1, only confirm that we are dealing with a
processing of special category biometric personal data. All of these
are typical security measures that have been adopted by the data controller
in the program, which have been taken into account when reducing
the penalty to be imposed, but which in no way serve to conclude that
the processing is not high-risk or does not involve special category biometric data.
Furthermore, when the University states that multiple checks are performed throughout the exam, resulting in an error rate close to zero, it merely demonstrates that the system is suitable for fulfilling the purpose of the unique identification of the student, which is not disputed in these proceedings.
On the other hand, the assertion that “human supervision at the end of the exam eliminates the possibility of errors, since it is the professor who assesses the fraud alerts and verifies their accuracy” prevents the attribution of potential liability for non-compliance with Article 22 of the GDPR (relating to the right not to be subject to a decision based solely on automated processing), but does not exclude potential concurrent liability for non-compliance with Articles 5.1.c) and 9 of the GDPR, which are the ones alleged in these proceedings.
Third Allegation. Absence of adverse risks.
They maintain that there are no risks since the sample taken to create the
biometric pattern is very small and limited, and insufficient to perform any
actions other than identity verification. This is a common
characteristic of most biometric systems based on
facial recognition, such as this one, which use a small sample of
the face image (facial points) that is converted into a
biometric template. This characteristic has been recognized as a security measure
adopted and has been taken into account when classifying the infractions and determining the
penalty to be imposed, but in no case does it determine that the processing is not
high-risk or that it should not comply with the obligations whose breach is
alleged in this proceeding, in the same sense indicated
above.
or Fourth Allegation. The application ***APPLICATION.1 does not comply with the
characteristics of the biometric templates established in section 2.2 of the
Initiation Agreement.
It is reiterated that templates are neither generated nor archived, so we refer to what has already been stated regarding both issues.
Fifth Allegation. Interpretation of Article 9 of the GDPR.
They provide the Roxburgh table published in a 2017 book on fingerprinting by the United States Department of Justice to argue why
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 105/225
there are no false positives or negatives in their system, and to justify that the biometric verification, which has the data subject's consent, radically eliminates the number of false positives or negatives. Furthermore, they insist,
once again, that biometric verification does not fall within the scope of Article 9.1 of the GDPR.
The acceptable level of false positives or negatives of the biometric system
used by the University has not been questioned, the Agreement
initiating this case understanding that the program is suitable for the purpose of the
processing. However, these levels of effectiveness of the facial recognition system
do not preclude the fact that the program processes special category biometric data, nor does it constitute high-risk processing. Therefore, the data controller
using it must comply with the requirements established for both in the
GDPR, including ensuring that, in addition to being suitable, the processing of
special category biometric data it involves is truly necessary and
proportionate to fulfill its purpose.
or Allegations regarding the existence of an exception under Article 9.2 of the
GDPR that would allow the processing (allegations six to eight).
For the sake of clarity, and to avoid unnecessary repetition, reference will be made to the reasons why it is understood that there is no exception that would allow the processing of special biometric data in the following Legal Basis (V), which is specifically dedicated to determining whether there has been a breach of Article 9 of the GDPR.
Ninth Allegation: The application ***APPLICATION.1 is necessary, suitable, and proportionate:
For the same reasons stated in the previous paragraph, this will be addressed in Legal Basis VIII, which is dedicated to the analysis of suitability, necessity, and proportionality, and to compliance with the Principle set forth in Article 5.1.c) of the GDPR.
Tenth Allegation: Regarding aggravating circumstances.
(i) First, regarding the aggravating circumstance related to
the “Nature, seriousness, and duration of the infringement,” it is noted that
it is arbitrary and unfair for the Spanish Data Protection Agency (AEPD) to apply the duration of the treatment, exceeding six years, as an aggravating circumstance
when
virtually the entire period coincided with the situation in which
the AEPD itself did not clarify its position until November
2023, that is, after the reported events. Furthermore,
according to the UIV, it could be understood that, by doing so, the AEPD is acting
against its own prior actions.
Regarding this matter, we refer to what was already indicated in the
response to the preliminary and first allegations, and the
statement made in the Commencement Agreement that “the processing
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 106/225
of facial recognition biometric data has been carried out
unlawfully since 2017” is hereby rectified, given that it has been proven during the
evidentiary phase that the processing began in May 2015. However, this
date is not relevant for determining the university's
responsibility. It should be understood that the obligations whose
breach is alleged in this proceeding become enforceable from the entry into force of the
GDPR, and therefore, that is the
date from which both infringements are deemed to have been committed.
Now, regarding the duration of the infringement of Article 9.1 of the
GDPR, this allegation can be partially upheld, and it can be considered that the
UIV acted under the belief of an error based on the Principle of Legitimate Reliance
until it became aware of the opinion issued in the Legal Department's Report
No. 36/2020, which it included in its 2020 Data Protection Impact Assessment (DPIA),
and decided to ignore the Agency's opinion, despite knowing that it had already
ruled on these facial recognition systems
***PROGRAM.1 based on 1:1 authentication systems,
determining that these did process special category biometric data and expressly indicating the requirements that had to be
met to be considered necessary and
proportionate processing in the context of online university assessments.
However, legitimate expectations cannot be extended
to justify either the current situation—in which the UIV insists on continuing
to apply this program—or the processing that has been carried out
since the approval of the DPIA in September 2020.
In short, the duration of the infringement of Article 9 of the
GDPR, which was indicated in the initial agreement, should be rectified to understand that
although the infringement was completed and committed continuously
from the entry into force of the GDPR to the present, the UIV cannot be held liable
due to the lack of culpability
until September 2020, the date on which it is established that
it analyzed Report 36/2020 from the legal department of this Agency, and
continued processing special category biometric data,
deciding to take action against it.
However, the same does not apply to the infringement of Article 5.1.c) of the GDPR, for which the Principle of Legitimate Expectation referred to by the UIV cannot be invoked, as this Principle is not related to the issue of classifying the processing as special category personal data. Therefore, it is considered that this infringement was committed from the date the GDPR came into force, by continuing with processing that has been shown to be neither necessary nor proportionate, given the existence of other less intrusive alternatives that could have fulfilled the intended purpose of identification.
(i) Regarding the circumstance of “intentionality or negligence in the infringement,” the University denies its existence, arguing that, according to the recent judgment of the Court of Justice of the EU of December 5, 2023, non-compliance with the GDPR
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 107/225
can only be sanctioned in the case of intent or negligence.
The burden of proof for intent or negligence lies with the administration, a view shared by this Agency, which has initiated
these proceedings because it considers that there was serious negligence on the part of the University.
First, it should be noted that it is not true that there is no burden of proof regarding the University's negligent actions, since there is evidence that:
The UIV claims to have carried out all the appropriate assessments, but
the fact is that it has been established in the fifth finding of fact that
the processing involving facial recognition began with
the contracting of the initial version of ***APPLICATION.1 in
2015, and the first DPIA was in September 2020, more than
two years after the GDPR had come into force,
which also had to be supplemented by the updated
DPIA of July 2023, and the DPIA of January 2024, as some relevant aspects of the
processing were not included in the original one.
As also mentioned, the lack of
adequate information control measures and knowledge
of the processing itself has become evident, given that the UIV claims
to be unaware of which versions of the program it has contracted and since
when, providing multiple documents that contradict each other,
and acknowledging that it prepared the DPIA despite not having
the program's technical specifications.
In any case, the negligence is also evident in the failure to
adequately justify the
application of an exception under Article 9 of the GDPR, and in the failure to
conduct an adequate assessment of the necessity and
proportionality of the processing, even refusing to analyze
various processing alternatives that could be used to
evaluate online exams while controlling for fraud, which were
specified in the aforementioned Report 0036/2020, under the simple
excuse that they cannot be implemented in exams
that are 100% online.
Finally, as already mentioned, it is clear that the new obligations that became enforceable with the entry into force of the GDPR in May 2018 were not rigorously analyzed,
and an interpretative criterion dating from 2012 continued to be applied from September 2020, despite knowing that the Agency had already resolved this issue with respect to an equivalent system,
without considering the possible adaptation of its processing to the obligations arising from the processing of special category biometric data, nor submitting a prior consultation
to this Agency in case of doubt.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 108/225
However, in light of the new circumstances established
during the investigation, it is appropriate to modify the severity of the
penalty imposed by the initial decision, which set the initial penalty
considering that the UIV had acted with gross negligence
by processing, since 2017, the special category biometric personal data of its students (facial pattern) without having
an exception under Article 9.2 of the GDPR, as well as by having
implemented unnecessary and disproportionate processing that
violated the principle of Article 5.1.c) of the GDPR.
Following the investigation, it must be understood that the UIV acted culpably, although the severity of the sanction imposed may be modified when considering the circumstances of Article 83.2.b) of the GDPR, since:
(i) With regard to the degree of culpability under Article 9 of the GDPR, it is considered that negligent conduct cannot be attributed to the UIV until September 2020, due to the application of the aforementioned Principle of Legitimate Expectation.
(i) However, on the other hand, the classification of the
negligence that occurred from September
2020 onwards should be aggravated, considering it
to be very serious rather than merely serious, since it has been
proven that the UIV was aware that this
Agency had issued Report 0036/2020
regarding the facial recognition systems
used in the evaluation of online exams,
because it included it in its DPIA, but ignored the
conclusions regarding the legal nature of the
processing. It has also been proven that in the
2023 update of the DPIA, it was also
aware that the EDPB had already established its position
on this matter in EDPB Guidelines 05/2022
but persisted in maintaining an
interpretation contrary to it, as it continues
to do today. All of this without having
consulted this Agency beforehand.
(ii) And with regard to the degree of
contributory culpability concerning the infringement of
Article 5.1.c) of the GDPR, it is understood that negligent conduct can be imputed to the UIV from the
entry into force of the GDPR, although it must be
considered serious until September 2020, when
it became aware that Report 0036/2020 had
expressly indicated that processing
equivalent to its own could not be considered either necessary
or proportionate, thus rising to the level of negligence
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 109/225
very serious from then on, given that it was
aware of this criterion and continued with the
unnecessary and disproportionate processing.
On the other hand, the UIV points out that it has amply demonstrated its
due diligence in continuously verifying that the processing did not
jeopardize the rights and freedoms of the students. However, the
risk analysis attached to both DPIAs is considered incomplete and
biased, since it does not foresee all the risks that the
processing presents to the rights and freedoms of the students, but rather
focuses on successfully identifying and preventing
fraud.
(i) Regarding the connection between the infringer's activity
and the processing of personal data, the University's assertion that it
is reserved for companies whose corporate purpose and main activity
is the processing of personal data is incorrect. It is applicable
more broadly to all entities "whose activity is
linked to the processing of personal data," which
is undoubtedly the case for an international university dedicated to
teaching.
(ii) Finally, regarding the application of the circumstance relating to the categories of personal data affected by the infringement of Article 5.1(c) of the GDPR, the UIV maintains once again that the UIV does not process biometric data, which has already been ruled out based on the aforementioned grounds.
1.2. Response to the allegations of February 26, 2025.
On February 26, 2025, a new statement of allegations to the initiation agreement was submitted by B.B.B., acting on behalf of the UIV,
in which it is stated that, as a result of new facts, new allegations are being made requesting the dismissal of the case.
However, the allegations are not based on new facts, but rather on regulations and judgments issued in 2024, which the university considers to reinforce its arguments. In summary, the following is alleged:
First. – The Disciplinary Proceedings are based on a flawed premise: biometric data for authentication/verification do not constitute a special category of personal data under Article 9.1 of the GDPR.
The arguments made in the letter of May 21, 2024, are reiterated, namely, that this Agency has incorrectly interpreted Article 9 of the GDPR and recitals 51 and 91, which must be dismissed for the reasons already stated and confirmed by EDPB Guidelines 05/2022.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 110/225
As a new development, it is added that: “Given the contradiction between the provisions of
Article 9.1 and Recital 91 of the GDPR and Recital 51 of this
regulation, the latter recital cannot be given binding normative value,
as indicated by the case law of the CJEU. This is declared in the CJEU Judgment
of 22 January 2022, issued in Case C-165/2020, Air Berlin PLC & Co.
Luftverkehrs KG and Bundesrepublik Deutschland, which has made it clear
that the explanatory memoranda of Union acts do not have binding value, nor can they be invoked to interpret the normative provisions in a way contrary to their literal meaning:
“54. However, without it being necessary for the Court of Justice to examine the circumstances that led to the inclusion of that phrase in the preamble to Directive 2008/101, it must be pointed out that that preamble contradicts the wording of Article 3 sexies, paragraphs 4 and 5, of Directive 2003/87, which highlights the indispensable link between, on the one hand, the allocation and issuance of aviation emission allowances and, on the other, the actual exercise of the aviation activities listed in Annex I to that Directive.
Although it is true that the CJEU's case law has attributed to the recitals of European directives and regulations a non-binding normative value, comparable to that of preambles, the claim cannot be upheld, since:
The Judgment of 22 January 2024 is based on a different set of facts, in which a recital It directly contradicted an
article contained in the Directive that regulates the EU Emissions Trading System and amends it to include
aviation activities (Directives 2003/87/EC and 2008/101/EC). This is not the case
in the present instance, where there is no contradiction whatsoever between
recitals 51 and 91 and Article 9 of the GDPR, as has been pointed out
above.
Furthermore, in this proceeding, the infringement is not being alleged of
an obligation set out in a recital, but rather of its articles
or substantive provisions (Article 9 of the GDPR in this case), which state
that the processing of biometric data aimed at the unique identification of individuals is considered special category processing, which is
interpreted in accordance with the recitals, which serve
as a source for interpreting the law.
Thus, in accordance with the case law of the Court of Justice,
the explanatory memorandum of an EU act is not legally binding
and cannot be invoked either to establish exceptions to the
provisions of the act in question or to interpret them
in a way that is manifestly contrary to their wording [see, in particular, the
judgments of 19 June 2014, Karen Millen Fashions, C-345/13,
EU:C:2014:2013, paragraph 31, and of 25 November 2020, Istituto nazionale
della previdenza sociale (Family benefits for long-term residents
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 111/225
) C-303/19,
EU:C:2020:958, paragraph 26], Therefore, in the case
invoked by the University, it was considered that the operator could not rely on
recital 20, fourth sentence, of Directive 2008/101 in order to
claim aviation emission rights because it contradicted
the provisions of Article 3 sexies, paragraphs 4 and 5, of
Directive 2003/87.
However, although the recitals of Community legal acts are not
legally binding, they can have significant value as a
source of legal interpretation to determine, in the words of the Spanish Civil Code,
the "spirit and purpose" of the rule.
A recent example is found in the Judgment of 22 December 2022
(Case C-61/21, JP v. Minister for Ecological Transition, Premier Ministre), in which
the Court of Justice declared that individuals cannot
claim compensation for damages arising from
air pollution constituting a breach by the State of
the Air Quality Directive. This is because, the Judgment states,
the first requirement is not met, namely, that the rule of EU law must have the purpose of conferring rights on individuals, given that there is no
express or implied attribution in the provisions of the Directive,
since, "as is clear from its recitals," the obligations it imposes
"pursue a general objective of protecting human health and the environment in general."
Second. – The Artificial Intelligence Regulation (RIA) and Directive
2024/2831 confirm that biometric data for
authentication/verification do not constitute a special category of
personal data.
In addition to reiterating everything stated above regarding the RIA regulation,
it is added as a new point that the new Directive 2024/2381 of 23 October,
on improving working conditions in platform work (hereinafter, “Directive 2024/2831”), clearly distinguishes in its
recital 41 between “biometric data for identification purposes” and
“biometric data for the purpose of verifying the identity of the person”, and
prohibits, according to the university, only the processing of the former.
Specifically, Recital 41 of Directive 2024/2831 states that:
“Digital work platforms should not process the biometric data of individuals working on platforms for identification purposes, namely, by determining the identity of the individual by comparing their biometric data with the stored biometric data of a number of individuals in a database (multiple-match identification). This does not affect the possibility for digital work platforms to carry out biometric verification, namely, to verify the identity of an individual by comparing their biometric data with data previously provided by that individual (unique verification or authentication), where such processing of personal data is lawful under Regulation (EU) 2016/679 or other
relevant provisions of Union law and national law.
“ (Emphasis added)
In connection with the above, the university also considers that Article 7.1.f)
of Directive 2024/2831 only limits the processing of biometric data
for identification purposes, not biometric data for verification purposes: “1. Digital work platforms may not, by means of
automated tracking systems or automated decision-making systems: […]
However, this argument must again be rejected because:
o The subjective scope of application of this Directive differs from that which
is being analyzed in the sanctioning procedure.
o Both Recital 41 and Article 7 refer to the GDPR. It is
this latter regulation that, ultimately, must be taken into account
for any processing of personal data and, more specifically,
for the processing of biometric data.
From all of the above, it follows that the allegations made
by the UIV must be dismissed, confirming the existence of the two infractions alleged in
the present proceedings, without prejudice to the pertinent modifications that
must be made when determining the sanction to be imposed, in accordance with what has been
set forth.
V. Response to the allegations made against the Proposed Resolution.
On April 1, 2025, UIV submitted a written statement of allegations against the
Proposed Resolution of the file, which consists of 88 pages organized
into the following allegations (preliminary issue, preliminary allegation, and allegations
first through sixth) as reflected in the eighteenth factual background:
"PRELIMINARY ISSUE: The Proposed Resolution violates the fundamental rights of VIU: violation of the principle of retroactive application of the most favorable law and the principle of double jeopardy.
"PRELIMINARY ALLEGATION – Summary of the controversy raised.
" FIRST ALLEGATION: The Proposed Resolution is based on an erroneous premise: biometric data for authentication/verification (1:1) does not constitute a special category of personal data under Article 9.1 of the GDPR. The conduct attributed to VIU is not a crime.
SECOND ALLEGATION: The Proposed Resolution violates the principle of double jeopardy, established in Article 39.5 of the LRJSP, since it imputes the commission of two infringements for the same facts.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 113/225
THIRD ALLEGATION: Article 9 of the GDPR has not been violated: the consent given by the students is freely given and the processing is necessary for reasons of substantial public interest.
FOURTH ALLEGATION. Article 5.1.c) of the GDPR has not been violated: the processing is necessary and proportionate.
FIFTH ALLEGATION: The Proposed Resolution violates the principle of culpability: given the interpretative doubts arising from the GDPR, a sanction cannot be imposed.
SIXTH ALLEGATION: Incorrect application of the criteria for determining the severity of sanctions.
The statement of allegations against the proposed resolution of the proceedings is accompanied by three documents:
Document 1. Report from the National Cryptographic Center of December 2024
on Secure Biometric Technologies for Access Control.
Document 2. Resolution of sanctioning procedure no. PS 41/2022,
concerning the Foundation for the Open University of Catalonia (hereinafter
FUOC), of the Catalan Data Protection Authority.
Document 3. TESLA Report “D5.3 – Instruments technical description and development scheduling” dated July 29, 2016. In English, without an accompanying Spanish translation.
It should be noted that within each of the allegations, the UIV raises arguments that are then progressively expanded upon in subsequent allegations, throughout the entire document, reiterating the same idea several times and adding further details.
Therefore, for greater clarity and in strict compliance with the duty to provide justification for decisions, the response to these questions should be structured by grouping all the allegations made for each argument.
Therefore, for the purposes of clarification, the allegations made and evidence submitted in this proceeding are grouped around the following five central legal issues raised by VIU:
1. Preliminary Issues:
The Proposed Resolution violates VIU's fundamental rights:
violation of the principle of retroactive application of the most favorable law and the principle of double jeopardy. These issues, contained primarily in the PRELIMINARY ISSUE and SECOND ALLEGATION, are reiterated throughout this document.
or Summary of the controversy and proven facts. In the PRELIMINARY ALLEGATION.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 114/225
1. Regarding the legal nature of the processing carried out by the UIV: it is denied that its
program processes special category biometric data under Article 9 of the GDPR.
Contained mainly in the PRELIMINARY QUESTION, PRELIMINARY ALLEGATION, and FIRST ALLEGATION (6 arguments plus conclusions), although
references to it are found throughout the document.
The bulk of its content is found in the FIRST ALLEGATION,
entitled “The Proposed Resolution is based on an erroneous premise:
biometric data for authentication/verification (1:1) does not constitute a
special category of personal data under Article 9.1 of the GDPR. The
conduct attributed to VIU is not a crime.”
This is the central issue around which all the allegations to the
proposed resolution revolve. In these allegations, the UIV expands upon the arguments presented
on this matter in the allegations to the initial agreement, in which
the UIV expresses its disagreement with the criteria of the EDPB and this Agency, and
argues that biometric systems based on
identity authentication through 1:1 comparisons should be interpreted as not being included in the
concept of Article 9 of the GDPR, and therefore not being special category data.
2. Regarding the applicability of an exception under Article 9.2 that would allow the processing of special categories of data.
Contained in the THIRD ALLEGATION: Article 9 of the
GDPR has not been violated: the consent given by the students is freely given and the processing is
necessary for reasons of substantial public interest.
To avoid unnecessary repetition, this allegation will be addressed
in Legal Basis VI, concerning the breach of
Article 9 of the GDPR, and will be joined with the response to the allegations made
previously against the initial agreement.
3. Allegations regarding the breach of Article 5.1.c) of the GDPR, because the
processing of biometric data is neither necessary nor proportionate to fulfill the
purpose of the processing.
Contained in the FOURTH ALLEGATION: Article 5.1.c) of the
GDPR has not been violated: the processing is necessary and proportionate.
For the same reasons stated in the previous section, this allegation will be
addressed in Legal Basis VII, concerning the
breach of Article 5.1.c) of the GDPR, joining the response to the
allegations previously made against the initiation agreement.
4. Allegations regarding the application of the Principle of Culpability.
Grouped under allegation FIFTH. The Proposed Resolution
violates the principle of culpability: given the interpretative doubts arising
from the GDPR, a sanction cannot be imposed.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 115/225
5. Allegations against the Legal Basis regarding the severity of the sanction.
Grouped under allegation SIXTH. Incorrect application of the criteria for
determining the sanctions.
5.1. Response to the preliminary issues raised.
In this section, the following allegations are addressed:
The Proposed Resolution violates VIU's fundamental rights:
violation of the principle of retroactive application of the most favorable law and the
principle of double jeopardy.
Summary of the controversy and proven facts. In the PRELIMINARY ALLEGATION.
5.1.1. Regarding the violation of the Principle of Retroactive Application of the Most Favorable Law.
VIU introduces this ground in its preliminary question as follows: “Existence of new facts that lead to the dismissal of the Disciplinary Proceedings: the RIA and Directive 2024/2831 stipulate that biometric data for authentication/verification (1:1) do not constitute a special category of personal data. Retroactive application of the most favorable law.” And subsequently, it makes constant references to the application of these more favorable rules in its first allegation and throughout the entire document, all of which will be addressed in this section.
First, it should be clarified that, although the UIV repeatedly states that these allegations are based on new facts, it must be noted that no new facts have occurred in relation to the alleged infractions in this case file. Rather, the party is referring to Directives, judgments, and reports issued during 2024 that the university considers to reinforce its arguments.
Furthermore, it should be noted that the UIV had already referred to most of these in its previous submissions: (i) the RIA referred to the initial agreement in its first allegations, which were dismissed in Legal Basis III of the Proposal; and (ii) to Directive 2024/2381 of 23 October, on improving working conditions in platform work, in its last submission of 26 February 2025, which was submitted before the Draft Resolution was adopted, and whose arguments were dismissed in section 4.2 of Legal Basis IV of the Draft.
Despite the alleged violation of the
Principle of applying subsequent, more favorable regulations, as provided for in the Artificial Intelligence Regulation (RIA) and Directive 2024/2831 on digital work platforms, being expressly alleged for the first time, this had already been implicitly alleged in previous submissions, by referring to the fact that both regulations were adopted after the GDPR and determined that biometric identity verification systems could be excluded from the concept of special category biometric data.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 116/225
This was already rejected with justification by the Proposed Resolution.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 116/225 In its submissions against the Proposal, VIU reiterates the argument contained in its previous submissions, stating that the Agency operates on an erroneous premise by considering that biometric systems based on 1:1 authentication process special category biometric data included in Article 9 of the GDPR, since this has changed with the approval of the RIA and Directive 2024/2831. VIU points out that:
“As will be explained later, the RIA and Directive 2024/2831 stipulate that ‘biometric verification’ systems do not constitute a special category of personal data, as they are not high-risk systems.
Therefore, the conduct attributed to VIU is not a crime and cannot be sanctioned, since my client has not processed any special category of personal data.”
This argument should be dismissed, primarily because neither the RIA nor the aforementioned Directive has The concept of personal data processing has not changed.
Biometrics of special categories under Article 9 of the GDPR have not changed, nor has the concept of high-risk processing contained in Article 35 of the GDPR changed.
It should also be noted that this regulation, and the respondent's own arguments, refer to the systems that may be established in application of it, a matter distinct from the processing of personal data that may be carried out through the implemented systems covered by these regulations and which, in any case, must comply with the requirements of the GDPR and the interpretation criteria adopted by the Spanish Data Protection Agency (AEPD) as the supervisory authority.
The proposed resolution already indicated the reasons why it is understood that the concepts applicable to biometric artificial intelligence systems and to digital work platforms containing automated systems for biometric verification of workers do not exclude or modify the application of the GDPR at present. Therefore, we refer to the reasons set forth in the Proposed Resolution and in Legal Basis IV of this Resolution.
Regarding the allegations against the Proposed Resolution concerning the application of the RIA, the following should be noted:
The exposition of the legal framework contained in the new RIA, which is presented in the allegations, coincides, basically except for the legal assessments made by the UIV, with what was stated in the Proposed Resolution.
It is true that in the new regulatory context in which we find ourselves, the RIA has opened the door for certain AI systems to be used, even in the context of education and vocational training, provided that the requirements established therein are met. These requirements do not, under any circumstances, exclude the requirements that must be met when the use of these AI systems involves the processing of personal data. In other words, the
use of AI systems may be possible, but respecting the provisions of the following:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 117/225
regulatory provisions, specifically, in the case at hand, the GDPR if
these AI systems process personal data.
It is not denied that the RIA applies to artificial intelligence systems, which are
defined in Article 3, and for which the Regulation itself constitutes
sectoral or specific regulations aimed at governing their risks, requirements,
limitations, obligations, and prohibitions for those defined as responsible
for them. And it distinguishes, as the respondent points out, between:
(i) biometric verification and
biometric identification in the definitions contained in Article
3;
(ii) and between general-purpose AI systems and high-risk AI systems in
Article 6;
(iii) it establishes that AI systems will be prohibited;
(iv) and it imposes
a series of requirements and limitations that high-risk AI systems must meet, among which biometric verification systems are not included,
since it is true that Annex III, paragraph 1(a), excludes from the definition of
high risk “AI remote biometric identification systems intended
to be used for biometric verification purposes whose sole purpose is
to confirm that a specific natural person is the person they claim to be.”
However, although AI-powered remote biometric identification systems
intended for biometric verification are not considered high-risk according to
Annex III.1.a) of the RIA, it is necessary to clarify that the following are considered high-risk
in the field of education and training according to Annex III.3.d): “d) AI systems
intended to be used for monitoring and detecting
prohibited behavior by students during examinations
in the context of educational and vocational training establishments or within
these at all levels.”
Therefore, it can be said that, although the system used by the UIV is not an AI-powered remote biometric identification system according to Annex
III.1.a), it would be considered high-risk by the RIA because it would fall
within the scope of Annex 3.d), since the UIV itself acknowledges that it
uses AI to detect anomalous student behavior in order to
prevent plagiarism and cheating in examinations.
In short, this argument can be dismissed, since, although it is true that
certain AI systems that hypothetically employ “AI systems
intended to be used for biometric verification purposes whose sole
purpose is to confirm that a specific natural person is the person they
claim to be” would not be considered high-risk under the RIA, this would not apply to the
present case, since:
In this case, the software ***APPLICATION.1 used by the UIV as a
method for evaluating its students employs an AI system
considered high-risk by Annex III.3.d) of the RIA, which implies
that it should comply with the requirements established for these high-risk systems
therein, which are indicated in section 2 of Chapter 1, as well
as in articles 102 to 109 and article 112, and part of article 57
of the RIA, when they fully enter into force.
Similarly, the UIV is responsible for the processing of biometric personal data
which is carried out through the software used as an assessment method.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 118/225
Therefore, it must also comply with the requirements
established by the GDPR for the processing of special categories of personal data
as defined in Article 9 of the GDPR, and for processing
considered high-risk as defined in Article 35, as well as all the
Principles and other obligations established therein, such as
Principle 5.1.c) of the GDPR.
On the other hand, the assertion that the RIA has
modified the concept of special categories of data contained in Article 9
of the GDPR cannot be accepted, since its scope is limited to the
artificial intelligence systems defined in Article 3 of the RIA. These may be related to a specific processing of personal data, but this is not always the case (there are AI systems that do not process personal data). Both regulations, GDPR and RIA, have different scopes of application and coexist in parallel, without one modifying the other.
This is made clear in Article 2.7 of the RIA, and its Recitals 39 and 63, without any "antinomy" that makes both regimes incompatible, as the university points out; rather, each has its own scope of application.
Recital 39 of the RIA expressly states that the prohibitions on the processing of special categories of biometric data contained in Article 9 of the GDPR remain applicable: “All processing of biometric data and other personal data associated with the use of AI systems for biometric identification, except for that associated with the use of real-time remote biometric identification systems in publicly accessible spaces for the purpose of ensuring compliance with the law regulated by this Regulation, must continue to comply with all the requirements arising from Article 10 of Directive (EU) 2016/680. Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725 prohibit the processing of biometric data for purposes other than ensuring compliance with the law, with the limited exceptions provided for in those Articles. In the application of Article 9(1) of the Regulation (EU) 2016/679, the use of remote biometric identification for purposes other than ensuring compliance with the law has already been subject to prohibition decisions by national data protection authorities.
On the other hand, Article 2.7 of the RIA states that both sets of regulations must coexist and apply independently, expressly stating that: “Union law on the protection of personal data, privacy and the confidentiality of communications shall apply to personal data processed in relation to the rights and obligations laid down in this Regulation. This Regulation shall not affect Regulations (EU) 2016/679 or (EU) 2018/1725 or Directives 2002/58/EC or (EU) 2016/680, without prejudice to Article 10(5) and Article 59 of this Regulation.”
It should be clarified that the UIV's argument is based on several
erroneous premises:
(i) The assumption that the concepts of "biometric system" and
"processing of biometric personal data" are equivalent. According to
the UIV, since its program uses an AI biometric system that is not
considered high-risk under the sector-specific regulations governing
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 119/225
artificial intelligence systems (RIA), it understands that the processing of
biometric personal data carried out is not high-risk.
This was already rejected by the Proposed Resolution, given that
a single processing operation can involve several processing operations that
are executed through various systems, as may be the case with
an AI system, which must comply with the requirements stipulated by their
sector-specific regulations (as in the case of the RIA). But this obligation will be in addition to
that of the data controller as a whole, which is regulated by the GDPR.
(ii) The UIV goes further, and considers that, since the AI system used by its
software ***APPLICATION.1 is not high-risk according to the RIA, the personal data processed
by the UIV are not special category data, an argument that cannot be accepted by
confusing the concept of high-risk processing contained in Article 35.4 of the
GDPR with the concept of special category data in Article 9 of the GDPR.
This difference has been detailed in detail since Legal Basis II of the initiation agreement.
(iii) And finally, despite claiming that biometric remote identity verification systems using AI are excluded from the scope of the RIA,
it also seeks to have its regime applied to it, arguing that the RIA has
modified the GDPR, requesting that it be applied in this sanctioning procedure
as a more favorable standard, which is a contradiction in itself.
Thus, on page 22 of its submission, it states: “In connection with these
provisions, paragraphs 35 and 36 of Article 3 of the RIA establish a
separate definition of “biometric identification,” which is included
within its scope and constitutes a special category of
personal data; and of “biometric verification,” which is excluded from
its scope and does not constitute a special category of
personal data.”
The issue raised by the university (understanding that this
new classification in the RIA affects the concept of special category biometric data
as defined in Article 9 of the GDPR) is already resolved by
Recital 63 in fine of the RIA, which expressly states that: “The fact
that an AI system is classified as a high-risk AI system under
this Regulation should not be interpreted as indicating that its use
is lawful under other acts of Union law or national law
compatible with Union law, for example, in the area of the protection of
personal data or the use of polygraphs and similar tools or other
systems to detect the emotional state of natural persons. Any such use must continue to be carried out exclusively in accordance with the appropriate
requirements arising from the Charter and applicable acts of Union
and national law. This Regulation should not be construed as
providing a legal basis for the processing of personal data, including
special categories of personal data, in its in this case, unless this
Regulation specifically provides otherwise.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 120/225
Therefore, the fact that the RIA has not classified as high risk
the artificial intelligence systems used to verify the identity of
individuals based on 1:1 authentication processes, does not imply that the
processing of personal data carried out through them is not
considered high risk. Because the processing of personal data
carried out in this case comprises various processing operations
that can be carried out by different
technological systems—whose requirements are regulated by their specific sectoral regulations,
as is the case with the AI systems regulated in the RIA. Therefore,
as the Proposal pointed out, the requirements for the processing
of personal data carried out by the data controller are one thing, and the requirements
established for each system used in sector-specific regulations are another. These latter requirements are
additional to, but not mutually exclusive of, the former.
Furthermore, it should be noted that the university has not
demonstrated that the facial recognition system developed by
APPLICATION.1 uses artificial intelligence to perform the process of
uniquely verifying the identity of students (the processing to which
this file refers), since the only thing on record in the
file is the use of said artificial intelligence to detect
anomalous behavior related to exam fraud/plagiarism (which
falls under the high-risk concept of Annex III.3.d) of the RIA, as we have
stated). However, even if AI were used in facial recognition, which, as we have indicated, could be acceptable,
the requirements established by the RIA for its use would always be
additional to those established by the GDPR for processing special category biometric data. This is without prejudice to the fact that the aforementioned RIA entered into force
after the facial recognition system under analysis in this case was implemented.
Therefore, it is also understood that the fact that the
Guide on AI practices prohibited by the RIA of 4 February 2025 establishes that biometric verification systems are
excluded from the prohibition provided for in Article 5.1.h) of the RIA is
entirely independent and does not affect in any way the fact that their
use involves the processing of special category biometric data
under Article 9 of the GDPR.
Furthermore, regarding the application of Directive 2024/2831 on improving working conditions in platform work (hereinafter, the “Directive 2024/2831/Digital Platforms for Work Directive”), it is worth confirming the reasons why the Proposed Resolution indicated (Legal Basis 4.2) that this Directive was neither applicable to the present case nor did it preclude compliance with the obligations contained in the GDPR.
In its further submissions, the UIV appeals to the application of recital 41, which distinguishes between biometric data for identification purposes and biometric data for identity verification purposes and prohibits only the former. and to Article 7-1-f), which
provides for this prohibition, but does not offer convincing arguments, given that:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 121/225
Firstly, the aforementioned Directive is not applicable to the present case,
which refers to the processing consisting of verifying the identity of
enrolled students participating in university exams
during their administration, since the scope of the Directive is limited
to the obligations and requirements that must be met by natural or legal persons
providing “digital work platform” services (and
intermediaries) defined in Article 2.1.a) thereof, as:
“services provided partly remotely via a web service or app,
requested by a recipient, involving the organization of work
performed by natural persons in exchange for financial consideration,
and the use of automated systems of monitoring or automated decision-making systems.” This is not the case we are dealing with.
Furthermore, it should be noted that this is a Directive whose obligations are not directly enforceable on these data controllers—and therefore cannot be applied to the processing of biometric data of workers on these platforms—until it is transposed by the Member States, which must be done no later than December 2, 2026, in accordance with Article 29.
On the other hand, it should be clarified that Article 7.1.f) of this regulation provides, in addition to an express limitation/prohibition on the automated systems contained in these platforms processing biometric data of workers providing services on them when they are based on biometric identification systems, but expressly states that biometric verification systems must comply with the requirements of the GDPR. The issue could not be clearer:
“Article 7 Directive: Restrictions on the processing of personal data
by means of automated tracking systems or automated decision-making systems
1. Digital work platforms may not, by means of automated tracking systems or automated decision-making systems:
(f) process biometric data, as defined in Article 4, point 14, of Regulation (EU) 2016/679, of a person working on platforms to establish their identity by comparing their data
with the biometric data of natural persons stored in a database.”
And this same idea is contained in Recital 41 of the Directive:
(41) Digital work platforms should not process the biometric data
of individuals working on platforms for the purpose of
identification, namely, by determining the identity of the individual by
comparing their biometric data with the stored biometric data of
a series of individuals listed in a database (identification
by multiple matching). This does not affect the possibility that
digital work platforms may carry out biometric verification, namely,
verify a person's identity by comparing their biometric data
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 122/225
with data previously provided by that same
person (unique verification or authentication), when such processing of
personal data is lawful under Regulation (EU) 2016/679 or
other relevant provisions of Union and national law.”
Therefore, this Directive on digital work platforms issued in 2024 has not modified the concept of special category data contained in Article 9 of the GDPR, which remains in force and includes both authentication-verification processing (1.1) and identification processing (1.N), nor the requirements that are generally applicable to the processing of personal biometric data.
This Directive does not repeal or replace the GDPR, but rather
complements it and makes continuous references to it to remind users that
its obligations and limitations must be met when processing personal data
through these platforms.
Among others, and in addition to the aforementioned Recital 41, Article 8 of the Directive
and Recital 43 of the same, also establish that digital work platforms
must always carry out an Impact Assessment of
all personal data processing that complies with the requirements
established by the GDPR. There are also numerous references to “In addition to the
requirements set out in Regulation (EU) 2016/679, digital work platforms
must…” (Article 9 on transparency, Article 11 on human review, Article 12 on security…as well as several Recitals
such as 44, 48, 49…etc).
Consequently, we find that both regulations (RIA and Digital Platforms Directive) have a different scope of application than the present case, and
complement the GDPR, adding new obligations for those responsible for these
services or systems, in addition to the obligations established by the GDPR for the
processing of special category biometric personal data. They do not replace,
nor have they repealed, the concepts of high-risk processing and special category personal data contained in Articles 35.4 and 9 of the GDPR, and therefore
this claim is considered entirely unfounded.
Related to the above, the UIV raises the violation of the Principle of retroactive application of the most favorable law under Article 25 of the Spanish Constitution, and Article 26.2 of Law 40/2015, of October 1, on the “LRJSP”, because this Agency has not applied to the present sanctioning procedure the most favorable rule contained in the RIA, according to which the UIV's conduct would be atypical. And it mentions several rulings of the Constitutional Court and the Supreme Court regarding "retroactivity in bonus" and international law norms on page 25.
This Agency understands that it is possible to apply the most favorable sanctioning norm in accordance with this legislation and doctrine, but precisely in accordance with it, it understands that in this case the requirements for its application are not met, since:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 123/225
Firstly, the university simplifies to one the three reasons why the Proposal rejected the application of the RIA to this case, by making the following reference: "Incomprehensibly, the Proposed Resolution, on its page 101, decides not to apply the previous Community regulations, alleging that the distinction between biometric identification systems and biometric verification systems established in the RIA "will not be applicable until the 2nd February 2025.”
The university has focused on dismissing only one of the three reasons why the application of the concepts contained in the RIA and Directive 2024/2831 to this case was rejected, namely that both regulations had not yet entered into force when the alleged infringements were committed. However, the Proposal rejected this argument primarily for the reasons reiterated above. The gradual entry into force of the RIA is an additional reason.
They are referring to the mention on page 101 of the Proposal, which states that the distinction between general-purpose and high-risk AI systems contained in the RIA would not be applicable until that date, but not, as the UIV seems to suggest, that this distinction is applicable to the processing of personal data in the present case: “This distinction did not enter into force until February 2, 2025,
given that Article 113 of the RIA provides for a phased implementation of its
provisions, stipulating that the chapter in which this differentiation is defined
will not be applicable until February 2, 2025: “Chapters I and II will be applicable from February 2, 2025.” Therefore,
in any case, it would not be applicable to the treatment carried out by the UIV prior to that date.”
Or, in response to the UIV's claim, it should be noted that the possibility
of applying a more favorable subsequent rule derives from the application of the
Principle of Non-Retroactivity of unfavorable or restrictive sanctioning provisions concerning individual rights, as provided for in the following provisions of the
Spanish Constitution:
Article 9.3 of the Spanish Constitution: “The Constitution guarantees the principle of legality, the
hierarchy of norms, the publication of norms, the non-retroactivity of
unfavorable or restrictive sanctioning provisions concerning individual rights,
legal certainty, accountability, and the prohibition of
arbitrariness by public authorities.”
Article 25.1 of the Spanish Constitution: “1. No one may be convicted or sanctioned for
actions or omissions that, at the time they occurred, did not constitute
a crime, misdemeanor, or administrative offense, according to the legislation in force at that
time.”
In administrative sanctions law, this Principle has been codified
in Article 26 of the LRJSP (Law on the Legal Regime of the Public Sector), whose second paragraph establishes the
cases in which it will be possible to apply a more
favorable subsequent regulation, stating that:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 124/225
“Article 26. Non-retroactivity.
1. The sanctioning provisions in force at the
time the acts constituting an administrative offense occurred shall apply.
2. Sanctioning provisions shall have retroactive effect insofar as they are more favorable to the alleged or actual offender, both with regard to the classification of the infringement and the sanction and its limitation periods,
even with respect to sanctions pending compliance when the new provision enters into force.
It follows from the aforementioned provision that, in order for a rule
different from the one in force at the time the infringement was committed to be applicable,
there must be a sanctioning provision subsequent to the GDPR that provides for
a classification, sanction, or limitation period more favorable than that
provided for in the GDPR infringements alleged in these
proceedings (classified in Article 83.5 of the GDPR, for breaching
the obligations applicable to the controller of personal data processing
as provided for in Articles 9 and 5.1.c) of the GDPR). That is,
it is necessary that a regulatory change has occurred in a
of the same or higher rank that modifies the previous regulation that was
in force when the events occurred, establishing a classification,
sanction, and/or statute of limitations more favorable to the offender than that contained in
the previous regulation.
What the UIV intends is for it to be understood that the RIA approved in 2023
(which did not partially enter into force until 2-2-25) and Directive
2024/2831 have modified the previous regulations that were in force when
the processing began, by changing the concept of personal biometric data
contained in the GDPR. That is, they appeal to the existence of two
subsequent, more favorable regulations that would no longer classify this non-compliance as an infringement,
according to their view, and therefore, they believe that their conduct
should be considered "atypical" because it does not violate any of the
obligations provided for in the regulations.
However, this allegation cannot be admitted, since in the
present case there has been no subsequent, more favorable regulation. Since
neither the RIA nor Directive 2024/2831 have brought about a regulatory change
to the concept of special category biometric data in Article 9 of the
GDPR -nor to the Principle contained in Article 5.1.c) of the GDPR which requires
that the processing of personal data be necessary, suitable and
proportionate- the classification, penalty and limitation period
provided for by the GDPR for both infringing behaviors remains intact.
Because, as explained: (i) neither of these two regulations is
applicable to the processing of biometric personal data carried out by
the program contracted by the UIV to verify the identity of students
participating in its online exams; (ii) nor have they modified the scenario of
the infringing act classified in the alleged infringements, since
the general regime of the GDPR applicable to the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 125/225
Processing of special category biometric personal data, and
high-risk processing, for the reasons stated above.
In short, the principle of retroactive application of a more favorable provision cannot be applied because there has been no
regulatory change to the concept of special category biometric data
contained in Article 9 of the GDPR, nor to the principle of data minimization
enshrined in Article 5.1(c) of the GDPR, which requires that
processing be necessary and proportionate. These principles remain
in force without variation since their entry into force and apply to the present case.
Neither the RIA nor Directive 2024/2831 can be considered
as a subsequent, more favorable regulation in the sense expressed by
Articles 9 and 25 of the EC and 26.2 of the LPRJSP.
Since the requirements for applying a more favorable subsequent sanctioning rule are not met in this case, the rule "tempus regit actum" applies, "according to which each legal relationship is governed by the rules in force at the time of its creation" (Supreme Court Judgment of June 3, 1995), as referred to in Article 26.1 of the LRJSP, which is the rule that has been applied and described on page 101 of the Proposal, and
it is considered that the UIV has committed the two infringements defined in the GDPR that are alleged in these proceedings.
5.1.1. Regarding the alleged "Violation of the ne bis in idem principle: two infringements are alleged for the same facts."
Secondly, the UIV argues in its preliminary question and elaborates in its second allegation (and makes references throughout its text) that this Agency is violating the principle of double jeopardy by imputing two infringements for the same conduct, which, according to the UIV, is "the use of the software ***APPLICATION.1 in the
taking of exams by students." This allegation must also be dismissed for the following reasons:
Firstly, because the infringing conduct is not the one indicated by the UIV, which states: "The conduct imputed to my client,
according to the Proposed Resolution, is the use of the software ***APPLICATION.1
in the taking of exams by students. However, despite being a single act, the Proposed Resolution attempts to impose two different infringements on my client, both classified under Article 83.5 of the GDPR: the violation of Article 9 of the GDPR and the
violation of Article 5.1.c) of the GDPR.”
This assertion is entirely unfounded, since both the initial agreement,
the proposal, and this resolution clearly identify
the alleged infringing conduct, and it is not true that there is
a single alleged act, nor that it is “the use of the software
***APPLICATION.1 in the administration of exams by students.”
Since this was not mentioned in any section of the Proposal, it is
a biased statement of the proven facts that did not in any way qualify
the infringing conduct, but rather described the processing carried out.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 126/225
The UIV, once again, confuses concepts: the description of the
processing, and the obligations required of the data controller
of said processing, the breach of which is imputed as an infringement. This
phrase, in any case, would be the description of the processing carried out
(although it does not exactly correspond to the description made
in the Proposal when analyzing this issue) but not the infringing conduct.
In this case, as the university later points out on page 38, two administrative infringements have been charged, as defined in Article 83.5(a) and (e) of the GDPR, because two infringing actions have occurred
stemming from the breach of two different obligations (those
set forth in Article 9 and Article 5.1(c) of the GDPR) regarding the same
processing of special category biometric personal data carried out
by the university, which is the use of facial recognition software ***APPLICATION.1
as a method of identifying students
participating in the university's online exams.
That is, what has happened is that two obligations have been breached
that were required of the data controller regarding the same processing of personal data
but the specific conduct described is that which is clearly established
in Legal Basis VII of the Proposal, which has its
correspondence in Legal Basis VIII of this Resolution, namely:
1. Processing special category biometric personal data
without having one of the exceptions in Article 9.2 of the GDPR that would have allowed it to do so. This is defined in Article 83.5(e) of the GDPR.
2. Having carried out processing of biometric personal data
that is neither necessary nor proportionate to fulfill the purpose of the
processing, as defined in Article 83.5.a) of the GDPR, by
violating the principle of data minimization contained in Article
5.1.c), which stipulates that the data processed must be “adequate,
relevant and limited to what is necessary in relation to the purposes for which they are processed.”
The UIV appeals to the doctrine of the Constitutional Court, without this Agency denying that
the principle of double jeopardy is applicable to the sanctioning power, but in this case, there is no such violation nor is there a
conflict of rules or laws as the UIV claims. Furthermore, we are not even dealing with a case of multiple offenses, so the rule set forth in Article 29.5 of the LRJSP, which applies to cases of multiple offenses, is not applicable.
And indeed, there is no violation of the principle of non bis in idem in this case,
since we are dealing with a case of multiple
infringing conduct (“multiple sanctionable conduct” in the words of the
EDPB), given that two provisions containing
different obligations for this type of processing in the
GDPR have been breached, which are categorized as separate infringements and must be sanctioned
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 127/225
independently, in accordance with what the EDPB indicates in its
Guidelines 04/22 on criteria for calculating fines (Guide to Fines):
3.2 — Multiple sanctionable conduct
44. The principle of multiple actions (also called
“Realkonkurrenz”, “factual concurrence” or “coincidental concurrence”)
describes all non-concurrent cases included in the principles of concurrence of offenses (Chapter 3.1.1) or Article 83(3) of the GDPR (Chapter 3.1.2).
45. The only reason these infringements are addressed in one decision
is because they came to the attention of the supervisory authority at the same time
without being the same or linked processing operations within the meaning of
Article 83(3) of the GDPR. Therefore, the infringer is deemed to have
infringed several legal provisions, and separate fines are imposed
in accordance with the national procedure, either in the same fine decision or in
separate fine decisions. Furthermore, since Article
83(3) of the GDPR does not apply, the total amount of the administrative fine may
exceed the amount specified for the most serious infringement (argumentum e contrario).
Cases involving multiple actions do not provide any reason
to favor the infringer with regard to the calculation of the fines. However, this is understood without prejudice to the obligation to continue respecting the general principle of proportionality. (...)
The UIV cites judgments that declare the infringement of this Principle when the administration has exercised sanctioning powers, which do not refer to "cases analogous to the present one," as it itself points out:
Thus, Judgment No. 1146/2023 of the Supreme Court of September 18 (Cassation Appeal 5223/2021) analyzed the conflict of laws between two provisions of the General Tax Law, but did not analyze the provisions alleged in this proceeding.
The Judgment of the Administrative Chamber of the National Court of September 3, 2007, issued in Appeal No. 85/2006 (JUR\2007\276044), in which The ruling was against this Agency for
violation of the ne bis in idem principle, which refers to infringements different
from those charged (for having communicated personal data and
considering that this constituted both an unjustified transfer and without
consent according to the UIV itself), and in a regulatory situation
in which the GDPR was not in force.
And with respect to the Resolution issued by the Catalan Data Protection Authority (hereinafter APDCAT), which is attached as document 2, issued in a
sanctioning procedure against the Foundation for the Open University of Catalonia for the use of a facial recognition system for conducting
distance examinations, for infringement of Article 5.1.a) and 9 of the GDPR, it should be noted
that APDCAT is the independent body that guarantees the
right to the protection of personal data within the Catalan public
sector and the private sector that performs public functions and services, including
professional associations and public and private universities in Catalonia.
It should also be remembered that, in addition, a sanctioning resolution is
the result of the investigation of a sanctioning procedure, taking into account each of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 128/225
the circumstances present in the facts under analysis and, therefore,
their specific peculiarities.
It is therefore untenable that, in addition to the different
areas of competence of the supervisory authorities involved—the APDCAT and this
AEPD—and the different characteristics of the facts analyzed, it can be argued
that the criteria must be the same. Therefore, the conclusions of this resolution cannot be extrapolated to this
case file, since the classification and
degree of sanction carried out by other protection authorities, such as the
Catalan authority, does not condition the criteria of this Authority, nor the meaning of
this resolution, insofar as it is not subject to the
interpretative criteria of other control authorities, with respect to which there is no
relationship of subordination.
5.1.1. Regarding the “PRELIMINARY ALLEGATION – Summary of the controversy raised.”
Despite the title “summary of the controversy raised,” within this
section, it is observed that the UIV makes some allegations that must be dismissed,
as well as statements that need clarification, following the order of the 3 points
indicated therein:
1- Conduct imputed to my client: use of the program
APPLICATION.1 in the administration of exams by students.
Statement of Proven Facts.
As previously stated, it should be noted that the conduct attributed to the
UIV is not the use of this program ***APPLICATION.1.
It is observed that the UIV does not deny the occurrence of any of the
proven facts contained in the Proposed Resolution, implicitly acknowledging
their occurrence.
The UIV focuses on listing eight statements that have been included in the
proven facts of the proposed resolution, in order to point out that
they contain legal considerations that must be addressed in the proposed
resolution. However, it only specifies why it believes that such legal consideration is being
made in two of these cases, which should be
included in the legal grounds (the case of free consent, and the
absence of exceptions under Article 9). Nor does it refer to the rule or
principle that would be violated by carrying them out, or the harm that this would cause.
It should be noted that the essential requirement for the validity of administrative sanctioning resolutions is that they include the proven facts of each condition of the alleged infraction, its severity, and responsibility, etc. This has not been challenged in the present case.
Therefore, the requirements set forth in Articles 89 and 90 of the LPACAP must be met.
Content and Form of the Proposed Resolution: Article 89.2 and 3
Proposed resolution in sanctioning proceedings.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 129/225
“2. In the case of sanctioning proceedings, once the investigation has been completed, the investigating body will formulate a proposed resolution, which must be notified to the interested parties. The proposed resolution must indicate that the proceedings are available for public review and the deadline for submitting allegations and presenting any documents and information deemed relevant.
3. The proposed resolution will set out, with justification, the facts considered proven and their precise legal classification, determine the infringement, if any, that they constitute, identify the responsible person or persons, and the proposed sanction, assess the evidence gathered, especially that which forms the basis of the decision, as well as any provisional measures that may have been adopted. When the investigation concludes, the non-existence of infringement or liability and
the power provided for in the first paragraph is not exercised, the
proposal shall declare this circumstance.”
or Content and form of the Resolution: Article 90.1 of the LPACAP:
Specific features of the resolution in sanctioning proceedings, which
provides that:
“1. In the case of sanctioning proceedings, in addition to the
content provided for in the two preceding articles, the resolution shall include
the assessment of the evidence presented, especially that which
constitutes the basic basis of the decision, establish the facts and,
where applicable, the person or persons responsible, the infringement or
infringements committed and the sanction or sanctions imposed, or
the declaration of non-existence of infringement or liability.”
While it is true that it is not expressly prohibited by the legal system,
it follows from the formal structure of a proposal or resolution that the
legal considerations must be made—and have been made extensively
and exhaustively—in the Legal Grounds of the Proposal and this
Resolution, which has even dedicated a separate and exclusive section to
evaluating the evidence, in which it is explained in detail why each aspect related to the proven facts has been considered
proven, in addition to the
Legal Grounds dedicated to the breach of each obligation,
where these issues are legally justified.
In this case, it is understood that no legal considerations or
evaluations (issuing opinions or interpreting the rules) have been made
within the proven facts of the proposed resolution, but rather that the evidence proving the existence of the constitutive facts
that determine each type of infraction, or the non-existence of facts that prevent,
extinguish, or exclude liability, has been
enumerated. And for greater clarity,
in these two cases mentioned by the UIV, reference has been made to the
associated legal concept or infraction to which they refer.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 130/225
It should be noted that there is no rule prohibiting the introduction of legal concepts
associated with the evidence related to the proven facts, and
that this may even be advisable in order to comply with the Principle of
Transparency and clarity of administrative procedures, to facilitate
greater understanding for the interested party, if the intention is, as in the present case,
to include in a single proven fact all references relating
to the non-compliance with a specific requirement, which is why mention is made of the
legal concept of “free consent”, the
application of which will be justified later in the Legal Basis, as
is the case. And with regard to the alleged failure to provide evidence of
exceptions that would allow the processing of special category data under
Article 9 of the GDPR, what is being declared proven is an omission or negative
fact that could prevent, extinguish, or exclude liability,
the lack of proof of which must also be declared as
a proven fact. Since proven facts can consist of actions
and omissions.
1-Infringements attributed to my client.
The UIV lists the two alleged infringements, but does not make any arguments
regarding the classification of the infringements, but rather regarding the proposed sanctions for
them, stating that “the increase is not justified by new facts or
circumstances that arose during the proceedings.” Without offering any
justification in this regard.
In this regard, and without prejudice to what will be said later regarding the
sequencing of the sanctions (sixth allegation), it should be clarified that the proposed
resolution did not increase the sanction for either infringement, but rather raised the sanction under Article 5.1.c) of the GDPR by
€50,000, as it was considered
that very serious negligence, rather than serious negligence, occurred from September
2020 onwards; however, it reduced the initial sanction set in the commencement agreement by Article
9 of the GDPR by €50,000, partially upholding the allegation made by the
UIV regarding the duration of the infringement due to the application of the Principle of
Legitimate Expectation from September 2020. In both cases, the reasons for reaching this conclusion were extensively explained.
This allegation should be dismissed, since the change in the sanctions established in the proposal is deduced from the investigation carried out without requiring any new facts or circumstances to occur during the proceedings. This modification can be deduced from the facts that occurred prior to the start of the proceedings, the existence of which has been verified throughout the proceedings.
3. Summary of the grounds for opposition to the Proposed Resolution.
No response is necessary to this section, as it merely summarizes the allegations detailed in points one through six, which will be addressed below.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 131/225
5.2. Response to the allegations made regarding the legal nature
of the data processed and the atypical nature of the conduct attributed to VIU under Article 9 of the
GDPR.
This is the central issue, addressed primarily in the FIRST ALLEGATION,
although references to this issue are also made throughout the document: “The
Proposed Resolution is based on an erroneous premise: biometric data for
authentication/verification (1:1) does not constitute a special category of personal data
under Article 9.1 of the GDPR. The conduct attributed to VIU is
atypical.”
It should be noted that VIU does not specify which infringement it is referring to when it states that the
“conduct is atypical,” given that two
infringements have been attributed in this proceeding (Articles 9 and 5.1.c) of the GDPR). However, in any case,
it should be clarified that this question of legal nature would only affect the imputation of one of the two infringements: that of Article 9 of the GDPR, which is committed when processing special category personal data without an exception that allows it; and, where applicable, the application of the aggravating circumstance of processing special category data with respect to the infringement of Article 5.1(c) of the GDPR.
But in no case will this issue affect the classification of the infringement of Article 5.1(c) of the GDPR, since the infringing conduct is committed in this case with respect to the processing of all types of personal data, even if they are not special category, provided that it has not been justified that the processing complies with the principle regulated in this provision, because it is not necessary, suitable, and proportionate for the purpose in question.
In its submissions to the initial agreement, as well as in the previous written responses
submitted during the preliminary investigation phase, the UIV has consistently
maintained that its program does not process special category personal data and therefore
is not subject to these obligations. Among its arguments, it highlighted
its denial that its program stored biometric templates and that it was
based on a verification/authentication system. These arguments were dismissed
by the proposal, which acknowledged both facts as proven, determining, in
synthesis, that both implied the adoption of security measures for the processing
that had been considered when determining the appropriate sanction. However, the adoption of these
two design and default measures does not alter the legal nature of the
biometric data being processed, which, since the entry into force of the GDPR, is
considered a special category under Article 9 of the GDPR.
Well, in its response to the Proposal, the UIV makes no reference to the argument
that the program ***APPLICATION.1 does not process biometric data because it does not
store biometric templates, nor does it contradict the arguments contained in the
Proposal on this matter, which pointed out that although there is no storage of
facial patterns, the program generates and uses students' facial patterns to
perform identity verification, which constitutes processing operations
of personal biometric data as defined in Article 4.14 of the GDPR.
In its new arguments, the UIV already assumes that the program processes biometric data
of a personal nature in accordance with Article 4.14 of the GDPR, but disagrees that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 132/225
Article 9 of the GDPR includes within special categories of personal data
biometric systems based on identity verification/authentication based
on comparisons 1.1, maintaining and expanding its argument regarding
this issue.
Within this statement, an introduction is provided, and six reasons are listed on which the UIV disagrees with the conclusions of the Proposed Resolution regarding the legal nature of the data processed by its facial recognition program, APPLICATION.1, expanding on the reasons it had indicated in its previous submissions:
1. Differentiation between the processing of biometric data for the verification/authentication of a person (1:1) and the processing of this data to identify a person (1:n). This distinction has been maintained following the approval of the GDPR, as acknowledged by the Spanish Data Protection Agency (AEPD).
2. The processing of biometric data for verification/authentication (1:1) is excluded from the special categories of personal data provided for in Article 9.1 of the GDPR.
3. Prohibition of retroactively applying unfavorable sanctioning rules. 4. – The RIA and Directive 2024/2831 confirm that biometric data for authentication/verification do not constitute a special category of personal data.
In any case, these rules should be applied retroactively.
5. – The proposed resolution carries out an extensive interpretation “in malam parte”.
6. – The suitability of biometric verification systems and their lack of impact on fundamental rights.
Based on these six reasons, the UIV concludes the following:
“Based on the foregoing, the following conclusions can be drawn:
i. Prior to the adoption of the GDPR, there was a settled
doctrinal distinction between biometric data for verification (1:1) and
for identification (1:n). This distinction had been recognized by
Opinion 3/2012. The GDPR maintains this distinction in the definition of the
concept of “biometric data” established in Article 4.14.
ii. Based on the above distinction, and in accordance with the wording
of Article 9.1 of the GDPR, only biometric data for identification (1:n) constitutes a special category
of personal data, not
biometric data for verification. This interpretation had been
maintained by this Agency in Report 36/2020 and in the AEPD Guide
2021.
iii. In the Guidelines 5/2022 of the EDPB and in the 2023 AEPD Guide, the previous criterion was changed.
Specifically, it was held that both purposes constitute a special category of personal data, in accordance with recital 51 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 133/225
However, to reach this conclusion, an interpretation of the aforementioned recital is carried out that is contrary to the literal wording of Article 9.1 of the GDPR, attributing to said recital a normative value that it does not have and which, moreover, is contrary to law.
iv. The RIA and Directive 2024/2831 demonstrate that biometric data for verification purposes do not constitute a special category, as they classify these biometric systems as low- or no-risk systems.
v. Contrary to what is stated in the Proposed Resolution, it is appropriate legally the application of the aforementioned rules to this
controversy, as required by the principle of applying the most
favorable law, established in Article 26.2 of the LRJSP; and which derives from the
fundamental right to legality in criminal matters established in Article 25 of
the Constitution.
vi. The Supreme Court has ruled that biometric systems used for verification purposes do not infringe upon the fundamental rights established in Articles 15 and 18 of the Constitution. This ruling is consistent with the regulations established in the RIA and Directive 2024/2831, which classify these systems as low-risk.
Therefore, the assertions made in the Proposed Resolution that this processing poses a high risk to those affected are rejected. This consideration currently lacks legal support.
vii. The National Cryptologic Center has argued that verification systems are secure and low-risk, and are also the only real and effective method of authentication that allows for verifying a person's identity.
All of this should lead to the dismissal of the Disciplinary Proceedings, since the conduct attributed to VIU is not a crime and falls within the legal framework.
The reasons for rejecting this claim are outlined below, as this Agency does not agree with the university's conclusions.
5.2.1. Regarding the “Differentiation between the processing of biometric data for the verification/authentication of a person (1:1) and the processing of this data to identify a person (1:n).” This distinction has been maintained after the
approval of the GDPR, as recognized by the Spanish Data Protection Agency (AEPD).
This allegation must be dismissed once again, and it must be confirmed that the program
***APPLICATION.1 facial recognition based on a biometric system
for identity verification and authentication that performs comparisons 1.1 processes
special category personal biometric data as defined in Article 9 of the GDPR, and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 134/225
therefore, it must comply with the applicable requirements for this type of processing
(exception authorizing its processing, DPIA due to its high risk, etc.).
The arguments contained in this section do not justify the atypical nature of the
conduct claimed by the UIV, for the following reasons:
First, the UIV refers to the regulations prior to the GDPR, and to
that the bodies and authorities responsible for data protection Personal data
recognized the difference between two types of biometric systems
(authentication and identification), recommending the use of the former. It cites
Article 4.2 of Council Regulation (EC) No 2252/2004 of 13 December
2004 on standards for security measures and biometric data in
passports and travel documents; Working Paper 80 of the former
Article 29 Working Party (predecessor of the current EDPB) of 1 August 2003; and
the report from Tilburg University of April 2023; the oft-cited
Opinion 3/2012 of the Article 29 Working Party, which was the
main argument of the objections to the initial agreement; Report No. 36-2020 of the
Legal Department of this Agency responding to the query made by a
university for an equivalent examination system to that used by the UIV; and
the published Guide to Labor Relations in May 2021 by this Agency.
In this regard, it should be noted that this Agency has always recognized that there are
two types of biometric systems designed to uniquely identify
individuals (authentication and identification). What is denied is that biometric identity verification/authentication systems do not process
special category biometric personal data as defined in Article 9 of the GDPR.
Therefore, this distinction is irrelevant for the purposes of determining the
legal nature of the biometric data processed by both types of
systems, given that the biometric template obtained in both cases is
personal biometric data whose purpose is to uniquely identify
the individual.
Furthermore, it should be clarified that when referring to this
Agency's report 36/2020, the UIV omits an essential part of it, referring only to
the section of considerations made at the beginning, regarding the fact that it was generally understood at that time that “the data Biometrics
would only be considered a special category of data in
cases where they undergo technical processing aimed at
biometric identification (one-to-many), and not in the case of
biometric verification/authentication (one-to-one). However, the UIV omits that
following this, the report indicates that a case-by-case interpretation must be carried out. That part and the conclusions, as the proposal rightly emphasized, apply
to the UIV system. Therefore, contrary to what the UIV states,
report 36/2020 determined that in the case of identity verification for
online exams based on facial recognition through authentication,
data of a special category under Article 9 of the GDPR was being processed.
We should refer to the proposal, which details the explanation in this regard.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 135/225
However, although the Labor Relations Guide published This
Agency analyzed this issue in May 2021, applying the criteria
contained in Opinion 3/2012 of the Article 29 Working Party, expressly stating
that:
“However, the GDPR does not consider all processing of biometric data
as processing of special categories of data, since Article 9.1 refers
to “biometric data for the purpose of uniquely identifying a
natural person,” and therefore, from a joint interpretation of both provisions,
it follows that biometric data would only constitute a special category of
data if it is subject to specific technical processing
aimed at uniquely identifying a natural person. (...)”
This was done before the EDPB issued its opinion on the matter, specifically in
EDPB Guidelines 05/2022, when it established its position regarding the
new regulation contained in Article 9 of the GDPR. A position that was
adopted by this Agency in November 2023 when the Guide to
biometric processing, to which the UIV refers, was published.
Therefore, and based on the above, it is appropriate to partially uphold the fifth and sixth allegations regarding the culpability of the conduct and the
severity of the sanction.
However, the first allegation cannot be upheld, since this assessment affects the
requirement of culpability but not the elements of the offense, considering
that the UIV committed the infringement by processing special category biometric data
from the entry into force of the GDPR, although it must be exonerated from
culpability for the period in which the UIV is considered to have acted under the
Principle of Legitimate Expectation, applying the criterion of Opinion 3/2019, which
this Agency had confirmed in its 2021 Guide to Labor Relations.
Since, as the Proposal correctly pointed out (p. 96): “There is no
retroactive application of the rules, since the
obligations whose breach is being examined in this procedure were
imposed by the GDPR, and are enforceable from its entry into force, not from
when the aforementioned Guidelines 05/2022 or this Agency's Guide were issued.”
Consequently, the infringement of
Article 9 of the GDPR for processing special category data without
an exception can be upheld, but the period of the alleged infringement
(set in the Proposal as beginning in September 2020) can be reduced to November
2023, with the corresponding reduction of the penalty to be imposed. However,
as will be explained later, it is emphasized that processing through
authentication is also considered a special category in accordance with what was set out
in the Proposed Resolution.
5.2.2. Regarding the statement: “The processing of biometric data for
verification/authentication (1:1) is excluded from the special categories of personal data as provided for in Article 9.1 of the GDPR.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 136/225
In this section, the UIV first sets out the arguments for why it believes that the previous criterion contained in Opinion 3/2019 of the Article 29 Working Party should still be applied, questioning the legal basis of the current interpretative criterion established by the EDPB in its Guidelines 05/2022.
Along these lines, the UIV presents an overview of the regulatory evolution regarding the processing of personal biometric data and the various references made to it in different reports, guides, and guidelines, which coincide with and expand upon those made by the Proposal, and acknowledges the following:
First, that the concept of personal biometric data had not been regulated in personal data protection legislation. in force prior to the GDPR, as stated in Legal Basis III, indicating: “Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data did not expressly regulate the processing of biometric data. This regulation has been established for the first time in the GDPR, whose Article 4.14 establishes the following definition of biometric data: “personal data obtained from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person which allow or confirm the unique identification of that natural person, such as facial images or fingerprint data.”
It follows that the interpretation made in previous reports
of the regulations contained in the previous legislation on the protection of
personal data – such as Opinion 3/2012 of the Working Party on
Article 29 of Directive 95/46/EC, on the evolution of technologies
to which constant reference is made – is not applicable to the new
regulatory situation reflected in the GDPR.
• The UIV also recognizes that the concept of biometric data
of a personal nature in Article 4.14 of the GDPR includes both
authentication and identification systems, when it states that: “It is
essential to emphasize that this definition of “biometric data” includes two
distinct scenarios, as can be seen from the use of the conjunction “or”:
(i) those that allow the identification of a person (1:n) and (ii) those that allow
the confirmation of a person’s identity (1:1).” Therefore, it is
thereby acknowledging that its program ***APPLICATION.1 verifies
identity (allows confirmation of the identity of the student taking the
exam) through 1:1 comparisons, and that this involves the processing
of biometric personal data as defined in Article 4.14 of the GDPR.
or The UIV then refers to the fact that this Agency has changed its
criteria in its Guide on Biometrics of November 2023, an issue that has already
been addressed previously, given that said Guide expressly stated
that:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 137/225
“The Spanish Data Protection Agency published in May 2021
the guide “Data Protection in Employment Relations”, in which
the use of biometrics in the implementation of attendance
registration processes was addressed in the section “Biometric Data” of chapter 4.6. The text interpreted biometric authentication
as not falling outside the special categories of data. However,
this interpretation has been superseded by the aforementioned Guidelines,
and therefore the interpretation of this AEPD must be adapted to the
EDPB Guidelines mentioned of April 26, 2023.
Similarly, the interpretation of these types of processing
made by this Spanish Data Protection Agency (AEPD) in its Legal Report 036/2020, based, among
other documents, on Opinion 3/2012 of the Article 29 Working Party (WP29) on the evolution of biometric technologies—
published in 2012, when neither biometric data nor biometric data were considered special categories (only after
the entry into force of the GDPR in 2016)—must also be considered superseded by the EDPB's new position, set out in
Guidelines 05/2022.
In short, it must be considered that, as in the case of
identification, biometric authentication is a process that involves the
processing of special categories of personal data.
In this regard, as already mentioned, it should be noted that this Agency adopted
the criteria adopted by the EU's highest expert advisory body on
data protection, the EDPB, in its Guidelines
5/2022 of April 23, which contains the first pronouncement made by
this new body on this issue since the entry into force of the
new concept of special category biometric data regulated by the
GDPR.
In these Guidelines, the EDPB states that: “(…) While both functions—authentication and identification—are distinct, both relate to the
processing of biometric data concerning an identified or identifiable natural person and, therefore, constitute the processing of personal data and, more specifically, the processing of special categories of personal data.”
It is not true that this conclusion was reached without “further argumentation or
development,” as the UIV claims, since the EDPB, before reaching this conclusion,
states the following:
“7. FRT falls under the broader category of biometric technology. Biometrics includes all automated processes used to recognize an individual by quantifying their physical, physiological, or behavioral characteristics (fingerprints, iris structure, voice, gait, blood vessel patterns, etc.). These characteristics are defined as ‘biometric data’ because they enable or confirm the unique identification of that person.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 138/225
8. This is the case with people's faces or, more specifically,
their technical processing using facial recognition devices:
By capturing an image of a face (a photograph or video) called a
biometric "sample," it is possible to extract a digital representation of
distinct features from this face (this is called a "template").
9. A biometric template is a digital representation of the
unique features extracted from a biometric sample and
can be stored in a biometric database. It is assumed that
this template is unique and specific to each person and is, in principle,
permanent. In the recognition phase, the device
compares this template with other templates previously produced or
calculated directly from biometric samples, such as faces
found in an image, photograph, or video. Facial recognition is, therefore, a two-phase process: the collection of the facial image and its transformation into a template, followed by the recognition of this face by comparing the corresponding template with one or more other templates.
10. Like any biometric process, facial recognition can fulfill two distinct functions: (authentication and identification: paragraph transcribed by the UIV).
11. In both cases, the facial recognition techniques used are based on an estimated match between templates: the one being compared and the baseline(s). From this perspective, they are probabilistic: the comparison deduces a greater or lesser probability that the person is indeed the person to be authenticated or identified; if this probability exceeds a certain threshold in the system, defined by the user or the system developer, the system will assume that there is a match. 12. Although both functions—authentication and identification—are
distinct, both relate to the processing of biometric data
concerning an identified or identifiable natural person and, therefore,
constitute the processing of personal data and, more
specifically, the processing of
special categories of personal data.
On the other hand, the UIV reiterates the argument that Recital 91 of the GDPR
excludes authentication systems from this consideration, but at the same time, the UIV criticizes this Agency for taking into account the
interpretive criterion set out in Recital 51 of the GDPR, on the grounds that
recitals are not binding. This results in a
clear contradiction.
In this regard, we should refer to the Proposed Resolution, which details the
reasons why Recital 91 of the GDPR is understood to be inapplicable
to this case and not contradicting Recital 51 of the GDPR, and
why the latter clearly states that both systems are
considered to be of a special category.
The application of Recital 51 (expressly referring to the fact that biometric data that authenticates or identifies is of a special category) is deduced
from its literal wording, as is the fact that Recital 91 does not exclude
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 139/225
Under no circumstances should these systems be considered special category data, since
it refers to high-risk processing and impact assessments.
This is clear from the literal wording of both, without the university justifying the
reasons why the interpretation made by the EDPB and this Agency
are violating Recital 91:
“51) Personal data which, by their
nature, are particularly sensitive in relation to fundamental rights
and freedoms, because the context of their processing
could entail significant risks to fundamental rights and freedoms, deserve special protection.”Personal data revealing racial or ethnic origin must be included among such personal data, it being understood that the use of the term "racial origin" in this Regulation does not imply the Union's acceptance of theories that seek to determine the existence of separate human races. The processing of photographs should not be systematically considered as the processing of special categories of personal data, as they only fall within the definition of biometric data when their processing by specific technical means allows for the unique identification or authentication of a natural person. Such personal data should not be processed unless their processing is permitted in specific situations provided for in this Regulation, given that Member States may lay down specific data protection provisions to adapt the application of this Regulation to compliance with a legal obligation or the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for that processing, the general principles and other rules of this Regulation must be applied, particularly with regard to the conditions for the lawfulness of the processing. Exceptions to the general prohibition on processing these special categories of personal data must be explicitly established, including where the data subject has given explicit consent or where there are specific needs, in particular where the processing is carried out in the context of legitimate activities by certain associations or foundations whose objective is to enable the exercise of fundamental freedoms.
... “(91)The above should apply, in particular, to large-scale processing operations
that aim to process a considerable amount of personal data at a regional, national, or supranational level and that could affect a large number of data subjects and
are likely to entail a high risk, for example, due to their
sensitivity, when, depending on the level of technical expertise
achieved, a new technology has been used on a large scale, and to
other processing operations that entail a high risk to the
rights and freedoms of data subjects, in particular when these
operations make it more difficult for data subjects to exercise their
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 140/225
rights. A data protection impact assessment
must also be carried out in cases where personal data is processed
to make decisions concerning specific natural persons
based on a systematic and comprehensive evaluation of
personal aspects of natural persons, based on
profiling of such data or as a result of processing
special categories of personal data, biometric data, or data
concerning criminal convictions and offenses or related security measures.
A data protection impact assessment is also required
for the control of large-scale public access areas,
in particular when optoelectronic devices are used, or
for any other type of operation when the competent supervisory authority considers that the processing is likely to result in a high
risk to the rights and freedoms of data subjects, in particular
because it prevents data subjects from exercising a right or using a service
or performing a contract, or because it is carried out systematically on a large
scale. The processing of personal data should not be considered large-scale if it is carried out, with respect to the personal data of patients or clients, by a single doctor, another healthcare professional, or lawyer. In these cases, a data protection impact assessment should not be mandatory.
Furthermore, it is also untrue that, as the UIV points out, normative value is being given to Recital 51 of the GDPR, since it is Article 9 of the GDPR that defines which processing of personal data is considered to be of a special category (“biometric data for the purpose of uniquely identifying a natural person”), and therefore, this is the provision that is understood to be infringed. It is worth reiterating in this regard the arguments contained in the
Proposed Resolution, which highlighted the interpretative value that case law has recognized in the Recitals of the preambles of European regulations, and as such, it has been considered by the EDPB. And, likewise, it is worth denying, once again, that Recital 51 contradicts Recital 91 of the GDPR, as the university repeatedly maintains, for the reasons stated in the Proposal.
On the other hand, the UIV criticizes the EDPB for showing an ambivalent criterion in declaring The conformity of passenger authentication systems at airport security checkpoints was addressed in Opinion 11/2024, concerning the use of facial recognition to expedite passenger flow at airports.
However, this Opinion in no way declared that these authentication systems are not of a special category. In fact, the second paragraph of its executive summary states that:
“As a preliminary observation, the Committee recalls that the use of biometric data, and in particular facial recognition technology, entails high risks to the rights and freedoms of data subjects.” It refers to
the processing of biometric data, which is granted special protection
under Article 9 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 141/225
It also refers to the obligation to comply with the requirements that
the GDPR establishes for this type of data. It is one thing to indicate that authentication or identification systems can be used, and another to have declared that in
this case the requirements established by the GDPR do not have to be met when
special category data is processed, and, moreover, high-risk processing is carried out.
This opinion responds to a query that analyzes, exclusively, and
as its title indicates, compatibility with Articles 5(1)(e) and
(f), 25 and 32 of the GDPR. Furthermore, it refers only to the scenario presented
regarding the implementation of this system in airports, which is not
comparable to the one presented here. raised.
Furthermore, it is not true that there is a contradiction with what has been previously stated by the EDPB, since:
(i) In paragraphs 22 and 23, it again distinguishes between these two biometric systems and indicates, as do the EDPB Guidelines 05/22, that:
23. In both cases (i.e., identification and authentication), facial recognition techniques are based on an estimated correspondence between templates; that is, the one being compared and the reference database(s). From this perspective, they are probabilistic: the comparison deduces a greater or lesser probability that the person is indeed the person who must be authenticated or identified; if this probability exceeds a certain threshold in the system, defined by the user or the system developer.
(ii) And the subject of the consultation being, among other things, whether the
authentication systems in the airport sector infringed
the aforementioned provisions, Opinion 11/2024 states the following in
paragraph 26.
“26. As a preliminary observation, the Committee recalls that the use of
biometric data and, in particular, facial recognition technology
entails greater risks to the rights and freedoms of
data subjects. First, the processing in question relates to
biometric data that is afforded special protection
under Article 9 of the GDPR. In particular, biometric data
irreversibly alters the relationship between the body and identity
because it makes the characteristics of the human body ‘machine-readable’
and subject to further use (…).”
In short, this claim should be dismissed, since the UIV insists on denying the
obvious based on a technicality and an interpretative criterion that applied to
the previous regulations and not the current ones, when it is obvious that the facial recognition
used by the program ***APPLICATION.1 generates and uses biometric templates
in order to uniquely identify the student who
takes and participates in the exam. This follows from the aforementioned regulations, and
from the documentation provided by the UIV itself:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 142/225
Thus, it is established that the first of the 5 purposes of the processing that
are listed in the Data Protection Impact Assessment (DPIA) and updates carried out by the UIV
is to “verify that the student taking the exam is who
they claim to be,” which is undoubtedly a way to identify them and verify that
only the student registered on the virtual campus who registers for the
exam has accessed it and is taking the exam,
by comparing their facial pattern 1.1 every two seconds
from the beginning to the end of the exam.
• In the description of processing operations for the 2023 DPIA update, the authentication process used, subcontracted to the entity ***APPLICATION.1, is described. It is clear from this process that the purpose of facial recognition is to uniquely identify the student who takes and participates in the exam. It is worth recalling the following excerpt from page 31 of the
Proposal:
“However, in the actions sub-tasked to ***APPLICATION.1, it is
indicated that the student's facial pattern is processed and it is stated that the following is
performed: (i) ***APPLICATION.1 (Platform Registration):
it is indicated that the facial pattern is the data processed, and that “to
complete the registration, the student must take 3 photographs of their
face (frontal photograph, left profile photograph, and
right profile photograph), and the Platform assigns them a user
identifier code”; (ii) and ***APPLICATION.1 (Taking
an exam) states that the facial pattern and
facial expressions are processed as follows: “The user is
authenticated facially through the identifier code that the
Platform assigned to the user during registration. In this case, the user is
authenticated by comparing the interested party's facial pattern
with the one associated with the ID (one-to-one). Once the student logs in and
takes the exam, a check is carried out to prevent fraud
or copying during the exam (by checking for
anomalous behavior or facial expressions, etc.)”
• In addition to what is stated in the DPIA, the description of the operation
of the ***APPLICATION.1 program contained in Document 1.2
(information provided by the manufacturer), or in the example of a
final master's thesis submitted as Document 3.2, leaves
no doubt that the purpose of the facial recognition system
is to uniquely identify the student. For the purposes of
determining whether special category biometric data is being processed, it is irrelevant whether
the student's biometric template is compared with the one created
upon registration for the exam, or with those of other students. The
same biometric template is generated in both cases, and it is used to
verify the student's identity. This makes it, according to Article
9 of the GDPR, special category biometric data. Special.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 143/225
But, as also explained in the Proposal, it is not that this Agency
does not value the fact that the UIV has opted for a more secure biometric system than
those based on biometric identification 1.N, since this has been
taken into account in the present sanctioning proceedings by reducing the
penalty to be imposed. Let us recall that the Proposal indicates that the use of
authentication systems also requires an exception under
Article 9 of the GDPR and a DPIA under Article 35 because it is special category data
and high-risk processing, but it recognizes that these
authentication systems generate lower risks for the rights and freedoms of
data subjects than identification systems, implying the adoption of a
design measure and default measure in the processing, which has been adopted by the
controller in this case, and this This has been considered when determining the
penalty to be imposed. There is no doubt that in both cases an infringement of Article 9 of the GDPR is committed if no exception exists, but the penalty to be imposed would be greater
if 1:N identification methods had been used,
instead of 1:1 authentication methods.
5.2.3. Prohibition of retroactively applying unfavorable sanctioning rules.
This allegation has already been addressed in section 5.1, which refers to the fact that the
Agency was carrying out a retroactive interpretation of a favorable sanctioning rule, which is dismissed.
The UIV adds here that the interpretative criteria of the advisory authorities and the data protection authorities should also not be applied retroactively, and refers to two Supreme Court rulings and
one from the CJEU. Specifically, it states the following:
“The interpretation of the applicable regulations carried out by the AEPD also violates the prohibition against retroactively applying the rule sanctioning.
This prohibition also applies to purely
interpretive rules and the interpretative criteria upheld by the Administration
(as is the case of the AEPD's 2023 Interpretative Guide, which
has been referenced above).
Thus, if, among several possible interpretations, an
interpretative rule or the Administration itself, through its criteria, chooses or
the Administration itself, through its criteria, chooses an interpretation that excludes
others that are more favorable to the alleged offender, the prohibition of
retroactivity "in peius" prevents its consideration and, in reality, what it
demonstrates is that there were doubts regarding its interpretation, with the benefit
that such doubts may entail for the alleged offender.
As the aforementioned Supreme Court Judgment of March 4,
2016, rec. 2163/2013 (ECLI:ES:TS:2016:934), regarding the interpretative rules
(in this case, a Royal Decree of the Government on matters of
competition):
"Said explanatory statement [the Statement of Reasons of the Royal Decree] does not reflect, as
the appealed judgment maintains, the 'will of the legislator,' since it is a
regulation issued by the Government, specifically by the
Council of Ministers at the proposal of the Minister of Industry, Tourism and
Trade. However, regardless of this, the clarification sought by this
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 144/225
rule highlights the interpretative doubts that existed until then, which
would corroborate the impossibility of sanctioning conduct by stating that it is
conduct contrary to competition that could be classified as 'unjustified.'
It should not be forgotten that when one wants Giving retroactive effect to interpretative rules, insofar as they seek to maintain their validity from the date of entry into force of the interpreted rule, leads to a contradiction,
because if the previous rule required interpretation, this implies
recognizing that the scope of the previous rule was uncertain until it was
interpreted. And this purported retroactive effect cannot serve as
grounds for sanctioning conduct prior to said rule on the grounds that
it was already punishable under the previous regulations, duly interpreted in light of the
subsequent rule, since this would imply granting retroactive effect
to a sanctioning rule, a possibility expressly prohibited in
Article 9.3 of the Spanish Constitution and Article 128 of Law 30/1992 (now Article 26 of the Law on the Legal Regime of the Public Sector) (Legal Basis 6). (emphasis added)
Based on this argument, the Supreme Court upholds the appeal, annuls the
lower court's judgment and the administrative decision that imposed the sanction.
The Supreme Court has stated the same regarding the interpretative criteria
established by the Administration itself, specifically by the Spanish Data Protection Agency (AEPD). Thus,
following what has already been indicated in previous rulings, the Supreme Court ruling of February 27,
2012, appeal no. 747/2009 (ECLI:ES:TS:2012:1299), in response to a sanction imposed by
the Data Protection Agency, stated that:
“[…] in matters of sanctions, new criteria, however reasonable
they may be, whether contained in a regulation or derived from a decision of the
Administration interpreting the regulations, must have their effects on the
future but never be projected onto past actions that conformed
to the criteria then in force, and the relationship of
citizens with the Administration must be based on a principle of
legitimate expectation, an expectation that can only be generated when there is
predictability and certainty in the actions of the Administration.” (FD 2)
Therefore, it upholds the judgment of the National Court which had maintained
that criterion and dismisses the appeal filed by the
General State Administration.
The CJEU maintains the same position. For example, in its judgment of 10 June 2014, Case C-295/12 P, Telefónica v. Commission, which, in a case concerning abuse of a dominant position, stated: “…the principles of legality of penalties and legal certainty (…) may preclude the retroactive application of a new interpretation of a rule defining an infringement” (para. 147); and “this is the case, in particular, when it concerns a case law interpretation whose outcome was not reasonably foreseeable at the time the infringement was committed…” (para. 148).
In this respect, the ECtHR starts from the premise that case law on punitive norms is a source of law and, since Article 7.1 of the ECHR refers to "law," not legislation, it proclaims the non-retroactivity of unfavorable judicial decisions (ECtHR, Grand Chamber, 21 October 2013, Rio Prada v. Spain, paragraphs 91-93).
This argument should be considered, solely for the purpose of understanding that, through the
Biometrics Guide of November 2023, this Agency adopted the criterion
contained in Opinion 05/2022 of April 2023, understanding that said
interpretative criterion can only be applied from the publication of said
Guide for reasons of legal certainty. Therefore, the duration of the infringement
must be reduced compared to that indicated in the initial agreement and in the
proposed resolution, since it is understood that the infringement was
committed from the entry into force of the GDPR and the conduct is typical, but
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 145/225
until November 2023 the conduct cannot be considered culpable, concluding a justifiable mistake of law based on the Principle
of Legitimate Expectation.
5.2.4. The RIA and the Directive 2024/2831 establishes that biometric data for
authentication/verification does not constitute a special category of personal data.
In any case, these rules should be applied retroactively.
This claim has already been addressed in section 5.1 and should be
dismissed in its entirety.
5.2.5. The Draft Resolution carries out an extensive interpretation “in malam parte”.
The UIV states in this regard that:
“In the preceding sections, it has been justified that the interpretation of
Article 9.1 of the GDPR, in relation to Article 4.14) of this regulation,
leads us to conclude that the only possible interpretation of the
literal meaning of these provisions is that the processing of biometric data for the verification of persons (1:1) does not constitute a
special category of personal data.
This conclusion is supported by the criteria maintained by this
Agency in its Report 36/2020 and in the AEPD Guide 2021; as well as by
subsequent legislative acts approved by the EU legislator
(the RIA and Directive 2024/2831).
However, should other interpretations be possible,
we must reiterate, as we already did in the submissions
presented on February 26, 2025—a point which has not been addressed
by the Proposed Resolution—that we are dealing with the
exercise of sanctioning powers.
Indeed, this Agency exercises the power to punish and, consequently,
must respect the guarantees that Article 25 of the Constitution grants
to my client, among which are the principle of legality and the
principle of specificity, which prohibit the broad interpretation “to the detriment of the
party” of the offenses. (...)
First, it should be clarified that this is the first time the UIV has raised this
argument, having made no reference whatsoever to the violation of the Principle
of legality and specificity by carrying out an alleged broad interpretation
within a sanctioning procedure. It is not true that the proposal did not
address this argument because it was not formulated in these terms.
Furthermore, the UIV also mentions for the first time two judgments that
declare the prohibition against public authorities carrying out a broad
interpretation of the rules when exercising sanctioning powers, such as
Constitutional Court Judgment No. 52/2003, of March 17
(ECLI:ES:TC:2003:52), and Judgment No. 462/2023 of the Administrative Chamber of the Supreme Court, of April 11, issued in appeal No. 7272/2021. It also notes that the Agency itself, in report 36/2020, stated that “this Agency considers this to be a complex issue, subject to interpretation, regarding which no general conclusions can be drawn,” and therefore, in case of doubt, it should and should interpret it in favor of the accused, and exclude authentication systems from the typical conduct covered by Article 9 of the GDPR. Since this interpretation may be Admissible when issuing reports or guidelines, but not
when exercising sanctioning powers.
Or, a violation of the Principle of Legality is alleged, which forms part of the
Principles of Sanctioning Powers regulated in which it violates the provisions of
Article 25.1 and Article 27.2 of the LRJSP, which state the
following:
“Article 25. Principle of Legality.
1. The sanctioning power of Public Administrations shall be exercised
when it has been expressly recognized by a law,
with application of the procedure established for its exercise and in accordance with the
provisions of this Law and the Law on Common Administrative Procedure of
Public Administrations and, in the case of Local Entities, in accordance with the provisions of
Title XI of Law 7/1985, of April 2.
2. The power to impose sanctions corresponds to the administrative bodies to which it has been expressly attributed by a legal or regulatory provision.
3. The provisions of this Chapter shall extend to the exercise by Public Administrations of their disciplinary power with respect to their personnel, regardless of the legal nature of the employment relationship.
4. The provisions of this Chapter shall not apply to the exercise by Public Administrations of their power to impose sanctions with respect to those who are bound to them by relationships governed by public sector contract legislation or by legislation on the assets of Public Administrations.
Article 27. 1 and 2. Principle of legality.
1. Only violations of the legal system specifically defined as such by law constitute administrative offenses, without prejudice to the provisions for Local Government in Title XI of Law 7/1985, of April 2. Administrative offenses are classified by law as minor, serious, and very serious.
... 2. Only for the commission of administrative offenses may sanctions be imposed, which, in any case, will be limited by law (...)”
This allegation can be dismissed, as this Agency understands that it is not making an extensive interpretation to the detriment of the accused of the conduct typified in Article 9 of the GDPR, which violates the principle of legality or specificity, in the terms expressed in the LRJSP, because it is understood that the infringing conduct has been defined and specified by the legislator in Article 9 of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 147/225
and in this case, it is established that the purpose of the facial recognition system developed by the UIV was the unambiguous identification of the student, thus fulfilling the typical requirement provided for in Article 9 of the GDPR, as It was stated in the
documentation referenced above. Furthermore, the regulatory text itself
clarified in its Recital 51 that both identification systems
and authentication systems designed to uniquely identify
individuals were special category data. Therefore, the issue
might be doubtful in other cases, but not in the present one, where it is clear
that the program ***APPLICATION.1 generates and uses biometric templates
of individuals in order to verify that the student taking the
exam is who they claim to be throughout the entire exam (every two
seconds). It is not true that the GDPR is vague or imprecise regarding this
issue, since Article 9 of the GDPR does not exclude or make
any reference to authentication or identification systems. The requirement
stipulated is limited to determining the purpose of the processing carried out when
extracting and comparing the templates, which is the case here, and it is also
confirmed in the aforementioned Recital 51 that both systems would be
included in this concept whenever that are intended to uniquely identify a person. Considering that it has interpretive value, as has been said.
Furthermore, when this Agency's report 36/2020 stated that it was
a “complex issue subject to interpretation,” it meant to indicate that it was not
possible to categorically state that all authentication scenarios
were excluded from the concept of Article 9 of the GDPR, since in each
case, the purpose of the processing had to be analyzed. And all this
without prejudice to the fact that the aforementioned report addressed a query with very
specific terms and in a very specific circumstance—marked by the
COVID-19 pandemic—before the EDPB itself had clearly taken a position
on this issue, as we have previously indicated.
Furthermore, the UIV has not transcribed the entirety of this fragment of the report,
which actually states the following:
“However, this Agency considers this to be a complex issue, subject to interpretation, regarding which no general conclusions can be drawn. Each specific case must be considered, taking into account the data processed, the techniques used for its processing, and the
consequent interference with the right to data protection. Until the European Data Protection Board or the courts rule on the matter, in case of doubt, the interpretation most favorable to the protection of the rights of the data subjects must be adopted. (emphasis added)
In the present case, as we have indicated, the consultant does not
identify the facial treatment techniques to which the consultation refers.
However, as the Technological Assessment and Studies Unit has informed the Legal Department, several different techniques are currently being used:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 148/225
“The set of queries raised establishes measures for identification and control during online testing that range from the least intrusive to the most intrusive:
• Access to the student's image and microphone, including:
o Recording the student's image and sound during the exam
o Multi-camera viewing of the student from different perspectives
o Recordings of the student's personal environment before and/or during the test
• Access to the student's system
o Access to the student's screen
o Control of the student's system (at least by blocking the execution of applications other than the teaching applications)
o Recording of the student's interaction with the system
• Processing of information Biometrics
or Identification through facial recognition and, in addition, other
biometric parameters of the student (such as typing profile).
or Processing of biometric data to profile attitudes, gestures,
moods or anxiety levels, etc.
It should be noted that, as acknowledged in the aforementioned “Second
Online Conference for Sharing Experiences in Assessment Models,” universities are combining different
systems to verify student identity and prevent potential
identity theft. Furthermore, one of the characteristics of the
***PROGRAM.1 systems currently on the market is that
they guarantee student identification through facial recognition,
preventing identity theft, not only at the outset,
but throughout the entire activity. To achieve this, the activity is recorded, and various captures are taken and compared with the
biometric information previously stored in their databases.
These systems also include, as previously mentioned, the
processing of other types of biometric data (such as keystrokes) and non-biometric data, such as recording the environment in which the student is located, as well as access to the microphone for sound recording.
Therefore, considering the specific circumstances, which involve the
processing of different types of biometric data and in which
facial recognition is not performed at a specific moment but
is performed continuously, which may also involve the
processing of a third party's biometric data for comparison
with that of the student in order to identify possible impersonation, it must be
concluded that the facial recognition processes used for
conducting online assessments involve the processing of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 149/225
biometric data for the purpose of uniquely identifying a natural person.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 149/225 Thus, it should be noted that in the present case there is no doubt that the
***PROGRAM.1 program used by the UIV for the online assessments
of its students was intended to uniquely identify a
natural person to whom the infringing conduct of Article 9 of the
GDPR refers. But in any case, as mentioned in said report
36/2020, in case of doubt regarding the protection of personal data, the rule most favorable to the data subjects (owners of the biometric data processed) must be applied
and not the rule most favorable to the controller.
5.2.6. Suitability of biometric verification systems and their lack of impact
on fundamental rights.
Finally, this first argument concludes with some reflections from the UIV
regarding the risks involved in biometric systems, which were
detailed in Legal Basis II of the Proposal (2.1), and in contrast
to this, it makes two arguments to denying the existence of these risks,
without establishing what connection this issue has with the fact that
the infringing conduct of Article 9 of the GDPR has occurred, nor with the disputed issue
argued in this first allegation.
In any case, both allegations are irrelevant to determining whether
the alleged infringements have occurred, and must be dismissed for the following reasons:
First, contrary to the paragraph on page 55 of the Proposal (where it is stated
that systems processing personal biometric data
use a technology that can be truly intrusive because it can have
very adverse effects on fundamental values and human integrity), the
UIV points out that the only ruling issued by the Supreme Court on this matter
is to indicate that biometric authentication systems do not
violate the fundamental right to life, physical and moral integrity, nor the right to
family privacy and one's own image, which are enshrined in Articles 15 and 18 of
the Spanish Constitution.
It is dismissed since that the aforementioned Supreme Court ruling of July 2, 2007
(RJ/2007/6598): (i) analyzed a different system, for monitoring employee working hours,
which has nothing to do with the one implemented by the university to monitor
the attendance of its students; (ii) and furthermore, it was issued in 2007, during the
validity of the previous data protection regulations (former Directive
96/45 and the LOPD) in which personal biometric data had not yet been
regulated, and when there was not even a pronouncement from the previous group
of Article 29 through Opinion 3/2019, therefore the applicable regulations were not
comparable to the current ones, where the level of protection is much higher.
Currently, it can be confirmed that, as Guidelines 05/2022 indicate: “the
processing of personal data constitutes an interference with the fundamental right
to the protection of personal data in accordance with the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 150/225
Article 8 of the Charter of Fundamental Rights of the European Union (hereinafter, “the Charter”) states that “the right to the protection of personal data is often key as a prerequisite for ensuring other fundamental rights. The application of FRT is considerably likely to interfere with fundamental rights beyond the right to the protection of personal data.” This has been highlighted again in Opinion 11/2024 on airports mentioned above.
It is noted that the exposure regarding the risks of biometric processing referred to by the Agency lacks legislative support and is not aligned with currently available biometric technology, as demonstrated in the new report issued by the National Cryptologic Center (hereinafter, CCN) in December 2024 on technologies. Secure Biometrics for Access Control, which is provided
as Document 1, in which a type of new generation biometric template, RBR (known as renewable biometric templates), is analyzed.
This report analyzes biometric technologies from an information security perspective for their application to access control methods, recommending the use of access control systems based on authentication by comparing a specific type of biometric template: renewable biometric templates (RBRs), as these are considered to have a high level of security.
Therefore, the CCN report analyzes only the main approved technical recommendations (ISO and ENS standards) to evaluate and guarantee the reliability, privacy, and security requirements that biometric technology demands. That is, its objective is to identify which are more reliable (suitable for identification), which best protect confidentiality (more private), and which are more secure. Its perspective is on information security, not on the processing of personal data that may be carried out through it, which is a much broader concept, as will be explained later.
The report focuses on analyzing CERTIFICATION.2:2022, which has created
so-called Renewable Biometric References (RBRs), which have the following
characteristics:
17. “Specifically, the CERTIFICATION.2 standard establishes
additional security protections for biometric templates
by creating the so-called “Renewable Biometric References (RBRs)” or “RBR biometric templates,” which have the following
characteristics:
• Multiplicity. An almost infinite number of different RBR templates can be obtained for each person's face.
• Irreversibility. It is impossible to obtain a person's biometric features from an RBR template.
• Non-interoperability. A specific RBR template is created for each use case, starting from the same features but using different sorting factors.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 151/225
• Revocability. In the event of a system compromise, the
RBR templates can be revoked and replaced with others.
• Non-permanence. The specific numerical expression of an RBR template can be modified through system changes.
And based on this ISO standard, the CCN makes an interpretation
from which it extracts a greater number of characteristics not mentioned
in ***CERTIFICATION.2, without explaining where they were extracted from, nor why
it considers that access control systems based on obtaining
an RBR biometric template comply with the data protection requirements
of the GDPR and the LOPDGDD. Specifically, it points out the following characteristics:
“Irreversible. The resulting RBR biometric template cannot be reversed
to obtain the original raw data used (e.g., the
individual's facial image) for its generation. The template resembles
the result of a hash function and, as such, is irreversible.
• Anonymous. The RBR biometric template does not contain any specific
biometric characteristics (it does not represent the distance between the eyes,
skin color, sex, etc.), but only data derived from them.
• Private. It is not possible to know who the person is simply
by having access to the RBR biometric template.
• Non-interoperable. It is not possible to use the generated RBR biometric template
for a purpose other than the one established when it was generated.
Each RBR biometric template is generated uniquely and associated with the specific
use case or application.
• Controlled use: As a consequence of the above, RBR biometric templates are data with limited usability and can only be
used effectively by the individual to whom they are assigned. belong. Even in
the event of possible theft, the impact on the user is minimal. The template
alone does not grant access to any system.
• Renewal: A person's biometric characteristics are
immutable, but the RBR biometric templates obtained from
those characteristics are not. Obtaining the template depends
on the biometric algorithm used and the mechanisms employed in its
protection, which can always be parameterized, modified, and/or
renewed. Two different algorithms will produce two different biometric templates
from the same biometric data.
• Encryption at the source: Biometric systems that include
the generation of RBR templates, in addition to obtaining the biometric template,
usually incorporate encryption mechanisms, adding an additional layer
of protection. The encrypted biometric template can only be decrypted
by the same mechanisms that generated it.
The application of the conclusions of this report by the CCN to the present case must be completely dismissed, since:
First, the procedure carried out in this case is not a method of controlling access to public or private premises.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 152/225
Rather, it is a method of monitoring student attendance during the exam.
Secondly, and although it could be applied analogously to attendance control,
the fact is that the UIV does not use this type of RBR biometric template,
as evidenced by various pieces of corroborated evidence
throughout the procedure:
Firstly, this is deduced from its own statements in the
present statement of allegations, since the UIV does not claim to use this type of template, but rather alleges that it complies with two of the
technical characteristics indicated in standard ***CERTIFICATION.2
(irrevocability and interoperability), as well as other characteristics
not mentioned in ***CERTIFICATION.2 but in the CNN report
(such as extracting the pattern of facial points), or even other
technical characteristics of the program's operation that are not
mentioned by either the ISO standard or the CCN (that the templates are not
stored and the verification lasts two seconds).
These technical characteristics are technical security measures that are
assessed when determining the appropriate sanction—as has been pointed out multiple
times—but they do not imply that the program uses an RBR template,
because for that to happen, the other
technical characteristics stipulated in the ISO must be present, which are what truly distinguish them from the previous ones: multiplicity, revocability, and non-permanence.
What differentiates them is that they are “renewable,” as their name
indicates, and that their use is controlled, anonymous, and private.
This stems from the multiplicity of creating different templates from
the same face, the non-permanence since they can be changed, and the
revocability in case of system compromise.
Furthermore, the UIV has indicated that it holds certification
***CERTIFICATION.1, which predates
***CERTIFICATION.2 of 2022, when the use of
this new type of renewable biometric templates was recommended. In its letter of November 16, 2023, the UIV, responding to the request for
information on the security measures applied to the
processing, stated that: “The application ***APPLICATION.1 has
certification ***CERTIFICATION.1, therefore the security measures
are those described in said standard. Additionally, the UIV is integrated
within the security, organizational, and regulatory framework of ***COMPANY.3.
Among the standards of ***COMPANY.3 applicable to the security of the VIU,
the Information Security Policy and the Standard on the Use
of Information Systems stand out.
• It is also not included in the submitted DPIA, nor its 2023
and 2024 updates, nor in the documentation provided by the manufacturer (document
1.2, which outlined the program's technical characteristics, nor in its
report of January 30, 2025), nor were they included in the
expert report prepared by the IT consultancy on July 23,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 153/225
2024, which specifically analyzed the generation and storage of
biometric templates by the program ***APPLICATION.1.
Thirdly, it should be clarified that in the hypothetical case that
said report were applicable (because it involves an access control method and uses RBR templates), it could only have effects for
considering that some of the technical security measures that
the controller of biometric data processing of a special category must adopt have been implemented,
and for assessing the suitability of the processing for
effectively identifying students. No liability is attributed for
either of these two issues in this proceeding.
Therefore, it should be noted that the scope of this report is
to analyze the advisability of using these renewable biometric templates
referred to in ***CERTIFICATION.2 from the perspective of
information security in access control systems. That is,
it only refers to recommending the use of these renewable biometric templates
as an information security measure, but this does not
replace the requirement that the processing of personal data
carried out through them must also comply with the other
requirements and guarantees for the protection of the rights and freedoms of data subjects
established by the GDPR.
It should be noted that the CCN limits its scope of competence to the
technical and security aspects of information technologies; this area,
that of security, does not correspond to the system of safeguards and
guarantees that apply to the right to the protection of personal data. Not every secure technology guarantees the protection of
personal data, nor are all measures to guarantee the right to
the protection of personal data technical security measures like the one
present here.
In this case, they will entail the adoption of an information security measure
which will form part of the measures that must be adopted as the
final step within the DPIA, required by Article 35.7.d) of the GDPR, which
must be determined in all high-risk processing such as this one
(“measures planned to address the risks, including safeguards, security measures
and mechanisms that guarantee the protection of personal data,
and to demonstrate compliance with this Regulation,
taking into account the rights and legitimate interests of data subjects and
other affected persons.”
However, the adoption of these information security measures is not
sufficient to comply with all the requirements applicable to the controller of
this processing. Among other aspects, it will also be necessary to justify
that an exception exists that allows the processing of this type of
biometric data because it is a special category, and to justify that the processing
carried out by this means is necessary and proportionate compared to
other non-biometric alternatives that are less intrusive.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 154/225
For security measures to be truly geared towards data protection, their selection and implementation must be conceived as a further step within the framework of risk management integrated into GDPR compliance management and following the principles of data protection.
The protection of personal data begins by assessing the necessity and proportionality of the processing, followed by establishing the lawfulness of the processing, and continues with the application of the principles of fairness, transparency, purpose limitation, proportionality, accuracy, limitation, exercise of rights, accountability, and finally, and derived from the requirements established by the implementation of all the above, technical and organizational measures of all kinds, including security measures.
All of this must be done taking into account the risk-based approach established by the GDPR; that is, the measures implemented will be aimed at preventing risks to the rights and freedoms of data subjects present in the processing materialize
causing harm to these.
Under no circumstances can the security measures adopted by the
controller of personal data processing (whether by application of
Article 32 or Article 35 of the GDPR) take precedence over or replace
everything involved in managing regulatory compliance, in accordance with the
principles of processing. This is because GDPR security measures are not
the starting point for the effective implementation of data protection
in an entity, but rather the final stage of the process.
In this regard, we must emphasize the difference between GDPR security measures, within the framework of a fundamental right and derived from
risk analyses and data protection impact assessments
(focused on the protection of natural persons, with a focus
always on the risks to the rights and freedoms of data subjects
present in the processing), and information security measures
(which protect an asset, which is information, which may or may not contain
personal data).
Notwithstanding the foregoing, When adopting and implementing GDPR security measures, the data controller may integrate information security measures, provided they serve the ultimate purpose of protecting individuals as defined by the GDPR and are compatible with the other measures and provide a level of protection no less than that necessary to achieve a level of security appropriate to the risk, taking into account the results of the risk analyses and impact assessments carried out.
With regard to information security, this encompasses the set of techniques and measures aimed at guaranteeing the confidentiality, integrity, and availability of information and data that are important to any organization, whether or not they are personal data, regardless of their format.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 155/225
Conversely, the protection of personal data of natural persons is established as a fundamental right, grounded in Article 18.4 of the Constitution. Spanish.
Consequently, the right to the protection of personal data
of natural persons is a fundamental right and, therefore,
situated at the highest level of legal protection, which is currently
directly regulated by EU legislation,
the aforementioned GDPR establishing a set of principles, rights,
obligations, and an organizational structure aimed at guaranteeing this
fundamental right. Within these, information security,
when it contains personal data, appears as a possible measure
to be adopted and implemented by data controllers and processors,
who must apply appropriate technical and organizational security measures
to guarantee a level of security appropriate to the
risk. These measures will include, among other factors, “the ability to ensure the
ongoing confidentiality, integrity, availability, and resilience of processing systems and services” and “the ability to restore the
availability of and access to personal data in a timely manner in the event of a
physical or technical incident” (Article 32.2.b) and c) of the GDPR).
Therefore, there is no doubt that guaranteeing the security of personal data
takes on special importance in terms of its protection,
but this protection is not limited exclusively to the security of
said information, since the protection of personal data, which is
a fundamental right, has a much broader scope that encompasses,
as we said, a set of principles, rights, and obligations, as well as
all kinds of technical and organizational measures, including
security measures, which are much broader.
And in this sense, while the use of these RBR templates implies the
adoption of a recommended security measure in the case of this type
of processing, in order for all the obligations of the
controller to be considered fulfilled, it must first be demonstrated that it has been analyzed that
the other requirements provided for in the GDPR are met: (i) to process special categories of data, an exception under Article 9.2 of the
GDPR must apply; (ii) and given that these are high-risk processing activities, a prior
DPIA must be prepared, complying with the requirements of Article 35.7 of the GDPR, and analyzing the
necessity, suitability, and proportionality of the processing, as well as all
concurrent risks, and providing for measures appropriate to the level of risk
if the risk is acceptable. These measures are the final step
to be taken, not the first or the only one, as they must be accompanied by many
other protective measures that go beyond those related to
information security, as mentioned.
Fourthly, and related to the above, it should also be clarified that
the CCN is not competent to state in general terms that a given
biometric system complies with the requirements of data protection regulations.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 156/225
As the UIV itself acknowledges, the CCN limits its competence to the security of
the administration's technology systems, without being a supervisory authority or
advisory body on matters of personal data protection. And the
report is limited to analyzing “secure biometric technologies for access control,” which is not the case at hand, as it analyzes
an attendance control system.
Therefore, it should be clarified that the statement made in section 20 of the
report regarding “Access control systems based on obtaining
an RBR biometric template from a specific biometric characteristic of the person, comply with the data protection requirements
of the General Data Protection Regulation and the Organic Law
on Personal Data Protection and Guarantee of Digital Rights,
thanks to the following characteristics (...)”, should always be understood as referring
to the information security perspectives that have been analyzed, and
not to all the requirements and guarantees that must be met by the
processing of special category biometric data. If such a claim were made,
the criteria of this Agency, as the competent supervisory authority, would prevail.
The same applies to the characteristics that this
report deduces determine compliance with this personal data protection
regulation, whose generic statements are not applicable
to all types of processing.
Finally, it should also be pointed out that some of the claims made by the UIV regarding the content of the report are not true; rather, they are partisan interpretations that do not correspond to reality.
... On the one hand, it is not true that—as the UIV claims—the CCN concludes that “biometric verification systems are the only ones that allow for ensuring a person's identity,” because what the report actually indicates, when analyzing the suitability of these systems for identifying people, is the following:
First, in section 29, it states that: “Biometric systems are the only automatic mechanism that allows for verifying true identity. Systems based on passwords (“something you know”) or based on possessing a device (“something you have”) do not allow for verifying that the person carrying out the authentication process is actually who they claim to be. These are systems based on the presumption that the person who knows a password or has a device is who they claim to be. However, the inherent nature of the system (“something you are”) is included as a factor that, combined with the previous ones, provides an additional layer of security and can be used in environments with higher requirements. Biometrics are the
only automatic mechanism that allows for the verification of true identity”
because they incorporate the so-called “inherence factor” (they are based on
“something that one is”).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 157/225
Therefore, it neither refers to verification/authentication systems nor states
that they are the “only ones that allow for ensuring a person’s identity,” but rather the only automatic mechanisms because they are based on the
inherence factor; it does not rule out manual mechanisms.
• And secondly, it points out that there are also suitable manual mechanisms
for verifying identity: “Manual identity verification,
with a level of equivalence similar to biometrics,
consists of the manual review by a person of the
authenticity of the bearer’s identity document, as well as the
correspondence of the document with the person carrying it. Any
other manual alternative that does not include the above does not constitute an
alternative “equivalent.”
Furthermore, the CCN does not state at any point that “the use of biometrics carries no or low risk to the fundamental rights of individuals,” nor does it recommend the use of biometric verification in general.
Instead, in its conclusion 35, it points out that “Access control mechanisms based on authentication by comparing an RBR biometric template make falsification more difficult compared to other authentication methods, providing an additional layer of security. (...)”
referring to authentication systems that use these RBR templates, which is
not the case for the UIV.
Therefore, all the grounds put forward by the UIV in its first allegation (and related grounds) must be dismissed, confirming that the infringing conduct imputed under Article 9 of the GDPR has occurred, fulfilling the requirement of legality demanded
by Article 26.2 of the LRJSP with respect to it, since it has been confirmed that the UIV has been processing special category biometric personal data of its students
without having an exception under Article 9.2 that would allow it to process said data. All of this is without prejudice to what will be stated regarding the partial acceptance of the fifth and sixth allegations, which refer to the existence of the requirement of culpability and the determination of the sanction to be imposed.
5.3. Response to the FIFTH ALLEGATION. The Proposed Resolution violates the principle of culpability: given the interpretative doubts arising from the GDPR, a sanction cannot be imposed.
The UIV appeals to the absence of culpability in the conduct, structuring its arguments as follows:
1. Introduction.
2. As this Agency has recognized, it is a controversial issue
whether the processing of biometric data for verification constitutes a special category of personal data.
3. The principle of culpability prevents a subject from being sanctioned.
that it acted under a reasonable interpretation of the rule. The Proposed
Resolution violates the doctrine of the Supreme Court and its recent
ruling in the LaLiga case.
4. VIU cannot be considered to have acted with gross negligence
or very gross negligence for having maintained a different interpretation than that maintained
by the AEPD 2023 Guide.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 158/225
5. Conclusions.
As previously stated, this fifth allegation regarding the commission of the infringement of Article 9 of the GDPR (and not Article 5.1.c) can be partially upheld,
considering that: (i) although the requirement of the conduct being a specific offense is met,
it is clear that the biometric authentication system used by the
UIV processes data that are classified as special category data under Article 9 of the
GDPR, without the UIV having justified the existence of an exception, as will be detailed later in Legal Basis IV; (ii) it can be understood that the UIV did not act culpably until the Biometrics Guide of this
Agency was published (November 2023), in which it was assumed that, in accordance with the criteria
expressed in EDPB Guidelines 05/2022, in April 2023, these authentication/verification systems were also included in the concept of Article 9 of the
GDPR.
It should be noted that this Agency does not share all the statements made
in this regard by the UIV, and this allegation cannot be fully accepted since
:
o It is not true that Report 36/2020 excluded all processing
based on biometric authentication systems from the consideration of
a special category, since it determined that each case had to be analyzed individually,
and analyzed the authentication systems used as a method of
identifying students in UNIR's online exams (a case
equivalent to the present one), determining that in this case there was no doubt that
the data in question was of a special category, because its purpose was the
unambiguous identification of the students.
It cannot be denied that this agency's 2023 Biometrics Guide
carried out an “over-ruling” with respect to the provisions of Report 36/2020 and the
2022 Labor Relations Guide, as the UIV points out, since the
guides are neither normative nor binding, as already stated in the
Proposal.
It is not considered that the Proposal was inconsistent or contradictory
in stating that this Agency's Guides are not binding but using them
as a basis for substantiating the infringement, as the UIV points out (pp. 77 and 78),
since the UIV stated on several occasions that
an application of the Biometrics guide - as the UIV alleged - but rather that the
infringement was based on the violation of the rule contained in Article 9
of the GDPR, which clearly defined the type of infringement, and was interpreted in accordance with
the provisions of Recital 51. However, this Resolution considers that
there was no liability for non-compliance with this precept until
after the publication of the Guide in November 2023, as has been
indicated.
Nor is it true that the error of law committed by the UIV in misinterpreting
the concept contained in Article 9 of the GDPR was
invincible, as the UIV claims.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 159/225
According to the Supreme Court ruling of December 28, 2015 (appeal no. 431/2012)
cited by the UIV, “the error of law is based on the well-founded belief that
the observed conduct does not warrant sanctions because it is in accordance
with the legal system,” which applies to the field of sanctioning law, as the UIV points out.
As established by case law, the assessment of unavoidable error depends on the
enforceability of the duty to be informed that the specific individual may have, which in
this case falls under the broad umbrella of the Principle of Proactive Responsibility.
The controller of personal data processing must
be aware of its processing and informed of the requirements applicable to it.
It is advisable that, in cases of doubtful or controversial interpretation, they consult the Guides, Guidelines, and Opinions issued by the
advisory or data protection authorities, or, where appropriate, submit prior consultations
in accordance with Article 36 of the GDPR.
In the present case, there was a mistake of law (regarding the unlawfulness of
the conduct), but the mistake was not invincible (at least, at the beginning of the processing
and before the publication of the 2021 Labor Relations Guide), since
the UIV had a 2020 report from this Agency (which it was aware of
because it cited it in its DPIA of September 2020) that had analyzed a
equivalent processing activity by a University that conducted exams remotely
using biometric authentication systems based on facial recognition,
and classified it as special category data processing, also noting
that there were other less intrusive alternatives that allowed students to take
exams online, so the processing was neither necessary
nor proportionate. Despite this, the UIV did not submit a prior inquiry to this
Agency to ensure that its processing did not violate the GDPR.
However, although it cannot be considered that there was an error of
"invincible" prohibition on the part of the UIV that would exonerate it from liability, the argument made by the UIV regarding the fact that the criterion applied by the UIV was based on
an erroneous interpretation of the concept contained in Article 9 of the GDPR, which
was "reasonably justified" for a time, can be accepted: until the
new Guidelines 05/2022 were issued by the EDPB in April 2023 and this Agency made public
the criterion followed by the EDPB, which understood that biometric authentication systems
were also special category data, adopting it as its own, in the
Biometrics Guide published in November 2023.
Thus, as indicated in Judgment number 1263/2024 of the Supreme Court of June 25,
issued in relation to a sanction imposed on LALIGA for considering that it made an
erroneous interpretation favorable to the Principle of Transparency, and as previously
pointed out by the jurisprudence cited by the university, and specifically, the Judgment issued by
the Supreme Court on February 27, 2012, when there is a change of criteria (such as
that recognized by the 2023 Biometrics Guide):
“in matters of sanctions, the new criteria, however reasonable
they may be, whether contained in a regulation or derived from a
decision of the Administration interpreting the regulations, must
have their effects on the future but never project onto
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 160/225
past actions that conformed to the criteria then
existing, as well as the fact that the relationship of citizens with the
Administration must be based on a principle of legitimate expectation,
a expectation that can only be generated when there is predictability and
certainty in the actions of the Administration (...)”.
Therefore, it is understood that the UIV can be exonerated from liability only with respect to
the infringement of Article 9 of the GDPR committed during this period (until
November 2023, when this Agency's Biometrics Guide was published), because
it is understood that it acted under a mistake of law that could have been avoided, but that this was
reasonably justified since it was not foreseeable until then that this Agency
would maintain the contrary position under the Principle of Legitimate Expectation of
administrative actions.
This is also interpreted in the most favorable way possible to the infringer, given that
the criterion that clarified this issue was actually established by the EDPB's Guidelines 05/2022 of April 2023, which is the highest
advisory body at the European level, without there being an obligation for the data protection authorities to issue a ruling on the matter for the rules to be considered applicable. However, in the present case, given that the Agency expressed its support for the criteria of the previous Opinion 3/2012 in its previous Labor Relations Guide of 2021, it is accepted that the UIV needed to wait for the Agency to issue a new opinion on the matter, and the commission of the infraction is considered to have occurred from that point forward.
Consequently, it follows from the foregoing that the present allegation may be partially (and not
fully) upheld, with the following scope and effects:
Regarding the infringement defined in Article 9 of the GDPR, the arguments of the UIV (page 76) can be accepted when it states that in no case would it be possible to impose a sanction for the events that occurred before the
publication of the Biometrics Guide of November 2023, by virtue of the
Principle of Legitimate Expectation,” since it was not foreseeable that this Agency
would consider that biometric authentication systems processed special category data until then.
Given that we are dealing with a continuing infringement that persists to this day, the imputation of the infringement committed under
Article 9 of the GDPR can be maintained, considering it to have been committed from November 2023 until
the moment when the UIV demonstrates that it complies with the requirements set forth in
the GDPR for processing special category and high-risk biometric data. or
that it has proceeded to implement an alternative online examination method that does not
process biometric data.
Consequently, the amount of the penalty to be imposed for the
commission of the conduct should be reduced, considering the shorter duration and
number of people affected by the infringing conduct that has been proven in the
proceedings, as indicated in the response to the sixth allegation. And it should be considered that, from that moment on, negligence on the part of the
UIV is present.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 161/225
However, it should be clarified again that no lack of culpability is observed in
the infringing conduct classified in Article 5.1.c) of the GDPR, since in
relation to the necessity and proportionality of the processing there has been
no change of criteria either on the part of the EDPB or this Agency that
justifies the UIV making an interpretation reasonable erroneous based
on this Principle of Legitimate Expectation.
Therefore, the infringement of Article 5.1.c) of the GDPR is understood to have been committed with
negligence from the entry into force of the processing.
However, it is understood that the severity of the sanction
made in the Proposal regarding this infringement of Article 5.1.c) of the
GDPR can be rectified, considering that: (i) on the one hand, there was gross negligence given the
lack of diligence shown by the UIV; (ii) and on the other hand, it is appropriate to continue applying
the aggravating circumstance of processing special category data to this infringement, although
it should be calculated from November 2023, reducing its
duration. Therefore, it is also appropriate to reduce the sanction to be imposed for this
infringement.
5.4. Response to the SIXTH ALLEGATION regarding: “Incorrect application of the
criteria for determining the severity of the sanctions”.
For the reasons set out in the previous paragraph, understanding that it is appropriate to maintain
both Administrative infringements, but reducing the amount of the fines that was initially set
in the commencement agreement and in the proposed resolution, it is appropriate to partially uphold the arguments contained in this allegation, as detailed below:
Regarding the severity of the sanction imposed for the alleged infringement of
Article 9 of the GDPR.
1. Assessment of the nature, seriousness, and duration of the infringement of Article
83.2.a) of the GDPR:
While not all of the arguments put forward are accepted
for the reasons already stated above, it is appropriate to partially reduce the duration of the infringement and consider it to have been committed
from November 2023 onwards.
For the same reason, it is also agreed to reduce the number of those affected by the infringement to those enrolled in the 2023-24 academic year, in accordance with the report issued by the investigating officer on December 16, 2024, as well as those enrolled in the 2024-25 academic year and in subsequent years in which the UIV chooses to continue processing this biometric data without justifying the existence of an exception under Article 9.2 of the GDPR.
2. Assessment of intent or negligence in the infringement [Article 83.2.b) of the GDPR].
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 162/225
In accordance with the foregoing, this claim is partially upheld, considering that from November 2023 onwards, the UIV can no longer justify its misinterpretation of the concept of Article 9 of the
GDPR on the Principle of Legitimate Expectation, which this agency considered
to mean that the biometric authentication system did not process special category data, because the Biometrics Guide of November 2023 clearly stated
the contrary. From then on, there was a lack of due diligence that must be classified as serious, not very serious, as indicated in the
proposed resolution. Since the Guide was published in November
2023, after a preliminary investigation procedure had already been initiated
against the UIV following the complaint filed on May 22,
2023, which led to the processing of this case. And despite
receiving the agreement to initiate this case, which clearly stated
the reasonable grounds to believe that this infringement had been committed, it has not
notified this agency of its intention to rectify its situation in this regard.
It should be clarified that—contrary to what the UIV states on page 82—
the assessment of the degree of culpability present in each infringing conduct is mandatory, without being considered an aggravating factor under the GDPR,
constituting a determining factor that is considered as one of the starting points for setting the sanction.
3. Assessment of the connection between the offender's activity and the processing of personal data [Article 76.2.b) of the LOPD].
The allegations made are dismissed, as it is understood that this criterion for determining the severity of the offense—which, unlike the previous ones, constitutes an aggravating factor—can be applied because the reasons why the Proposed Resolution considers that "the processing operations are inherent to the corporate purpose or main activity of the data controller" have been duly justified, stating the following: "since this consists of the teaching function with respect to students and includes the performance of all types of activities, including administering and grading exams, compiling students' academic records, etc."
It should be added that there is no doubt whatsoever regarding the offender's connection to the
mass processing of students' personal data, which should have
led the UIV to exercise due diligence, given its
familiarity with processing operations, considering the number of
students enrolled each academic year at its university, as documented
in these proceedings.
It is not argued that the UIV's corporate purpose is not to provide university education, but rather that the processing of personal data is
inherent to this corporate purpose, therefore this
argument cannot be accepted.
– Regarding the severity of the sanction imposed for the alleged infringement of
Article 5.1.c) of the GDPR.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 163/225
1. Assessment of the nature, seriousness, and duration of the infringement of Article
83.2.a) of the GDPR:
The allegations made must be dismissed in their entirety because, as already
stated, the error in interpretation regarding the processing of special category biometric data committed by the UIV only affected the
infringing conduct defined in Article 9 of the GDPR, without the
interpretation of this concept affecting in any way the obligation to comply with the
principle of data minimization regulated by Article 5 of the GDPR.
Therefore, the arguments put forward in the Proposed Resolution regarding the existence of this aggravating circumstance should be upheld,
considering the infringement committed from the date the GDPR came into force, and
with respect to students enrolled from the 2019-2020 academic year to the present, whose personal data was processed in a way that
violated the Principle of Data Minimization, since it was neither necessary nor
proportionate. It should also be considered that in this case, multiple alternatives existed
that would have allowed for the verification of the identity of the students
participating in the UIV exams, which were discarded without conducting an
adequate and thorough analysis, nor weighing the benefits and drawbacks that the
implementation of a facial recognition system entailed
in comparison to the alternatives. And, as already stated, this circumstance should not be considered
an aggravating factor, but rather a circumstance that determines the degree of the conduct, the assessment of which is mandatory in all
cases as a starting point.
2. Assessment of intent or negligence in the infringement [Article 83.2.b) of the GDPR].
Rejecting once again the notion that intent or negligence is
considered an aggravating circumstance, it should be clarified that it is not true that
the Proposal considered that there was serious negligence until September
2020 and very serious negligence from July 2023 onwards, as the UIV indicates, but rather that
it stated the following: And with regard to the degree of
concurrent culpability with respect to the infringement of Article 5.1.c) of the GDPR, it is
understood that negligent conduct can be attributed to the UIV from the entry
of the GDPR, although it must be considered serious until
September 2020, when it became aware that Report 0036/2020 had
expressly indicated that processing equivalent to its own could not
be considered either necessary or proportionate, rising to the level of very serious negligence
from then on, since it was aware of this criterion and
continued with the unnecessary and disproportionate processing.”
However, the allegation is partially upheld, considering that
gross negligence was present at all times in the conduct of the
UIV, and it cannot be considered that the degree of negligence increased to very
serious after the first DPIA was prepared in September 2020,
since, although it is true that the UIV did not act with the required diligence
in analyzing the alternatives and the proportionality of the processing, it is also true that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 164/225
it included an analysis of these alternatives in its 2020 DPIA and updated it on
two occasions. Therefore, although the analysis carried out is considered
manifestly insufficient, it is considered that there is no very
serious negligence, but rather serious negligence in compliance with the principle of Article 5.1.c) of the
GDPR.
It is also worth mentioning the actions carried out by the UIV to
adapt The processing of personal data carried out in accordance with the requirements of the GDPR, which, while not sufficient, must be
met.
Therefore, the penalty to be imposed for this infringement should be reduced compared to that indicated in the Proposed Resolution, and
even in the initial agreement.
3. Assessment of the category of personal data affected by the infringement
[Article 83.2.g) of the GDPR].
The allegations made should be dismissed, considering that the application
of this aggravating circumstance does not constitute a violation of the principle of double jeopardy,
since the same conduct is not being penalized twice, but rather
a circumstance is being applied to determine the severity of the penalty, recognized by
the EU legislator, which can be applied to different infringements
committed with respect to the processing of personal data when
they involve special categories of personal data, since this
is considered more serious, but does not form part of the infringement itself. type
offender.
That is, applying this aggravating circumstance to the infringement of Article 9
of the GDPR would be considered a violation of the aforementioned principle, but the
infringement of Article 5.1(c) of the GDPR is committed by carrying out
processing personal data that is neither necessary nor proportionate, which
is independent of the categories of personal data processed, and therefore
it is possible to apply the aforementioned circumstance.
Let us recall that the EDPB itself addresses this
graduated criterion in its guidelines 04/2022, on the calculation of
the administrative fines provided for in the GDPR, in the following
terms:
Regarding the requirement to take into account the categories of personal data
concerned [Article 83(2)(g) of the GDPR], the GDPR
clearly highlights the types of data that deserve special protection
and, therefore, a stricter response with regard to fines.
This refers, at a minimum, to the types of data referred to in
Articles 9 and 10 of the GDPR and to data outside the scope of
these articles whose disclosure would cause immediate harm to the
data subject (e.g., location data, data on
private communications, national identification numbers, or
financial data, such as transaction summaries or credit card numbers).27 In general, the more of these categories of data that are
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 165/225
The more sensitive or critical the data involved, the greater the weight the supervisory authority may give to this factor.
4. Assessment of the connection between the infringer's activity and the processing of personal data [Article 76.2.b) of the LOPD].
This aggravating circumstance is considered to exist, and the allegations made are dismissed for the reasons already stated.
VI. On the existence of an exception to the prohibition of processing under Article 9 of the GDPR, and the legal basis under Article 6 of the GDPR.
6.1. On the need for an exception to the prohibition of processing biometric data.
As already indicated, biometric data, categorized as a “special category” in Article 9 of both the GDPR and the LOPDGDD, are personal data whose use may pose significant risks to fundamental rights and freedoms. Therefore, in principle, their processing is prohibited under Article 9.1 of the GDPR, unless one of the exceptions provided for in paragraph 2 of the same article applies.
Another additional requirement for this type of processing is that, prior to initiating the processing, the controller must also verify and demonstrate that one of the exceptions provided for in Article 9.2 of the GDPR or other specific legislation applies.
Thus, since their processing is generally prohibited, any exception to this prohibition must be interpreted restrictively. As can be deduced from recitals 51 and 52 of the GDPR, which state:
“Such personal data should not be processed unless processing is permitted in specific situations provided for in this Regulation, given that Member States may lay down specific data protection provisions to adapt the application of the rules of this Regulation to compliance with a legal obligation or to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, particularly with regard to the conditions for lawfulness of processing. Exceptions to the general prohibition on processing of these special categories of personal data should be explicitly provided for, including where the data subject has given explicit consent or where there are specific needs, in particular where the processing is carried out in the context of legitimate activities by certain associations or foundations whose objective is to enable the exercise of freedoms.” fundamental.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 166/225
“Likewise, exceptions to the prohibition on processing special categories of personal data must be authorized when provided for by Union or Member State law and provided that appropriate safeguards are in place, in order to protect personal data and other fundamental rights, when it is in the public interest, in particular the processing of personal data in the field of employment law, social protection legislation, including pensions, and for the purposes of security, health surveillance and alert, the prevention or control of communicable diseases and other serious threats to health (...)”
Therefore, the exceptions that could possibly allow the lifting of the general prohibition on processing biometric data aimed at identifying/verifying the identity of natural persons are those provided for in Article 9.2 of the GDPR, with the following wording, which must be interpreted restrictively, always in order to
protect the rights and freedoms of citizens in case of doubt:
“2. Paragraph 1 shall not apply where one of the following circumstances applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more of the specified purposes, except where Union or Member State law provides that the prohibition referred to in paragraph 1 cannot be overridden by the data subject;”
b) the processing is necessary for compliance with legal obligations and the exercise of specific rights of the controller or of the data subject in the field of employment law and social security and social protection, insofar as this is authorized by Union or Member State law.
c) the processing is necessary to protect the vital interests of the data subject or of another natural person, where the data subject is physically or legally incapable of giving consent.
d) the processing is carried out, in the course of its legitimate activities and with appropriate safeguards, by a foundation, association or other non-profit body with political, philosophical, religious or trade union purposes, provided that the processing relates exclusively to current or former members of such bodies or to persons who have regular contact with them in connection with their purposes and provided that the personal data are not disclosed outside those bodies without the consent of the data subjects.
e) the processing relates to personal data which the data subject has manifestly made public.
f) processing is necessary for the establishment, exercise, or defense of legal claims or when courts are acting in their judicial capacity;
g) processing is necessary for reasons of substantial public interest based on Union or Member State law, which must be proportionate to the objective pursued, respect the essential right to data protection, and establish appropriate and specific measures to safeguard the interests and fundamental rights of the data subject;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 167/225
h) processing is necessary for the purposes of preventive or occupational medicine, assessment of the worker's capacity to work, medical diagnosis, provision of health or social care or treatment, or management of health and social care systems and services, based on Union or Member State law or pursuant to a contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
i) processing is necessary for reasons of public interest in the area of
public health, such as protection against serious cross-border threats
to health, or to ensure high levels of quality and safety of
healthcare and medicinal products or medical devices, on the basis of
Union or Member State law which establishes
appropriate and specific measures to protect the rights and freedoms of the
data subject, in particular professional secrecy.
(j) the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in accordance with Article 89(1), on the basis of Union or Member State law, which must be proportionate to the objective pursued, respect the substance of the right to data protection, and establish appropriate and specific measures to safeguard the interests and fundamental rights of the data subject.
Therefore, in addition to verifying beforehand that the processing passes the proportionality test, if the controller does not demonstrate that its processing falls within one of these exceptions, it cannot even begin processing without incurring an infringement of Article 9 of the GDPR.
6.2. Need for a lawful basis for processing under Article 6.1.
In addition to lifting the prohibition on processing, the controller must also demonstrate that processing is permissible because one of the legal bases for processing contained in Article 6.1 of the GDPR applies. These are
general requirements for the processing of any personal data. That is, the
existence of an exception that might hypothetically allow lifting the prohibition on
processing biometric data will not be sufficient; it does not replace the need for
a lawful basis to exist in the case of biometrics. The data controller must be able to demonstrate that both exist, in addition to passing the aforementioned proportionality test, and so on, with respect to the other requirements
stipulated in the regulations. Therefore, we speak of “cumulative requirements” and not
alternative ones.
Thus, Article 6 of the GDPR also starts from the premise that processing personal data in general is exceptional, maintaining that:
“1. Processing shall be lawful only if at least one of the following conditions (commonly referred to as a “lawful basis”) applies:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 168/225
b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary to protect the vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data,
in particular where the data subject is a child.
The provisions of point (f) of the first paragraph shall not apply to the processing carried out by public authorities in the exercise of their functions.
Therefore, if there is no legal basis for processing, in addition to the aforementioned infringements, there would be an infringement of Article 6 of the GDPR, which has not occurred in the present proceedings, where the aforementioned infringement is not alleged.
6.3. Analysis of the existence of an exception and a legal basis in the present case.
In the present case, the processing proposed by the university must have a legal basis under Article 6 of the GDPR because it processes personal data, and an exception under Article 9.2 of the GDPR because it processes special category biometric data. This is because, as previously argued in Legal Grounds II to V of this Resolution, whether the biometric data is processed for the identification of natural persons (comparisons 1 a
various) as if they are used for authentication or verification of the identity of
persons (1-to-1 comparisons), this biometric data are special categories of
data.
Regarding this matter, it is established that the UIV did not include in the
documentation prepared in relation to the processing to which this
file refers an express reference to the legal bases or the concurrent exception,
making a generic reference to the “legal bases of the processing” in the DPIA
which, moreover, did not correspond to that of the RAT, which in itself already constitutes a
breach of its obligations as a data controller
that reinforces the lack of due diligence of the UIV in fulfilling
its duty to adequately document its obligations (Articles 5.2 of the GDPR, and
Article 35.7.a) of the GDPR).
or The RAT provided by the UIV includes a reference to three “Legal bases
used for processing” (1. Explicit user consent obtained
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 169/225
in the pre-contractual and contractual phases; 2. Contract performance; and 3. Legitimate interest
for fraud prevention). The RAT, therefore, does not distinguish between
legal bases and exceptions, using the concept of “legal bases,” which
is not included as such in the new GDPR.
As can be observed in Finding Five, these three legal bases
indicated in the RAT do not exactly coincide with those mentioned
in the 2020 DPIAs or their 2023 and 2024 updates, which refer
to four “legal bases,” adding “public interest” to the
enumerated ones, and clarifying only in the legal basis of Consent
That “The data subject’s consent is the primary legal basis that arises when discussing special categories of data. Although biometric data are not considered special categories of data, VIU has been requesting the consent of individuals wishing to enroll at the University since 2018 (…). No further references to the concurrence of exceptions under Article 9 of the GDPR are found, beyond this statement regarding consent.
Furthermore, when questioned on this matter, the UIV has changed its position regarding the
legal bases and applicable exceptions throughout the proceedings:
In its initial response to the investigation request
submitted by the RAT and the EIPD of November 16, 2023, the UIV maintains a
different version than that contained in the RAT and the EIPD themselves, stating that the
legal bases depend on the purpose of the processing, with 3
purposes:
“For the purpose of verifying, through facial recognition and biometric data, that the student is a party to the educational contract, the
legal bases applied are:
1. The execution of the educational contract.
2. Consent: given upon accepting the general conditions at
the time of enrollment (educational contract). This consent
is given beforehand when the interested party is not yet a student of the
university and has full capacity to choose a university. The
consent is therefore freely given because the student can choose
any university and is not yet subject to university regulations.
For the purpose of verifying the environment with the second camera to prevent fraud:
1. Legitimate interest (no biometric processing is carried out with the data obtained; the environment is only viewed to discourage students from engaging in fraudulent activity and to detect such activity).
For the prevention of fraud in online exams:
i. Legitimate interest. The weighting of this interest is carried out in the impact assessment.
In its written submissions to the Initial Agreement, the UIV changes its initial position on this matter, stating that:
a) The legal bases for processing are consent and legitimate interest.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 170/225
b) And it expressly refers to the existence of two exceptions
(consent under Article 9.2.a) and substantial public interest under Article 9.2.g) of the GDPR),
which have not been reflected as such in the DPIAs for the processing.
or In its statement of objections to the Proposed Resolution—in which it
reiterated that it was not questioning the existence of a legal basis under Article 6, but rather the lack of an exception—the UIV makes no mention
of the legal basis and maintains that the same two exceptions that
were indicated in its previous statement (consent and essential public interest) apply, disagreeing with the conclusions of the Proposal.
In order to comply with the duty to provide reasons for the Resolutions, as outlined in Legal Grounds IV and V, the reasons why the allegations
submitted by the UIV against the Initiation Agreement and the Proposed Resolution are dismissed are set out below,
on the grounds that neither of the two exceptions
whose application is requested by the UIV has been demonstrated. This is because the consent does not meet the
requirement of being freely given, and there is no proven essential public interest that justifies
the processing being carried out through facial recognition.
6.3.1. Response to the allegations against the Initiation Agreement.
Once the investigation was completed and the evidence presented, the Proposed Resolution
responded to the allegations made by the UIV to the Initial Agreement
regarding this issue (sixth to eighth) as follows, which is confirmed by
this Agency, and is transcribed below (between << >>):
<< The following response addresses these allegations to the Initial Agreement
(sixth to eighth), reiterating the reasons why a legal basis
under Article 6.1.e) of the GDPR is considered to exist, and analyzing whether, according to the evidence
provided, one of the exceptions under Article 9.2 of the GDPR applies:
(i) Analysis of the existence of a legal basis for processing students' personal data.
Regarding the legal basis, the eighth allegation in the statement of
objections to the initiation agreement states the following: “There is a legal basis
based on the student's free and full consent, and
on the legitimate interest of both parties, with the Agency bearing the burden of proof since it is a sanctioning body.”
However, it should be clarified that this Agency has not questioned at any
time whether the UIV is acting without a legal basis that legitimizes the UIV to
process personal data according to Article 6 of the GDPR, and proof of this is
that it has not alleged a violation of said provision in the present
proceedings.
The analysis carried out in this regard in the Initiation Agreement was done for
purely clarification purposes, without imposing any liability.
A sound analysis, which this instructor shares, in which: (i)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 171/225
the existence of the legal bases of Article 6.1.b) of the GDPR (necessary for the performance of a teaching contract), and 6.1.f) of the GDPR (existence of a legitimate interest) was ruled out; (ii) but it was acknowledged that the
University had acted on a legal basis of Article 6.1. e) of the
GDPR (because the processing is necessary for the performance of a task
carried out in the public interest), applying the criterion on which this Agency
has already had occasion to rule in relation to the processing of
personal data derived from the necessary evaluation of students
-cited by Report No. 0036/2020 of the Legal Department of this
Agency- which understands that the processing is based on the existence of
a public interest, which is higher education, recognized in Article
46.3 of Organic Law 6/2001, of December 21, on Universities.
Therefore, it is understood that the allegations made regarding the legal basis
which is considered to exist and be proven in favor of the UIV, must be
dismissed as irrelevant, since they do not refer to a matter
disputed or adjudicated in these proceedings.
(ii) Analysis of the applicability of an exception under Article 9.2 of the GDPR
to process students' biometric data (considered a
special category).
It must be emphasized that processing personal data
necessary for student assessment is one thing, and processing
biometric personal data is quite another, as the latter requires a
kind of "extra legitimacy," which is the applicability of one of the
exceptions under Article 9.2 of the GDPR. Because, let us not forget, this type
of processing is so intrusive and sensitive that it is generally prohibited
under the GDPR.
The reasons why neither of these two exceptions applies in the
present case are set out below,
and the sixth and seventh arguments raised against the initial agreement
regarding this issue are rejected:
Regarding the exception provided for in Article 9.2(a) of the GDPR, relating to
the explicit consent of the data subject.
First, the University's sixth allegation refers to
the applicability of the data subject's consent exception established in
Article 9.2(a) of the GDPR:
"(a) the data subject has given explicit consent to the processing of
those personal data for one or more of the specified purposes, except
where Union or Member State law provides that
the prohibition referred to in paragraph 1 cannot be overridden by the
data subject."
In the present case, it has been established by the evidence contained
in the Tenth Finding of Fact of this Resolution, that the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 172/225
University implemented a consent system whereby the student
agreed to submit to a facial recognition and monitoring system
of their online exams, which were presented as the sole method of
assessment.
In its various written submissions, the UIV states that it requests
the student's consent in 3 phases, through 4 different actions
in which they express their acceptance of this evaluation method:
a) “Pre-contractual consent, in which, through the advertising
offered for the course and the general conditions stating that the
course is 100% online, including the exams, the student has the freedom
to choose whether to contract with that University or another.
b) Contractual consent: in which the student expressly consents
upon formalizing enrollment and accepting the general conditions.
This is referred to as the Learning Contract.
c) During the image registration process: upon accepting the privacy policy.
d) Upon installing the application ***APPLICATION.1: which describes in a video
and tutorial how the entire verification process works during the exam.
The following statement made by the UIV is also duly documented, when it indicates
that “all devices used during the exam must be
installed manual and explicit form by the student, which implies an
express and categorical action that reinforces the initial consent by accepting
the conditions.”
For the purposes of data protection regulations, the following should be clarified:
o That it cannot be considered that a student gave
consent in the phase that the UIV calls “pre-contractual”,
since what the University demonstrates during this phase by providing the
documentation published on its website (Evaluation Plan, Evaluation Rules, Master's Program Reports and Catalogs) is that it has fulfilled its duty
to provide prior information on the processing of personal data carried out
as referred to in Article 13 of the GDPR, as has been demonstrated in
the Ninth Proven Fact of this Proposal. Therefore, this implies that
when the contract is signed, an informed decision has been made, which
does not necessarily imply that it is a free decision, as will be discussed later.
o Consent to the processing of biometric personal data as a manifestation of will is not given by the student
until the phase contractual, after signing the teaching contract by accepting
the enrollment conditions provided as Document 3.1.
Prior to this, there was no consent whatsoever. It is established that
in this case - as indicated in the tenth proven fact - that these conditions were
agreed to upon accepting enrollment, in which the processing of biometric data was accepted.
And it has also been established - according to the same proven fact - that in the post-contractual phase (which includes the last two
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 173/225
actions indicated by the UIV), the consent given
by accepting the privacy policy to register on the virtual campus, and by downloading the ***APPLICATION.1 application to be able to
register for exams and generate their biometric pattern, is confirmed and extended. This consent
implies, on the one hand, a confirmation of the consent already given in
the contractual phase, and, on the other hand, an extension to the specific operation
of the program ***APPLICATION.1 whose use is authorized in all its
terms through these two actions.
However, it is not enough for the UIV to be obtaining the student's consent, since consent can be applied as the exception
of Article 9.2.a) of the GDPR for the purpose of lifting the prohibition on
processing special category data. The UIV will also have to demonstrate
that the consent system it has implemented complies with the
requirements and conditions set forth in Article 4.11 of the GDPR, Article 7 of the
GDPR, and Recitals 91 and 93 of the GDPR.
First, it should be noted that, according to the provisions
of Article 4.11 of the GDPR, consent is understood to be “any
specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal data relating to him or her.” Therefore,
consent must be freely given, specific, informed, and unambiguous.
And for the consent exception to apply, it must comply with the conditions set out in Article 7 of the GDPR,
“Conditions for consent,” which include freely given consent:
1. Where processing is based on the data subject’s consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data.
2. Where the data subject’s consent is given in the context of a written declaration which also relates to other matters, the request for consent must be presented in a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, and using clear and plain language. No part of the declaration which infringes this Regulation shall be binding.
3. The data subject shall have the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. The data subject shall be informed of this before giving their consent. Withdrawing consent shall be as easy as giving it.
4. When assessing whether consent has been freely given, and consideration will be given, to the greatest extent possible, to whether, among other things, the
performance of a contract, including the provision of a service, is subject to
consent to the processing of personal data that is not necessary
for the performance of that contract.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 174/225
For its part, Recital 42 of the GDPR states that: (...)
Consent should not be considered freely given where the
data subject does not have genuine or free choice or cannot refuse or
withdraw consent without suffering detriment.”
For its part, Recital 43 of the GDPR clarifies that “In order to
ensure that consent has been freely given, it should not
constitute a valid legal basis for the processing of
personal data in a specific case where there is a clear imbalance
between the data subject and the controller, in particular where
the controller is a public authority and it is therefore unlikely
that consent has been freely given in all the circumstances
of that particular situation. It is presumed that consent has not been
given freely when it does not allow for separate authorization of the different
personal data processing operations, despite being appropriate in the
specific case, or when the fulfillment of a contract, including the
provision of a service, is dependent on consent, even if
it is not necessary for such fulfillment.” (emphasis added)
Well, in the present case, once the documentation
submitted to the proceedings has been analyzed, it can be concluded that the consent obtained
by the UIV can be considered specific, informed, and unambiguous based on the
evidence established in Findings of Fact Nine and Ten of this
Proposal. However, the exception in Article
9.2.a) of the GDPR cannot be applied to this processing, since the consent given in those phases cannot
be considered freely given.
As already noted in the Initiation Agreement, in Report 0036/2020 of the
Legal Department of this AEPD—mentioned and taken into account by the
UIV itself in its The 2020 Data Protection Impact Assessment (DPIA) analyzes in detail how
the student's consent regarding the processing of their biometric data in online exam assessments must be obtained to comply with the
requirements of the exception provided for in Article 9.2(a) of the GDPR, noting
the following (emphasis and comments in parentheses are ours):
“The main problem posed by consent in this case,
given that the student is not in an equal position with the
university where they study, is the requirement that it be
freely given.
In this regard, Recital 42 of the GDPR highlights that: (text copied
above).
And Recital 43, considering situations of inequality such as the
present one, indicates the following (text copied above).
Likewise, Article 7.4. The GDPR stipulates that “When assessing whether consent has been freely given, consideration shall be given to the greatest extent possible to whether, inter alia, the performance of a contract, including the provision of a service, is subject to consent
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 175/225
to the processing of personal data that is not necessary for the performance of that contract.”
According to the Group of 29's Guidelines on Consent, already cited:
"The term 'free' implies genuine choice and control on the part of the data subject. As a general rule, the GDPR states that if the data subject is not genuinely free to choose, feels compelled to give consent, or will suffer negative consequences if they do not, then the consent cannot be considered valid. [...]
When assessing whether consent has been freely given, specific situations where consent is conditional upon the performance of contracts or the provision of a service, as described in Article 7(4), must also be considered. Article 7(4) has been worded non-exhaustively by using the expression 'among other things,' meaning that there may be other circumstances that fall within the scope of this provision. In general terms, consent will be invalidated by any undue influence or pressure exerted on the data subject (which can manifest itself in many different ways) that prevents them from exercising their free will.
Regarding situations of power imbalance, the Guidelines
refer to the case of public authorities and employers. Focusing
on the former, whose considerations, taking into account the configuration
of higher education as a public service, would be applicable to the
case at hand, it states the following:
Recital 43 clearly indicates that it is unlikely that
public authorities can rely on consent to carry out
data processing since, when the controller is a
public authority, there is always a clear power imbalance in the relationship
between the controller and the data subject. It is also clear in
most cases that the data subject will not have realistic
alternatives to accepting the processing (the processing conditions) by
that controller. The Article 29 Working Party considers that there are other legal bases that
are, in principle, more appropriate for the processing of data by
public authorities.
Notwithstanding these general considerations, the use of consent
as a legal basis for data processing by
public authorities is not entirely excluded under the Legal framework
of the GDPR.
And among the examples cited in the Guidelines as showing that the use
of consent can be appropriate in certain circumstances
with respect to processing carried out by public authorities is the
following: “A public school asks its students for consent to
use their photographs in a printed school magazine. Consent in
these situations would be a genuine choice as long as the students were not denied
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 176/225
education or other services and could refuse the use of
said photographs without suffering any detriment.”
Finally, the aforementioned Guidelines conclude that: “Power imbalances are not limited to public authorities and employers, but
can also occur in other situations. As the
Article 29 Working Party has emphasized in several opinions, consent can only be valid if the
data subject can genuinely choose and there is no risk of deception,
intimidation, coercion, or significant negative consequences (e.g.,
substantial additional costs) if they do not give their consent.
Consent will not be freely given in cases where there is an
element of compulsion, pressure, or incapacity to exercise free will.
Based on these criteria, the possibility of admitting students' free consent to the use of facial recognition techniques
to process their biometric data in online assessments
would require that they be offered the option of taking these assessments in a comparable situation where such processing is not necessary, such as completing the same activity
in person, or by offering other alternatives that do not require the
processing of their biometric data and that are comparable in
duration and difficulty to those carried out using
facial recognition; otherwise, for example, if the
alternative activities were more burdensome or involved greater
difficulty, the consent could not be considered freely given. And
what would not be admissible under any circumstances is that, as a consequence of
denying consent, the possibility of enrollment
or access to the assessment, or any other significant negative consequence
for the student, be denied.
It is therefore incumbent upon universities, by virtue of the principle of
university autonomy and as data controllers, and without
prejudice to their oversight by quality assurance agencies, to determine in their
assessment standards and training plans the assessment procedures
that ensure equality between students who consent to the
processing of their biometric data and those who do not. Only in
this way could consent legitimize such processing.
All of this is without prejudice to the fact that consent must also comply with the
other requirements established by the GDPR: explicit, specific, informed, and
revocable.
Well, (…) it is understood that the consent given by UIV students
to the use of facial recognition as an evaluation method
for their online exams is not freely given, based on the following evidence,
which is duly documented in the Tenth Finding of Fact of this Proposal:
(i) First, the University itself acknowledges this in its 2020 Data Protection Impact Assessment (DPIA):
which expressly states that consent will not be
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 177/225
considered freely given in the cases provided for in Recitals 92 and 93
(when there is no genuine freedom of choice, and when there is a
clear imbalance between the data subject and the controller), and
clearly acknowledges that this is the case for its processing, stating
literally that: “The regulations concerning university education seem
to create a clear imbalance between the position of the university and that of the
student, so it could be consider that the consent given by
the student would not be free.”
Therefore, the University itself concludes that the consent system it has implemented does not allow for freedom of choice, and that
there is an imbalance between the University and the student, so the
consent is not free.
(i) And because it is established that the UIV—despite being aware of the
criteria expressed by this Agency in Report No. 0036/2020—did not
offer any comparable alternative (whether in-person or online) to the use of
this facial recognition software for those students who did not
wish to consent to its use. Furthermore, although the aforementioned Report listed
several alternatives that could be valid as an assessment method,
many of which could be carried out 100% online, the analysis of
alternatives contained in the 2020 and 2023 EIPDs refuses to examine them
individually, under the simple generic statement that they are not
valid for conducting 100% online assessments. Further on Reference will be made to this issue, which is directly related to the lack of
necessity of the treatment, as well as the lack of freedom in
giving consent.
(ii) Because it is also established that the failure to provide
consent or subsequent refusal to use the evaluation method
through the software ***APPLICATION.1 had negative consequences for
the interested parties, which are openly acknowledged by the UIV in its sixth allegation, point 4.
Consequently, this implies that: (i) If they do not accept the general conditions,
which include said evaluation system, they cannot
enroll. (ii) If they do not agree to provide their image for the
generation of the biometric pattern upon registering with ***APPLICATION.1,
they appear as “absent” from the exam. (iii) And if they do not allow
their presence and
behavior to be continuously monitored during the exam through facial recognition, they also cannot pass the
evaluation. It is clear and unequivocal that there is no freedom of choice
whatsoever at any stage of the process, and that failure to consent to the
use of the system will result in negative consequences for the student.
The arguments contained in the 2020 Data Protection Impact Assessments (DPIAs) and their
subsequent updates of 2023 and 2024 should be dismissed for the following reasons:
(i) Regarding the argument of potential clients:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 178/225
The DPIA states that: “However, in this case we should not speak of
students but of potential clients, who are not yet
subject to the University and therefore are not in a
hierarchical position with respect to the VIU.” Therefore, if the client is truly aware
of the processing carried out by the University and genuinely wishes
to enroll (being able to freely choose any other educational institution), the act of enrolling
at the University could be considered their consent to the processing in question.
However, those interested in this case, who should be granted
free choice regarding the facial recognition system for
evaluation, are the recipients of the personal data being processed. These are not potential clients, but rather those who have already
acquired student status upon signing the tuition contract
and enrolling at the University by accepting the general
terms.
These students are placed in a position of imbalance and are forced
to consent to the online evaluation system using
facial recognition, because they are not given the option to choose other
alternatives at any time, as previously stated.
(i) Regarding the consent given by signing the tuition contract:
The EIPD points out that: “Furthermore, it should also be noted that the content of the
Civil Code establishes that entering into a contract always implies
the consent of the individual and therefore a positive act that is
recorded at the time of enrollment at VIU. In light of the above,
it can be understood that signing a contract, with the characteristics of the
VIU enrollment process, entails consent, and this
consent refers to the use of facial recognition technology,
the monitoring of activity performed on the screen, and the verification
of the surroundings using a second camera, as well as the other
conditions established in the enrollment process, since these data processing activities are
clearly identified in the documents prior to
contracting. Having said that, consent can be considered
one of the legal bases for processing.”
The University, once again, confuses the legal basis with the exception of the
processing. It is not disputed that the consent given
through a teaching contract can serve the University as
a legal basis for the processing, or an exception. However, the act of signing
a contract requires that the consent be a manifestation of the free
will of the contracting parties, according to Article 1255 of the Civil Code, which
is not the case here.
Nor can the remaining arguments contained in the sixth allegation
of its statement of objections to the initial agreement be admitted, which state that:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 179/225
i. The student has four moments and opportunities to decide whether
to participate in the processing of their biometric data and to grant their
explicit consent. This argument must be rejected, since,
according to what has been explained, this does not imply that the consent
must be freely given, since having different times to decide does not compensate for
the existing imbalance and the lack of other options that force the student to
undergo this treatment.
ii. Furthermore, it is not denied that the system chosen by the UIV
offers benefits to students, but these do not imply that there is no
imbalance in the power dynamic between the University and the Student, and moreover,
these benefits must be weighed against the concurrent disadvantages and harms
when determining whether the processing is proportionate and meets the requirement
stipulated in Article 5.1.c) of the GDPR. Therefore, even if benefits exist,
this does not affect in any way the need to obtain the student's freely given consent,
which is entirely independent and affects compliance with the
requirement to have an exception provided for in Article 9.2 of the
GDPR.
iii. And the fact that the University advertises itself as 100% online is not
an excuse for establishing a single online assessment alternative that
employs biometric identification methods, since there are other
online assessment methods that the University has discarded, but which
could be used without compromising its commitment to being a 100% online university. Among others, continuous assessment methods that do not require
exams, or that allow for the assessment of oral exams conducted by
a professor via videoconference. And the EIPD discards them without conducting
an adequate analysis of alternatives. And the same thing happened with the contracting
of version ***APPLICATION.3 referred to in the third proven fact
of this Proposal. (…)
iv. It is also noted that if the desire to enroll is a factor that prevents
consent from being freely given, then the consent given
for other processing activities associated with the admission and
enrollment process, which are accepted as valid, such as the English language tests, knowledge tests, entrance exams, and other
processing activities associated with the admission process, would also be invalid. In this regard, it should be noted
that biometric data is not processed in these cases, since
consent is not required as an exception under Article
9.2.a), it being sufficient that the general legal basis of
Article 6.1.e) of the GDPR is met.
Therefore, in light of the documentation submitted, it is appropriate to confirm the
application of the regulations established by the Commencement Agreement, determining
that the consent obtained by the UIV does not meet the requirement of
being freely given, as stipulated in Articles 4.11 and 7 of the GDPR, as well as in
Recitals 92 and 93 of the GDPR, since students are not offered the freedom
to choose to be identified by another method of
assessment that does not use a facial recognition system in
online exams, or any other system that does not involve the use of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 180/225
biometric means, resulting in a clear imbalance between the
University and the student, given that it is established that the UIV was aware of and
rejected the use of multiple other alternatives.
Therefore, the existence of explicit consent cannot be taken into consideration to lift the prohibition on processing special categories of data, pursuant to Article 9.2(a) of the GDPR.
(i) Exception under Article 9.2(g) of the GDPR regarding processing for reasons of substantial public interest.
On the other hand, the UIV argues in its seventh allegation against the Agreement that the processing of biometric data by facial recognition systems in online assessment processes could also be justified by the existence of an essential public interest, pursuant to Article 9.2(g) of the GDPR, which states that “processing is necessary for reasons of essential public interest based on Union or Member State law, which must be proportionate to the objective pursued, respect in substance the right to data protection and lay down appropriate and specific measures to safeguard the interests and fundamental rights of the data subject.”
In this regard, it is not currently possible to apply the “essential public interest” exception to biometric processing carried out using techniques known as “E-Proctoring” that employ facial recognition for online examinations, since the processing of biometric data under Article 9.2(g) requires that the “essential public interest” invoked as an exception be provided for in a rule of European law. national, and in this latter case, said
regulation, according to the aforementioned constitutional doctrine and the provisions of Article 9.2
of the LOPDGDD, must have the force of law.
This law, which does not currently exist, must also specify the essential
public interest that justifies the restriction of the right to the protection of
personal data and under what circumstances it may be limited, establishing the
precise rules that make the imposition of such
limitation and its consequences foreseeable to the data subject, without the
generic invocation of a public interest being sufficient for these purposes. And this law must also establish
appropriate technical, organizational, and
procedural safeguards to prevent risks of varying probability and
severity and mitigate their effects.
Applying the aforementioned doctrine to the present case, we must begin with the
recognition of the right to education as a fundamental right
in Article 27 of the Constitution, establishing Article 1 of the Organic Law on Universities (LOU) as higher education as a
public service provided by universities through research,
teaching, and study.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 181/225
Regarding student assessment, Article 46.3 of the LOU states the following:
3. Universities shall establish the procedures
for verifying students' knowledge. In
public universities, the Social Council, after receiving a report from the Council of
Universities, shall approve the regulations governing student progress and
retention at the University, in accordance with the
characteristics of the respective studies.
However, the claim of this right/obligation to verify students' knowledge by universities, despite being enshrined in an organic law, is currently considered insufficient because it does not expressly authorize the use of facial recognition techniques in assessment processes.
The UIV's seventh allegation, regarding "The essential public interest as an exception to Article 9.2 of the GDPR and the basis for processing," points out that the Agency has not taken into account:
The high risk of fraud in online exams and the socioeconomic and sociocultural consequences involved. Among
other factors, the low cultural level of Spain as declared in the PISA Report, the
social acceptance that, according to the University, cheating on exams has in Spain, statistics on the high levels of fraud in
online exams, the risk to the country's economy resulting from not
hiring professionals whose degrees were obtained through
online universities due to the perception of fraud, and that this fraud leads to
the entry of unqualified professionals into the job market, and the risk that
citizens will believe they can obtain degrees without effort.
The rights of the other parties involved, among which
the following stand out:
-The right of public and private sector entities to
hire professionals who have truly met the established
knowledge requirements for a job.
-The right of students who have not committed fraud to obtain a
valid qualification and not a worthless one that has lost its value due to
all the students who have committed fraud because of clearly ineffective
control measures.
-The right of public and private sector entities and the
market in general to be able to trust the value of a qualification obtained
through an online course.
-The student's right to have their knowledge assessed and for their qualification
to be free from any suspicion of fraud.
-The right of citizens, consumers, and users to receive products
and services created by professionals who are committed to achieving
professional and business success through hard work and not fraud.
Both arguments contained in the seventh allegation are considered to be dismissed,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 182/225
They merely point out that the Agency has not assessed the existence
of all the rights of the “other involved parties” related to
quality higher education and the existence of certain factors
present in Spain that increase the risk of fraud in online exams
and the socioeconomic and
cultural consequences this may generate. However, it does not substantiate the existence of these factors, making
assertions such as that Spain's cultural level is the lowest in Europe
and that there are high levels of fraud in online exams according to
statistics and socially acceptable forms of fraud, without providing any data
or reports to justify these claims.
But, above all, even if these factors or affected rights were present, this would still not justify fulfilling the main requirement in this case
for applying the exception in Article 9.2(g) of the GDPR, which is
that the essential public interest mentioned be recognized in a
law that expressly authorizes the processing of biometric data
for carrying out such assessments.
It is therefore confirmed that the exception in Article 9.2(g) of the GDPR does not apply in this case, as indicated in the Initial Agreement,
since the University still does not refer to any
law that indicates that universities or educational centers are authorized to verify the knowledge of their students
through assessment methods that involve the processing of
biometric data.
Furthermore, the UIV has not justified the existence of any of the other
exceptions listed in Article 9.2 of the GDPR.
6.3.2. Response to the objections to the Proposed Resolution.
In the objections to the Proposed Resolution, the third objection is dedicated to denying that Article 9 of the GDPR has been violated. The UIV points out that, contrary to what the Proposal states, the UIV has two exceptions that allow it to process special categories of personal data: freely given consent
under Article 9.2(a) of the GDPR, and the substantial public interest under Article 9.2(g) of the GDPR.
The THIRD ALLEGATION, entitled “Article 9 of the GDPR has not been violated:
the consent given by the students is freely given and the processing is necessary for
reasons of substantial public interest,” insists that the conduct is atypical because
no special category data is processed, but that notwithstanding this, these two exceptions apply in the
present case, which are alleged subsidiarily in the event that the UIV is still considered to have processed special category data, as is the case.
As previously stated, the evaluation method chosen by the
UIV is unique (without possible alternatives) and involves the processing of special category biometric data, the processing of which requires the prior existence of an
exception under Article 9.2 that authorizes it.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 183/225
While it is true that in the current regulatory context, the RIA (Regulation on the Administration of Higher Education)
seems to open the door to the future use of AI systems for
monitoring remote assessments to combat fraud, employing
biometric identity verification systems, the fact remains that there is still no
specific and sufficient legal authorization in the current legal framework to
support the widespread use of remote monitoring systems (***PROGRAM.1) in
higher education, much less to authorize the processing of
biometric data. This is especially true in cases like this one, which combine the use of
student identity verification devices that involve the processing
of biometric data, with remote monitoring devices that perform
automatic analysis of results. Devices that are particularly intrusive and
that carry additional risks beyond those already discussed regarding facial recognition systems in general (section 2.2 of the Resolution).
The use of remote monitoring tools in the evaluation methods of remote examinations could be possible in the future, and this Agency is not
ruling out this possibility. However, their use must always comply with the principles, conditions, and safeguards established in the RIA (if they employ AI systems) and in the GDPR (for the processing of personal data), including the requirement to have an exception under
Article 9.2 of the GDPR that legitimizes data controllers to process special category biometric data.
It is true, therefore, that this system could be implemented in the future through two
possible avenues provided for in Article 9.2 of the GDPR, as has been pointed out by
the data protection authorities of other countries, where there is a law
enabling the use of these methods (unlike the situation in the
Spanish case), such as France, whose “Commission nationale de l’informatique et des libertés” (hereinafter, CNIL), has issued recommendations in this regard
through its Decision No. 2023/0058 of June 8, 2023, in which it states,
among other things, that: “devices for verifying the identity of students that
involve the processing of biometric data could be implemented within the meaning of
Article 9 of the GDPR”:
- either by requesting the consent of the individuals concerned; In that case,
an alternative must be available (candidates could be offered the option to attend
the online exam session in advance to allow the supervisor
time to conduct a document reconciliation, for example);
- or if it is based on an important public interest reason (Article 9(g) of the
GDPR). Next, it must be strictly framed
by text, and human intervention must be possible in case of difficulty
for the student to authenticate.”
However, this is not the case with the evaluation method designed by the UIV,
regarding which neither of the two alleged exceptions applies, for the reasons expressed below:
- Regarding the exception in section 9.2.a) of the GDPR. The consent given by the
students is freely given. Consent must be assessed at the time it is given,
when the contract is finalized, and cannot be demanded subsequently.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 184/225
In this case, as already stated, there is no doubt that the consent
given by the students is unequivocal, express, and informed, but also that it must
be freely given, in the in the sense that alternative assessment methods must be established that allow students to choose between the biometric identity verification systems provided by the software ***APPLICATION.1 (RF) and another possible equivalent assessment method that does not involve the processing of biometric data. This is not the case here, as it is not covered by the exception in Article 9.2(a) of the GDPR.
The allegations made against the Proposal, which focus on asserting that the students' consent was freely given, must be dismissed in their entirety. These allegations essentially reiterate the same arguments previously made against the Initial Agreement, although the legal basis and data offered to support these claims are expanded.
Furthermore, statements are made about the content of the Proposal that do not correspond to what is stated therein, which must be clarified.
Regarding the argument that "The Proposed Resolution errs in considering when consent is given," must be
dismissed as inadmissible, since it referred to the
same moment of contract perfection indicated by the UIV, although it did not
invoke Article 1262 of the Civil Code, without understanding how it is
relevant to the present proceedings when the contract was perfected,
when it is acknowledged both in the initial agreement and in the
proposal that the UIV established a three-phase consent system that was
specific, unequivocal, and informed, and the only issue being whether this consent was
freely given. However, in no case is it a matter of dispute that the
teaching contract was perfected and that the enrolled students gave
this consent, nor is the application of the rules provided for in the Civil Code a matter of contention.
Regarding the alleged lack of imbalance between the student and the
university relationship, this must be confirmed based on the same arguments that
were extensively described in the Proposal and indicated in report
0036/2020 issued by the Office of this Agency.
First, it should be recalled that the 2020 DPIA itself acknowledges that this imbalance exists in the
recruitment process, an imbalance that is now being denied, stating
literally that: “The regulations concerning university education appear
to generate a clear imbalance between the position of the university and that of the
student, so it could be considered that the consent given by the
student would not be freely given.”
Furthermore, it is understood that the interpretation made by the EDPB Guidelines 5/2020
on consent is not an “extensive interpretation of
Recital 43 of the GDPR” that is contrary to law. It is true that
Recital 43 of the GDPR expressly states that consent will not be considered freely given
when “there is a clear imbalance between the
data subject and the controller, in particular where the
controller is a public authority and it is therefore unlikely that the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 185/225
consent has been freely given in all the circumstances of that
particular situation.” But the fact that a Recital (which has an
interpretive and not a binding normative value) that foresees a particular situation in
which occurs does not exclude the existence of a multitude of other
cases in which this imbalance occurs between one individual and another
individual or a private entity, as is the case indicated by
EDPB Guidelines 5/2020 on consent, as a sound criterion.
When Guidelines 5/2020 state that “Power imbalances are not
limited to public authorities and employers, but can also
occur in other situations. As the Article 29 Working Party has emphasized in
various opinions, consent can only be valid if the data subject can genuinely choose and there is no risk of deception, intimidation, coercion or
significant negative consequences (e.g., substantial additional costs) if they do not give their consent. Consent will not be freely given in
those cases where there is an element of compulsion, pressure, or
incapacity to exercise free will.” They are not making an
broad interpretation of this Recital, but rather interpreting the
cases included in Article 7.4 of the GDPR, which establishes
what must be considered to assess whether consent is freely given.
Article 7.4 of the GDPR states that “When assessing whether consent has been
freely given, consideration shall be given to the greatest extent possible to the fact that
the performance of a contract, including the provision of a
service, is made conditional upon consent to the processing of personal data which
are not necessary for the performance of that contract.”
Therefore, the interpretation made by this Agency, based
on the criteria expressed in these Guidelines 05/2020, is considered to be in accordance with
the law, since this provision does not contain a closed
list, leaving open the possibility that there may be more cases than the one
expressly mentioned. As the report 36/2020
mentioned in the Proposal points out: “Article 7, paragraph 4, has been drafted
in a non-exhaustive manner by using the expression ‘among other things’, which
means that there may be other circumstances that fall within the scope of
this provision. In general terms, consent
will be invalidated by any undue influence or pressure exerted
on the interested party (which can manifest itself in very different ways) that
prevents them from exercising their free will.”
It is denied that this “element of compulsion, pressure, or
incapacity to exercise will” was exerted on the students, pointing out that otherwise,
the consent would be vitiated. However, there is no doubt that there is an
element of pressure in this case (not compulsion or incapacity),
since the student is forced to accept being evaluated using
biometric methods in order to enroll at the center, take the exam once
enrolled, and continue there. Given that there are negative
consequences if they do not accept it, as explained in the Proposal.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 186/225
Despite the UIV's continued denial that There are no “significant” consequences for students as defined by the CEPD Guidelines
05/2020, because it is understood that they can choose not to enroll and go to another center. Therefore, what has been stated
from the beginning in report 36/2020 is applicable, namely:
“Based on these criteria, the possibility of admitting free
consent from students that would allow the use of
facial recognition techniques to process their
biometric data in online assessments would require that they be
offered the possibility of taking these assessments in a
comparable situation where such processing is not necessary, such as
completing the same activity in person, or
offering other alternatives that do not require the processing of their
biometric data and that are comparable in duration and
difficulty to those carried out using facial
recognition; Because in another case, for example, if the alternative activities were more burdensome or involved greater difficulty, the consent could not be considered freely given. And what would not be admissible, under any circumstances, is that as a consequence of the refusal of consent, the possibility of enrollment or access to the assessment, or any other significant negative consequence for the student, be denied.
The argument is repeated that this “element of compulsion,
pressure, or inability to exercise free will” did not exist in the students who were
forced to enroll at the UIV, since they have the free option not to
enroll and choose one of the other 86 universities that offer courses in
Spain, but prefer to enroll at the UIV knowing that it is a
100% online university, operating in a non-face-to-face format.
In this regard, this argument should be rejected for the reasons that were
clearly developed in the Resolution Proposal, insisting that
as indicated in report 36/2020, deciding not to contract with the UIV and going to another
university because of not accepting the facial recognition evaluation method
is not a valid free option. This is because it would apply to the “potential
clients” that the UIV referred to in its allegations to the initial agreement, and not
to the interested parties whose biometric personal data is processed
after contracting. It is these interested parties, who subscribe the contract to which it must
offer other evaluation alternatives so that they can choose between the
biometric system or other systems, and this choice is considered free.
Furthermore, in expanding the legal basis of this argument, it should be noted
that the UIV contradicts itself, since it references Article 2.1 of
Law 7/2008 of June 13, on the recognition of the International University
of Valencia, which states that the UIV “will organize and deliver undergraduate
and postgraduate (master's and doctoral) programs, predominantly in a non-classroom-based format, and will develop other non-official programs, as well as activities
of an educational, scientific, and cultural nature,” and in Article 2.1: “Its educational
offering will focus, preferably, on non-classroom-based education based
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 187/225
on the intensive and extensive use of information and communication technologies Communication (hereinafter, ICT).
Therefore, the argument that the UIV is legally obligated to deliver and organize all its courses remotely, even if they are "predominantly in-person," cannot be accepted. Rather, it is the UIV that has decided to deliver its courses 100% online and, among the multiple methods that would allow for online assessment, to establish as the sole and mandatory method one that uses facial recognition throughout the entire exam, which is appropriate and legitimate
in the exercise of its academic and university freedom. But the UIV cannot
simultaneously argue that it cannot use in-person assessment methods because it is obligated to organize the entire process online (when this is not true), or that it cannot use other online assessment methods (when there are multiple alternatives for online assessment
of students, known in the market and used for years, which
allow for effective student identification, and which the UIV has decided to discard).
It is argued that the criterion of understanding that an imbalance exists because there is an
"element of compulsion, pressure, or inability to exercise free will"
as indicated in ECDC Guidelines 05/2020 affects the constitutional right
to freedom of enterprise, and even to academic freedom:
The UIV bases this argument on statements such as "this Agency intends
to determine how my client should evaluate its students," or that "what
cannot be expected is that, once the students have freely accepted
the General Conditions and the contract between my client and
the students has been finalized, VIU should be forced to subsequently modify the terms of the
contractual relationship to allow for alternative evaluation methods," without
referring to the passages in which such
statements have been made, which, of course, do not exist, since they are
an interpretation made by the UIV that is far removed from what has actually been argued.
It is necessary to categorically deny that this Agency questions or has questioned
at any point in the proceedings the freedom of enterprise,
teaching, or university professorship of the UIV.
It has not been determined at any time how the UIV should evaluate its
students, much less asserted that it should breach its teaching contract
and change the evaluation method that had been designated
for enrolled students, which could indeed constitute a
breach of its contract in accordance with Article 1256 or 1258 of the
Civil Code. There is not a single reference to this argument in the
Proposal, therefore these considerations must be rejected outright as being
entirely unfounded.
The freedom of enterprise, teaching, and university professorship have been
considered throughout the entire proceedings. References to other
assessment alternatives have always been limited to listing several
possible online assessment options that had been identified, without indicating
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 188/225
which of these options should be applicable, which is a free and
exclusive decision of the UIV.
All these references have always been made in a generic way,
listing all the alternatives that the UIV itself had listed in its Data Protection Impact Assessment (DPIA),
without ever mentioning which option(s) would be considered valid, with the
purpose of:
a) Responding to the arguments previously formulated by the
UIV, ruling out the possibility that the UIV could excuse itself by claiming that there are no other
alternatives for evaluating its students 100% online, pointing out that there are
multiple other alternatives on the market that do not use
biometric methods. Or that the Principle of Legitimate Expectation can be applied
to the infringement of Article 5.1.c), because there are other alternatives that do not
require the processing of biometric data and were less intrusive.
b) And in order to comply with the duty to provide reasons, as it is necessary to
substantiate the commission of the alleged infringements, reference has been made
to these alternatives to point out that the consent was not
freely given, and that the processing was neither necessary nor proportionate.
What was denied by the Proposal and confirmed in this Resolution is not the
freedom that the UIV has to choose to make 100% of its assessments
online, nor is it the possibility of evaluating using this facial recognition method
through the ***PROGRAM.1 system developed
by ***APPLICATION.1, but rather, to justify the lack of free
consent from students (in which they are offered alternatives that do not process biometric data), the UIV hides behind the argument that, being obligated to provide
100% of its services online, it is not possible to implement any other effective
mechanism.
It should be remembered that what the Proposal actually pointed out is not what the UIV intends to convey in its arguments, but rather:
• It pointed out that, according to the legal requirements for consent to be considered freely given (Article 4.11 of the GDPR, Article 7 of the GDPR, Recitals 91 and 93 of the GDPR), the general rule in the existing relationships of subordination between a university and its students is that there is no freely given consent that would allow them to reject certain contractual conditions—such as submitting to evaluation methods involving facial recognition—because there is a clear imbalance between the parties that invalidates the consent given, given that if they do not accept the contract under these conditions, they suffer a series of disadvantages (not being able to enroll, being considered absent, or being forced to withdraw, etc.).
Having analyzed the present case, the evidence was noted that proves
that, as the system for consent to
the use of RF-based assessment methods at UIV was structured, the student
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 189/225
expressly accepted this enrollment condition (Art. 9, Enrollment Conditions), but that both conditions were met, leading to the conclusion that, as a general rule, consent is not freely given (imbalance and harm
in the event of not accepting the single established assessment method).
However, in favor of the university, it is considered that there could be
an exception in which the student's consent to
the use of these biometric methods would be freely given, namely, that
the student be offered other assessment alternatives that do not involve
the processing of biometric data, thus allowing them to choose between
both. And it was noted that the UIV was aware of other assessment alternatives
that employ non-biometric methods, without adequately justifying
why the system used was necessary and
proportionate compared to these methods. Therefore, it could not be
stated that there are no other possible alternatives for assessment
in person or online, which, combined or individually,
would allow the UIV to fulfill the purpose of identifying the student
participating in the exams and preventing fraud/plagiarism. This is confirmed
by this Resolution.
Nor can it be accepted that “The AEPD’s argument implies the elimination
of citizens’ consent as a legitimate basis for the use of their
biometric data,” since what is being established are the requirements that
should be met in order to accept consent as an exception to
Article 9.2.a) of the GDPR in cases such as this one, referring to
the need to include in the contract the possibility of opting for other
equivalent biometric assessment methods that do not produce
negative consequences for the student. Without it having been indicated at any point
which specific evaluation method(s) the UIV might choose.
This is done for the sake of clarity, under penalty of being
unfairly accused of violating the fundamental rights of freedom of
enterprise, teaching, or academic freedom. It must be said that the UIV had and
has the freedom to implement or not implement any other evaluation methods for its
students that it wishes, but this freedom does not authorize it to choose evaluation methods that involve the processing of biometric personal data without
complying with the requirements set out in the GDPR.
Nor is it understood that the right to identity of students, which includes the right to use the identification systems they deem appropriate, including biometric ones, is being “flagrantly violated,” given that what is being proposed is that they be offered a choice between biometrics and the alternative methods that may be established, provided that the biometric assessment systems implemented comply with all the requirements stipulated in the GDPR. It is not true that “the Biometrics Guide has prohibited the consensual use of these systems in general,” since it refers to the same requirements that have been indicated in this procedure and that would justify this exception.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 190/225
- Regarding the exception in Article 9.2.g) of the GDPR. “The processing is justified
for reasons of essential public interest, as recognized by the Spanish Data Protection Agency (AEPD) in previous cases.”
As mentioned above, another exception that could enable this type of processing of special category biometric data for the purpose of verifying the identity of students and controlling fraud in distance learning exams would be processing for reasons of essential public interest, pursuant to Article 9.2.g). However, this requires that the “essential public interest” alleged as an exception be established in a European or national law. In the latter case, this law must have the force of law, according to the aforementioned constitutional doctrine and the provisions of Article 9.2 of the Spanish Data Protection Act (LOPDGDD).
As previously stated, according to Constitutional Court Ruling 292/2000 (RTC 2000,
292), it would not be sufficient for the rule to make an invocation that allowed for the treatment "through generic concepts or vague formulas"; and according to what was stated in Judgments No. Judgment 76/2019 of May 22: “In view of the potential
intrusive effects on the affected fundamental right resulting from the processing of
personal data, the jurisprudence of this Court requires the legislator, in addition to complying with the aforementioned
requirements, to also establish adequate technical, organizational, and procedural safeguards that prevent risks of varying probability and
severity and mitigate their effects, since only in this way can respect for the
essential content of the fundamental right itself be ensured.” It analyzes which rule should contain the aforementioned safeguards (…) The provision of adequate safeguards cannot be deferred to a
subsequent moment after the legal regulation of the processing of personal data in question.
Adequate safeguards must be incorporated into the legal regulation of the processing itself,
either directly or by express and clearly defined reference to external sources that
possess the appropriate normative rank (...)”,
Any rule establishing vague or imprecise formulas will not suffice; rather,
the law must also specify the essential public interest that justifies the
restriction of the right to the protection of personal data and under what circumstances
it may be limited, establishing precise rules that make the imposition of such a limitation and its consequences foreseeable to the data subject. A generic invocation of a public interest is insufficient for these purposes.
Furthermore, the law must establish appropriate technical, organizational, and procedural safeguards that
prevent risks of varying probability and severity and mitigate their effects.
That is, if the EU or national legislator deems it appropriate, it would be possible in the future for enabling legislation to be enacted for these types of systems. This legislation could, in some cases, expressly establish a reinforced set of measures and safeguards to ensure their compliance with the principles of legality, necessity, and proportionality. Based on a fundamental legal framework, universities could then implement specific measures, taking into account their autonomy.
The possibility of these techniques could be considered, in particular, in fully online university programs, structurally and, in any case, providing for alternatives, including exceptional circumstances, and complying with the other requirements set out in the GDPR.
This could be done while ensuring compliance with the other requirements stipulated in the GDPR.
That is, if the EU or national legislator deems it appropriate, it would be possible in the future for enabling legislation to be enacted.
... However, at present, it is not possible to justify the processing of biometric data
carried out by the UIV under the exception in Article 9.2.g) of the GDPR, since as of today
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 191/225
there is no specific and sufficient authorization in current legislation to support the widespread use of biometric methods for verifying
identity in exam assessment and monitoring, nor in
higher education, nor at any other educational level in Spain.
Thus, on the one hand, Article 6 and Annex III of the RIA do not currently constitute an enabling basis for the use of these methods, since they only open the door to the generic use of AI biometric verification systems if the requirements established therein are met, but do not contain an authorization that expressly states that personal biometric data derived from the use of these AI systems may be processed, and expressly refer to Article 2.7 of the GDPR to regulate aspects related to the protection of the personal data processed. It does not establish any of the necessary aspects that must be defined by the enabling regulation referred to in the aforementioned constitutional doctrine (cases, conditions, limits, and guarantees of exercise).
Nor do the organic laws cited by the UIV (Article 46.3 of the former LOU and Article 33.f) of the current LOSU) constitute an enabling regulation under which this type of treatment can currently be justified. Therefore, the arguments presented by the UIV must be rejected for the following reasons:
First, it is pointed out that the Proposed Resolution erred in its analysis of Article 46.3 of the LOU (University Organic Law 6/2001 of December 26), since this article has been repealed by the LOSU (Organic Law 2/2023 of March 22, on the University System), which addresses this issue in Article 33.f), which, in its view, does provide sufficient coverage for the use of biometric systems in assessment tests.
Firstly, it should be noted that the Proposed Resolution did not err in its analysis of the application of Article 46.3 of the LOU, since: (i) it is the data controller who must allege the exception they consider applicable, and under which rule the essential public interest of Article 9.2.g) of the GDPR is protected, the UIV being the one that referenced this provision of the former LOU, which is why it was analyzed in response to their allegations regarding the initial agreement; (ii) and furthermore, this provision was the one that remained in force until the entry into force of the new LOSU, which is March 2023, and therefore it was applicable to the processing carried out.
However, once the content of Article 33.f) of the new
LOSU has been analyzed, it is understood that it also does not recognize that there is an
essential public interest in carrying out an evaluation by biometric methods,
just as its predecessor in the LOU did not, since in no case is there any
express reference to the student having the right or the university having the
obligation to evaluate through biometric means.
Article 33.f) of the LOSU, cited by the UIV, states that:
“In relation to their academic training, students shall have the following rights, without prejudice to those recognized by the university student statute approved by the Government: […]
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 192/225
f) To an objective evaluation and to the publication of the rules governing the procedures for evaluating and verifying knowledge, including the grade review procedure and the available appeal mechanisms.”
Therefore, it is understood that this regulation also does not serve to justify that the processing of special category biometric data is necessary to fulfill an essential public interest declared in a law, since for it to be applicable, this possibility of evaluating through biometric means would have to be expressly specified, as well as the assumptions, limits, guarantees, and conditions of its use, in accordance with the
The case law cited above, to which we refer,
in order to avoid unnecessary repetition.
Nor can this exception be based on the references made by the UIV
to other provisions of the LOSU (Article 2.2; 5.1, 33.b), 36 and 37), for the same
reason.
The excerpts from the Resolution to close proceedings issued by this
Agency in case 202200367 of UNIR and report 36/2020 that are
transcribed by the UIV never supported the existence of an exception
of Article 9.2.g) of the GDPR, based on Article 46.3 of the LOU, but rather on a
legal basis of Article 6.1.e) of the GDPR, as can be literally deduced from
them. Once again, the lack of understanding of the controller's obligations is evident, as they repeatedly confuse the need for a legal basis with the need for an exception.
Finally, the reference to the Judgment of the Administrative Chamber of the Supreme Court of July 2, 2007, issued in appeal no. 5017/2003 (RJ\2007\6598), which states that in an employee-administration relationship "the consent of the data subject was not necessary since the purpose of the processing, consisting of monitoring compliance with legal and contractual obligations by the data subject, was inherent to the relationship between the data subject and the controller," is not at all applicable to the present case, nor does it serve to argue that this exception applies, since it refers to the fact that consent is not necessary in that case.
This has already been addressed in Legal Basis V, in response to the
allegations, explaining why the CCN report, the RIA, and Directive 2024/2831 do not
exclude the obligation to comply with the requirements of the GDPR
when processing special category biometric data,
among which is the requirement for an exception to apply.
Therefore, it can be concluded that the UIV has violated the prohibition established
in Article 9.1 of the GDPR, since the investigation shows that
it has been processing special category biometric data
(facial recognition) which is generally prohibited since the GDPR came into force, and this prohibition has not been lifted to date, as
none of the exceptions provided for in Article 9.2 apply. Specifically: (i) neither the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 193/225
exception of Article 9.2.g of the GDPR, given that there is currently no
law authorizing universities and other educational institutions
to process biometric data for this purpose (verification of the identity of
students in order to prevent possible fraud in the evaluation processes); (ii) nor
the exception of Article 9.2.a) of the GDPR, given that the consent given by the
student to the evaluation by biometric methods does not meet the requirement of being
"freely given," since its acceptance is currently mandatory in order to enroll and
be evaluated by the UIV, without any freedom of choice or the offering of any
alternative evaluation method; (iii) and, furthermore, the UIV has not justified the
existence of any other exceptions provided for in Article 9.2 of the
GDPR.
In conclusion, following the investigation, it can be confirmed that the UIV has committed the
infringement of Article 9.1 of the GDPR, by processing special category personal data
without having an exception under Article 9.2 of the GDPR that authorizes it to do so.
VII. On the breach of Article 5.1.c) of the GDPR.
7.1. On the requirement that processing be necessary, suitable, and proportionate.
One of the obligations of every data controller is to ensure that processing complies with the principles set out in Article 5 of the GDPR.
In the case of biometric data, given its special category and high risk, it is essential to respect the principle of data minimization, as set out in Article 5.1.c), which states:
“1. Personal data shall be:
a) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’).”
This is confirmed by Recital 39 of the GDPR, which underlines the importance of processing being necessary, stating that “Personal data should only be processed if
the purpose of the processing cannot reasonably be achieved by other means.”
Along the same lines, the Article 29 Working Party, in its Opinion 3/2012 on the evolution of biometric technologies, states:
“When analyzing the proportionality of a proposed biometric system, it is necessary
to first consider whether the system is necessary to meet the
identified need, that is, whether it is essential to satisfy that need, and
not merely the most suitable or cost-effective. A second factor to be taken into account is
the likelihood that the system will be effective in meeting the
need in question in light of the specific characteristics of the
biometric technology to be used. A third aspect to consider is
whether the resulting loss of privacy is proportionate to the expected benefits.
If the benefit is relatively minor, such as greater convenience or slight
savings, then the loss of privacy is not appropriate. The fourth aspect
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 194/225
to assess the suitability of a system Biometrics involves considering whether a less invasive means of privacy would achieve the desired end.
Furthermore, as the Court of Justice of the European Union itself has indicated
in its judgment of 4 October 2024 in Case C-446/21, the provisions of that
provision reflect the principle of proportionality (emphasis added):
“49 Moreover, Article 5(1)(c) of this Regulation, which
enshrines the so-called principle of ‘data minimization’, stipulates that
personal data must be ‘adequate, relevant and limited to what is necessary
in relation to the purposes for which they are processed’ [judgment of 4 July
2023, Meta Platforms and Others (General Terms of Service of a Social Network), C-252/21, EU:C:2023:537, paragraph 109 and the case law cited therein].
50 As the Court of Justice has already stated, this principle reflects
the principle of proportionality [see, in this regard, the judgments of 22 June 2021, Latvijas Republikas Saeima (Points for traffic violations), C 439/19, EU:C:2021:504, paragraph 98 and the case law cited therein, and of 30 January 2024, Direktor na Glavna direktsia Natsionalna politsia pri MVR — Sofia, C 118/22, EU:C:2024:97, paragraph 41]”.
Respect for this principle in Article 5(1)(c) of the GDPR must be the starting point for any processing, and the controller must consider whether such processing is truly necessary, appropriate, and proportionate before initiating it. And when there is a
probability that the processing entails a high risk—as is the case with
biometrics—there is an obligation to document this within the DPIA, since it
must contain “(b) an assessment of the necessity and proportionality of the
processing operations with respect to their purpose,” in accordance with Article 35.7.
(b) of the GDPR.
We are, therefore, dealing with a provision that ensures the necessity and proportionality
of the processing, and these elements can only be analyzed from the perspective of and in comparison with other processing methods that, while equally possible, are less
invasive with regard to the fundamental right to data protection.
Therefore, if there is processing that, achieving the same purpose, is less invasive
and, therefore, more proportionate in respecting the fundamental right to the protection
of personal data, its application must prevail.
Both the obligation to process only “personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed,” as provided for by the data minimization principle in Article 5.1(c) of the GDPR, and the assessment of the necessity and proportionality of processing in the DPIA according to Article 35.7(b) of the GDPR, must be interpreted in accordance with the established case law of our Constitutional Court regarding the need to verify that any measure restricting fundamental rights (processing operations involving biometric data in this case) passes what is known as the “triple proportionality test.”
The regulations and criteria set forth imply that, first and foremost, the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 195/225
responsible party considering using systems such as biometric identification, which
involve high risk and process special category data, must consider and verify
that the proposed biometric processing meets the following three requirements or
conditions that the Constitutional Court demands for the imposition of any measure
restricting fundamental rights. According to Judgment number 14/2003, of January 28,
these three requirements, which form part of the so-called “triple proportionality test,” impose the obligation to verify beforehand: “whether such a measure is
likely to achieve the proposed objective (suitability test); yes, in addition, it is
necessary, in the sense that there is no other less restrictive measure to
achieve the same objective with equal effectiveness (necessity test); and, finally, whether it is
proportionate or balanced, in that it yields more benefits or advantages for
the general interest than harm to other conflicting rights or values (proportionality test in the strict sense).
The requirement to carry out this three-part proportionality test prior to processing is
specified with regard to biometric data in paragraph 72 of Guidelines
3/2019 on the processing of personal data by means of video devices, of
29/01/2020, from the EDPB, which states: “The use of biometric data and, in particular,
facial recognition carries high risks to the rights of data subjects. It is essential that the use of these technologies be carried out in due compliance with the principles of lawfulness, necessity, proportionality, and data minimization, as established by the GDPR. Although the use of these technologies may be perceived as particularly effective, data controllers must first assess the impact on fundamental rights and freedoms and consider less intrusive means of achieving their legitimate processing objective. In other words, the question must be answered as to whether this biometric application is truly essential and necessary, or merely "convenient."
The fact that the suitability, necessity, and proportionality analysis must be
“prior” to the start of any processing implies that it must therefore be carried out
before the actual execution of the processing, during its design phase, as
deduced from the regulations and criteria set forth, which are a further manifestation
of the Principle of data protection by design referred to in Article 25 of the GDPR, which is one of the basic guiding principles on which the new
GDPR regulation is based, and establishes the following (emphasis added).
“1. Taking into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement, both at the time of determining the means of processing and at the time of processing itself, appropriate technical and organizational measures, such as pseudonymization, designed to effectively implement the principles of data protection, such as data minimization, and to integrate the necessary safeguards into the processing, in order to comply with the requirements of this Regulation and to protect the rights of data subjects.
2. The controller shall implement appropriate technical and organizational measures to ensure that, by default, only personal data that are necessary for each specific purpose of the processing are processed. This obligation shall apply to the amount of personal data collected, the extent of its processing, its storage period, and its accessibility. Such measures shall ensure, in particular, that…” By default, personal data shall not be accessible, without the intervention of the data subject, to an indeterminate number of natural persons.
3. An approved certification mechanism may be used pursuant to Article 42
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 196/225
as evidence of compliance with the obligations established in paragraphs 1 and 2 of this Article.”
As indicated in the Guide on Risk Management and Data Protection Impact Assessments (DPIAs) published by this Agency
in June 2021, the suitability, necessity, and proportionality assessment must be analyzed
in the preliminary design phase, even before the operational design begins,
to avoid decisions that involve investments in processing activities that
may not meet the requirements because they are not suitable, necessary, or
proportional, as defined by the GDPR and in accordance with our Constitutional Court.
That is, the assessment of suitability, necessity, and proportionality must lead to
a decision on whether the processing is viable or not, given its current form. As the aforementioned Guide states: “when it is not
possible to demonstrate the necessity and proportionality of high-risk processing
or of the processing operations that may form part of it, it is not
recommended to proceed with the data protection impact assessment or even
to initiate the prior consultation referred to in Article 36 of the GDPR.”
In the present case, it is therefore necessary, first and foremost, before assessing
whether the other requirements established by the GDPR for the processing
of biometric data such as this are met, to assess whether the processing of personal data
that the UIV has been carrying out since the GDPR came into force passes the aforementioned
triple proportionality test, complying with the requirements of suitability, necessity,
and proportionality as established by the aforementioned Constitutional Court ruling.
In this regard, it should be clarified preliminarily that this Agency is aware of the evolving regulatory context in which we find ourselves, and does not rule out the possibility that the processing of special category biometric data based on remote online exam monitoring tools, intended to control fraud, may be necessary and proportionate in some cases where it is fully justified. However, we understand that this must be based on a thorough prior analysis, taking into account the real risks of fraud that are intended to be avoided and their consequences. All of this is aimed at preventing excessive interference with the fundamental right to data protection of the data subjects.
However, in the present case, these requirements are not met because the processing that
was designed by the UIV opted to use a single evaluation method based on
a biometric identity verification system combined with remote monitoring tools that perform automated analyses using AI techniques, which
are considered particularly intrusive, without justifying that: (i) this was necessary when
other less intrusive evaluation alternatives existed that could have been used
to achieve its purposes; (ii) nor that it was proportionate, generating
greater benefits than harm to the rights and freedoms of the data subjects.
7.2. Preliminary clarifications on the suitability, necessity, and
proportionality analysis carried out by the UIV.
In light of the background information in this file, the UIV submits a Data Protection Impact Assessment (DPIA)
dated September 2020 and two updates made in July 2023, and
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 197/225
January 2024, in which it corrected errors made in the original description of the
processing that had been carried out since March 18, 2020, when the advanced version of the program ***APPLICATION.1 had already been upgraded, which included the four
exam monitoring tools, in addition to identity verification through
facial recognition, which had been in place since the initial contract in 2015.
All of this has been clarified in the Fifth Finding of Fact of this Proposal.
To the initial confusion arising from the lack of correspondence between the index and the sections contained in the DPIAs, as well as the document titles,
we must add the confusion caused by the fact that in its statement of allegations to the initiation agreement of May 21, 2024, the UIV does not indicate that it had carried out a new update of the DPIA in January 2024, and submits as Document 1 a report on the balancing of the legitimate interest of the processing, which states that an update of the DPIA was carried out in January 2024, in order to include the same. This update was carried out after the present sanctioning procedure had already begun.
The second point to highlight is that neither the 2020 DPIA nor its update annex contains a complete analysis of the suitability, necessity, and proportionality. No single section is dedicated to this particular issue; rather, the assessment appears to be scattered
across several sections, which are not sequential. Some of these sections
use the terms necessity and proportionality, while others are related
but not explicitly defined as such. Furthermore, there are no references to the suitability of the
treatment, only to effectiveness controls.
The present proceedings will focus on determining whether the alleged infringement of
Article 5.1.c) has occurred, which refers to the fact that the
treatment—as configured—did meet the requirements of
suitability, necessity, and proportionality. And for this purpose, all sections of the Data Protection Impact Assessment (DPIA) and its updates will be assessed, even if they are not explicitly named as such but could be related to this three-part proportionality test, as well as the rest of the documentation describing the processing, and the arguments made in this regard in the ninth allegation against the initial agreement and in the fourth allegation against the proposed resolution.
Another point to note is that the University acknowledges in the first section of its
2023 Data Protection Impact Assessment (DPIA), dedicated to the purpose of the 2023 DPIA, that the UIV
is interpreting the current regulations in a way that is considered complex and
confusing, and that this interpretation should be consulted with this Agency, stating that:
“The CRUE Working Group, comprised of Data Protection Officers from Spanish universities,
considers facial recognition techniques inadvisable,”
therefore, a DPIA is deemed necessary.
Due to its technical complexity and the high level of requirements that the legislation
places on the use of biometric data, this issue can only be addressed
through a data protection impact assessment.
Furthermore, the lack of clarity in the regulations necessitates a process of
interpreting the authorizations for its use, which makes it advisable to:
1. Obtain an express ruling from the competent data protection authorities.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 198/225
2. Define the compliance model together with them.
3. Consider the regulatory conditions that offer adequate legal certainty.
However, there is no record that this Agency was consulted beforehand to clarify these doubts, which the UIV decided to resolve contrary to what had already been analyzed and resolved by this Agency in all the reports it reviews in its DPIA, as stated in the Data Sensitivity Report of the 2023 assessment.
As already mentioned in response to the allegations in Legal Basis V, unlike what occurred with the breach of Article 9 of the GDPR, the alleged breach of Article 5.1.c) of the GDPR cannot be considered to be based on an error in the interpretation of the applicable regulations,
based on the Principle of Legitimate Expectation. It is established that the UIV initiated the processing
in 2020.
It is established that the UIV did not act with due diligence, not basing its error on a
reasonable interpretation of the regulation, since when drafting its first DPIA in 2020 it was
perfectly aware that the criteria of the EDPB and this Agency were and are contrary
to its own, and yet it decided to follow its own (erroneous) criteria, not to submit a prior consultation, and to continue with the processing contrary to the provisions of the GDPR. And all this, despite the fact that the advisability of submitting a prior consultation was indicated in a similar case
in which a university was considering the same dilemma.
Finally, before entering into the analysis of the triple proportionality test, it is worth
recalling that the Principle of Article 5.1.c) of the GDPR entails the obligation to carry out
a prior analysis that must be performed before implementing any processing of
personal data, and not only of special category biometric data. Therefore,
it would also be inadmissible, under any circumstances, for the UIV to decide to implement
unnecessary and disproportionate processing, on the grounds that it does not process biometric data
of a special category. Thus, the fact that the implemented processing includes this
type of biometric data is an aggravating factor, which is considered when
determining the penalty, but it is not a requirement of the offense, which is committed with any
type of processing of personal data that is unnecessary, unsuitable, or disproportionate.
7.3. Regarding the failure to pass the suitability, necessity, and
proportionality analysis carried out by the UIV.
In light of the documentation and arguments presented, it is therefore necessary to analyze whether
the intended processing passes the so-called triple proportionality test, which,
according to the aforementioned doctrine of the Constitutional Court, entails analyzing the
following:
1. Whether the processing is capable of achieving the proposed objective (suitability test).
The aim is to determine whether the processing is appropriate for its intended purpose. That the processing addresses specific needs, demands, requirements, or objective obligations or opportunities, and can achieve the proposed objectives with sufficient effectiveness.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 199/225
Regarding this issue, the ninth allegation in the statement of objections to the initial decision states the following: “The application of ***APPLICATION.1 is necessary, suitable, and proportionate.
1. Suitability Assessment
The Spanish Data Protection Agency (AEPD) does not dispute that facial recognition can be a suitable and effective tool to ensure that the individual taking the exam is the same person who registered, that is, to achieve the proposed objective.”
In this regard, as the University points out, the Initial Agreement stated that
“this Agency does not question that facial recognition can be a suitable and effective tool to ensure that the individual taking the exam is the same person who registered, that is, to achieve the proposed objective,” and therefore, meeting the suitability requirement is not a matter of contention. It is the lack of necessity and proportionality that is being judged in this proceeding.
For their part, the objections to the Proposed Resolution claim to have no objections regarding the suitability requirement, which is understood to be met. However, to substantiate compliance with the requirements of necessity and proportionality in the strict sense, they cite some reasons justifying the suitability of the facial recognition system to verify the identity of the students participating in the exam, confusing suitability with the necessity or proportionality of a given procedure.
2. If, in addition, it is necessary, in the sense that there is no other more
moderate measure to achieve the same purpose with equal effectiveness (necessity test).
This means determining whether the intended goal cannot be achieved in a
less harmful or invasive way; that is, whether there is an alternative treatment
that is equally or more effective and safe for achieving the intended goal,
but less intrusive.
Necessity should not be confused with the system's usefulness. Facial recognition might make it easier to avoid having to travel to take an in-person exam, allow for examining a larger number of students simultaneously, and
be less costly for the organization because it requires hiring fewer
teachers. Obviously, a facial recognition system can be useful, but it does not
have to be objectively necessary (the latter being what must truly be
present when analyzing the necessity requirement of the treatment).
As established in Opinion 3/2012 on the evolution of biometric technologies (Working Group 29), it must be examined “whether it is essential to satisfy that need, and not just the most suitable or cost-effective option.” Options and alternatives must be analyzed before
implementing a new system that represents a significant intrusion into the rights of each
user, when less invasive means of privacy exist, and before opting for what is
practical, agile, or convenient, when the rights of data subjects are at stake.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 200/225
Therefore, any data controller considering implementing biometric data processing
must be meticulous in their work of thoroughly analyzing all
alternative options that are equally suitable and effective, but less intrusive.
Therefore, the feasibility study of
other available alternative options that do not require the use of biometric data must be documented alongside the DPIA, comparing all options and documenting the conclusions.
Furthermore, it should be noted that Recital 47 of the GDPR stipulates that the
processing of personal data must be “strictly necessary” for the prevention
of fraud, in order to constitute a legitimate interest of the controller.
However, it is difficult to argue that facial recognition
is strictly necessary to control student impersonation
or fraud/plagiarism in exams when other methods exist that lead to
the same result.
In the present case, it is established that the UIV conducted the analysis of necessity and proportionality in various sections scattered throughout its 2020 Data Protection Impact Assessment (DPIA) and its updates. The 2023 update did not add any modifications to the analysis performed, and the January 2024 update addressed an issue directly related to the proportionality of the processing (by weighing the benefits and harms of the processing).
To determine whether the necessity requirement is met, one must begin with the purposes of the processing, since this requirement is considered fulfilled when it is demonstrated that there are no less intrusive alternative means (that do not process biometric data, which has always been recognized by the UIV) that allow the purposes of the processing to be met with equal effectiveness and security. For these purposes, the EIPD refers to the following processing purposes:
“1. To verify that the student taking the exam is who they claim to be.
2. To prevent identity theft.
3. To prevent fraud or cheating on exams.
4. To guarantee academic quality and integrity.
5. To comply with the requirements of the certifying bodies (ANECA).”
Regarding the definition of these purposes, it should be noted that:
o Since the second and third purposes are to prevent fraud (by identifying oneself and by cheating on the exam), this document will refer to preventing fraud in general.
o The fact, consistently alleged by the UIV, that the exams must be online is not included. However, given the circumstances, it will be assumed that the UIV intends to achieve these purposes by using online assessment methods.
Since the requirements imposed by ANECA have not been duly accredited,
UIV refers to them in its documents prior to the Proposal, it should be noted
that there is no record that this entity ever imposed the implementation of
biometric methods or an environmental control system using
a dual camera, in the Report issued by ANECA on May 31, 2019, which
has been submitted to the proceedings as document 3.4. This report did not
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 201/225
indicate the need or the advisability of using either the dual camera system or facial recognition. But, above all, it cannot be considered
for the purposes of determining the purposes of the processing,
since complying with academic regulations or the instructions of the
educational bodies is not a purpose of the processing but a legal
obligation.
In short, based on the circumstances established by the documentation provided and the statements made by the UIV, it is considered that
the purpose of the data processing in this case—as indicated in the first established fact—is the implementation of a facial recognition and monitoring system designed to verify that the student taking the online exam is who they claim to be, in order to prevent fraud (identity theft and plagiarism of exams) and guarantee academic quality and integrity.
In light of the documentation provided and the statements made by the UIV, it can be confirmed that
the processing implemented by the UIV was not necessary to fulfill the
purposes indicated, based on the following:
- In this case, it is established that there are less intrusive alternative means
that would allow the purposes of the processing to be fulfilled effectively and securely,
without using biometric systems:
According to what is stated in both DPIAs, the UIV was aware that
other possible alternative means exist, since it stated the following:
(Page 767 of the file) that there were other alternative means identified
in Report 0036/2020 of this Agency:
“Alternative means to facial recognition
Report 0036/2020 of the Legal Department of the Spanish Data Protection Agency (AEPD) indicates that
there are alternative means to facial recognition, among which
the following stand out:
1. Assignment of access identifiers.
2. Use of tools for Videoconference.
3. Teacher's understanding of the student through continuous online contact throughout the course.
4. European Union TeSLA (Adaptive Trust-based e-assessment System for Learning) innovation and research project.
5. Continuous student assessment through practical exercises, assignments, and similar activities.
6. Limitation of facial recognition and the ***PROGRAM.1 to complex subjects with a large number of students.
7. Use of anti-plagiarism tools.
8. Limiting the circumstances under which a final knowledge assessment is required.
9. Avoiding rote memorization questions and promoting critical thinking.
10. Establishing short time limits for answering questions.
11. Implementing student monitoring by faculty and support staff.
12. Conducting oral exams via videoconference.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 202/225
13. Request for explanatory videos prepared by students
Furthermore, it is on record that the UIV was also aware since 2020 of the existence of
other alternative means proposed by the Dutch supervisory authority,
which adds more possibilities that could be used – individually or in combination – to conduct exams entirely online, as
the UIV intends. These include: open-book exams, essay papers,
oral exams, confidence reports on tests, time limits for taking a test, plagiarism checks, and live
intervention in which the professor questions students during or after the
exam to verify answers based on random sampling.
In turn, it is established as Proven Fact Three that – at least since the signing
of the amending addendum of June 14, 2021 – the UIV had The UIV considered the
real opportunity to contract a version of the ***APPLICATION.3 program,
which involved “human review without biometrics,” and through which it was also
possible to conduct online assessments of its students, and rejected it.
Contracting the two versions that required the processing of biometric data
(***APPLICATION.4 and ***APPLICATION.2). Thus, in its
second written response during the investigation phase, the
UIV states that: “
“An incomplete image analysis could be carried out without any
biometric analysis and without guarantees of preventing identity theft
in the case of using the ***APPLICATION.3 service. The UIV
has never contracted the ***APPLICATION.3 service due to its ineffectiveness
in preventing identity theft in online exams
compared to the ***APPLICATION.1+ service, which includes biometric control.”
All of these allow—some independently and others in combination—the fulfillment of the processing purposes, although they require a greater investment in human capital and prior research and planning.
And it must be remembered that if there is even a single alternative means that, individually or in combination with other means, allows the fulfillment of the purposes of preventing fraud, guaranteeing academic quality, and evaluating students 100% online, it will imply that processing through facial recognition was unnecessary, and therefore, it infringes Article 5.1.c) of the GDPR, which is prohibited. And in this case, there is not just one possibility, but rather the aggravating factor that there are several possibilities that would allow for online student evaluation and control to prevent fraud, and that the UIV is aware of this, but has decided not to use them.
- Furthermore, the UIV, despite knowing that other alternatives to the biometric access method exist, which it cites and lists in its 2020 Data Protection Impact Assessment (DPIA) of September
2020 (p. 620 exp) and the 2023 update (p. 768 exp), did not adequately justify
in its DPIA or in any documentation related to the processing
the reasons why it considers that these non-biometric methods cannot
fulfill the purposes of the processing. Neither in the initial 2020 version, nor
in the 2023 and 2024 updates was an adequate analysis carried out of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 203/225
why the other alternatives were not suitable for fulfilling the purposes of the
processing.
... That is, the initial DPIA and its updates briefly mention (in one line) the reasons for rejecting each alternative, but provide no analysis of the differences and impact of applying the biometric method compared to other alternative options from the perspective of the risks and impact on the rights and freedoms of the data subjects.
In the analysis of alternative means in the 2020 and 2023 DPIAs, the UIV rejects all alternative means, understanding that: “According to the Spanish Data Protection Agency (AEPD), these alternative means make the need for processing unjustified. The average number of students per classroom is 78, so the option of continuous assessment is limited. However, in all the alternative means mentioned in the report, student impersonation and fraud are possible.”
This idea is repeated in its conclusions regarding the assessment of necessity and proportionality (p. 775 Exp.), stating that “Given the increase in academic fraud, it is considered that the only way to guarantee that such fraud does not occur in distance exams is to use technology and the means it offers to ensure equal opportunities and the quality of studies.” However, as already mentioned, it does not provide objective data that justifies this increase in academic fraud, nor, more importantly, that allows us to conclude that there are no other alternative means to control it.
It also includes the following table, which lists the reasons why the processing purpose cannot be achieved using the means proposed by the Spanish Data Protection Agency (AEPD) and the Dutch authority. However, this is not considered an analysis of alternatives that meets the rigor required to fulfill the necessity requirement, given that: (i) it provides no further explanation, with no justification other than the generic assertion that it “does not prevent identity theft” in most cases; (ii) and when it does provide justifications, it fails to substantiate them, without even accompanying studies with objective data to support them.
(…)
In light of these tables, it can be concluded that the DPIA made contains constant assertions based on defending criteria of utility, driven by the strategic and business interests of the UIV, instead of assessing whether the processing carried out is necessary from the perspective of data protection. For example, this is the case with assessments
conducted using videoconferencing tools, where it is simply
stated that “beyond a certain number of students it becomes impossible,” which could
be resolved with investments in personnel, conducting appropriate
studies and analyses that would allow for rigorous certification of the number
of students per professor that can be included in each exam. The same applies
to the combination of various techniques in which the professor randomly questions
the student live using a sample, which are dismissed for
being limited to very specific aspects of fraud” without further explanation.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 204/225
Furthermore, when referring to the purpose of the processing and in the
conclusions regarding the assessment of necessity and proportionality, it states
that there are no other means by which the
purposes of the processing can be fulfilled “since the university has committed
through advertising to conduct the entire course online (...)”, insisting on the
erroneous conception that the student has all the information
beforehand and decides to enroll at UIV, knowing that the evaluation system
is online, the justification for which regarding its consideration as
consent as an exception to Article 9.2 of the GDPR has already
been dismissed in Legal Grounds V and VI, to which we refer.
It is not true that there are no other methods to conduct
online exams and verify that identity theft and
plagiarism are not committed, while simultaneously guaranteeing academic quality and integrity.
For example, hiring more professors who can
conduct exams via videoconference and combining this with other
video camera monitoring methods that are not biometric, or
subscribing to version ***APPLICATION.3, which allows them to evaluate online without
using biometric methods, would certainly be possible to fulfill their
objective of preventing fraud and being able to evaluate their students 100% online,
among other possible methods. However, these would imply a higher level of investment
that UIV does not seem willing to make. This would contravene the
rights and freedoms of its students by forcing them to undergo
biometric processing that carries such a high level of risk.
Therefore, the argument that there is no other alternative because the
exams must be 100% online falls apart.
Another untenable argument is the one that refers to discarding other methods of
assessment that do not involve exams, solely on the grounds that exams are
necessary for the degrees to have recognized prestige
in the market, since this is again a strategic criterion, which, although
understandable, is not viewing the problem from the point of view
of data protection, but rather according to criteria of expediency,
thinking of their online university as a business model of the
organization. In other words, students enroll in a
100% online university for the advantages of not having to travel and the cost savings, etc., but this does not imply that their
assessment should be of lower quality, nor that cheating on the
exams should be possible at the expense of putting their personal biometric data in an
unnecessary risk. Since there are other methods that, in combination, would allow the objectives of preventing fraud and providing the online university's degree with the desired educational quality,
it is established that the UIV did not justify, prior to initiating the processing in its 2020 Data Protection Impact Assessment (DPIA), nor subsequently in its updates, the need to use biometric identity verification systems. It does not explain why these alternative means cannot be used individually, nor does it mention why they cannot be used in combination, which would undoubtedly be possible and advisable in this case to fulfill the purposes of the processing.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 205/225
- As the Proposed Resolution pointed out, the allegations against the initial agreement and the expert report submitted on July 24, 2024, also failed to
justify the need for the processing carried out (which continues to this day),
since:
They merely confirmed that the UIV made the decision to use
the facial recognition system based on criteria of expediency and
business viability, even going so far as to state that
in addition to protecting user security and guaranteeing the quality
of the service (which can be achieved through other alternative means,
as already mentioned), biometric processing allows it to: “Ensure the
viability of the business, since fraud and identity theft
jeopardize the continuity of the company and the market's perception
of the authenticity of university degrees.”
The allegations against the initial agreement were based on providing, as
Document 1, a list of benefits, and erroneously consider
that the “necessity test is met when achieving the
benefits listed in this table is integrated into the aims of the
treatment and biometric control becomes the most
effective means to achieve these aims.” This confuses the requirement of
necessity—which is limited to assessing whether there are other less intrusive but equally effective and secure alternative means that allow
the same purpose to be achieved—with the requirement of proportionality, which
involves weighing and comparing benefits against risks or
disadvantages to the rights and freedoms of the students. This will be
analyzed in the following section.
Thirdly, it was not adequately justified why the measures
existing prior to the use of facial recognition (online assessments are not new) that are less intrusive cannot
sufficiently address the problem, even in a
combined manner.
It has been established that the UIV has chosen to implement the software
***APPLICATION.1 in its most intrusive version, requiring students
to accept the processing of their biometric data for facial recognition
during assessment tests, without adequately justifying
the need for such processing, since the
online identification/authentication of students has been routinely
carried out by university centers through
visualization of students without using facial recognition techniques.
It should be reiterated that necessity should not be confused with convenience. Thus, the use of facial recognition techniques
may be convenient for the UIV and may even offer certain
benefits for students, but this does not imply that its use is
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 206/225
strictly necessary to achieve the intended purpose, and this is
a sine qua non requirement for its implementation.
In this regard, the UIV was already aware of and ignored the statements in the aforementioned report 0036/2020, which indicates that:
“It should be emphasized that conducting online assessments is not
a new phenomenon, nor is it a result of the state of emergency. Rather, it is
an assessment method that has been used by
some Spanish universities for years, with
the methods employed by these universities to verify the
identity of students—the main issue on which the consultation focuses—being different. To this end, as noted in the report,
there are alternative methods to facial recognition that
have been used to date, such as assigning
access identifiers or using
videoconferencing tools or webcams.
(…) On the other hand, the implementation of facial recognition in
online assessment is not without its difficulties, some of which
exceed the specific scope of data protection but
have an impact on it, such as those arising from the
lack of technological equipment and skills.” digital technologies for both faculty and students, the need to address the needs of students with special needs, and other technical and economic challenges.
These circumstances have led the consulting entity to organize an "Online Forum on Experiences with the Suspension of In-Person Teaching at Spanish Universities due to COVID-19." This forum addressed the difficulties arising from the implementation of facial recognition systems, including privacy concerns, as well as the advisability of using alternative measures, as detailed in the "Summary of the Second Online Workshop for Sharing Experiences on Assessment Models," held on March 26, 2020, and in the recording of that session, which is linked in the document (https://www.us.es/sites/default/files/comunicacion/coronavirus/resumenjornadamodelos-evaluacion.pdf). Among the possible measures are... For online assessment, emphasis is placed on the need to
enhance continuous assessment through practical exercises, assignments, and other
types of activities, and the use of anti-plagiarism tools, limiting
the instances in which a final knowledge test is necessary, where other
measures can also be adopted to certify knowledge, avoiding rote
questions, establishing short periods for answering
questions, and implementing student monitoring by
faculty and support staff through
videoconferencing, oral exams via
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 207/225
videoconference, explanatory videos prepared by students,
etc. Along the same lines, the “Guide of Recommendations for
Online Assessment in the Public Universities of Castile and León”,
prepared by the “Group of Heads of Online Teaching of
the Public Universities of Castile and León”, in its version of 3
April
2020 (https://www.usal.es/files/2020_04_03_Recomendaciones_eva
luacion_online_p
ara_las_Universidades_Publicas_de_Castilla_y_Leon_V0.7.pdf),
recommends, in general and whenever possible,
continuous assessment of subjects, and only as a last resort,
resorting to facial recognition solutions or ***PROGRAMA.1,
reserving this option for complex subjects with a large
number of students.
The CRUE itself follows the same criterion in its “Guide on the
protection of personal data in the university setting during
the COVID-19 pandemic,” dated April 24,
(http://www.crue.org/Documentos%20compartidos/Informes%20y%20Posicionamientos/Guia%20Crue%20Universidades%20Espa%20%C3%B1olas%20%20Grupo%20DPD%20FAQS%20COVID19.pdf), which states the following:
(...) The University Student Statute allows faculty
to request identification from students, who must show their student ID
or other identification document (art. 25.7). In an
online environment, students can also be asked to identify themselves
by showing this documentation. In any case, for student identification,
it is recommended to use the technical measures
already available to the university that are the least intrusive
for their privacy.
Finally, the technical report submitted as an expert opinion by
the UIV, prepared on July 23, 2024, by an expert from
company ***COMPANY.3, performs an “Analysis of Less Intrusive Alternatives” in Section 1.9 of the “security expert report” document. This report also fails to justify the need for the processing, as
its assertions are based on criteria of expediency or efficiency,
simply indicating that facial recognition is more
secure and efficient than other less intrusive alternatives, without offering
objective data or evidence to justify the assertions
made therein, as follows:
“Possible less intrusive alternatives for the
student identity verification process during
exams were evaluated.” Manual verification of student identity:
Less efficient and impractical for a large number of students in an online exam format.
Use of access codes:
Less secure and less efficient.
Identity verification using identity documents:
Less efficient and more intrusive.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 208/225
(requires linking to personal data).
Verification using security questions:
Less secure and less efficient.
Alternatives such as manual verification of student identity, the use of access codes, or verification
through security questions do not offer the same level of
security and authenticity in verifying student identity, and may be more intrusive and/or less efficient in an
online exam environment with a large number of students.”
- Finally, the allegations made against the Proposed Resolution
still fail to justify that the processing carried out is necessary, since:
o It states that there are two “premises that condition the
argumentation of the Proposal” which are not actually premises.
Since it is considered that the Twelfth Proven Fact
established a proven fact that is a legal consideration by
stating “it is established that there are other alternative, non-biometric means of verifying the identity of students suitable
to fulfill the purpose of the processing,” which is inadmissible
because, in addition to the fact that there are many
other alternative means that the UIV itself had listed in its
DPIA, and this is subsequently assessed in The legal grounds
because this fact is a requirement for the
type of infringement to occur. Furthermore, and as already argued in response to
the preliminary question, although legal
concepts are used in the proven facts, this is not contrary to any
rule nor does it constitute any infringement or prejudice to the sanctioned party.
It is also noted that the “alternative measures” listed in the
Proposed Resolution must also be subject to the proportionality test, as the Proposal itself indicates, which in no way
excludes the existence of these measures and the
treatment being unnecessary. Necessity and
proportionality must be assessed; there is no contradiction.
It is noted that the analysis of all the alternatives
mentioned in the Proposal was included within the tables contained
in the DPIA, which coincides with what the DPIA stated, and is not
denied. What is maintained is that these tables indicated the
reason why it does not allow the purpose of the treatment to be achieved,
referring in the 90% of the cases to “does not prevent identity theft,” without this being justified with objective data,
and to cite reasons based on criteria of
expediency that are inadmissible since the analysis of
alternatives must be carried out from the perspective of the impact they will have
on the rights and freedoms of the students.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 209/225
o It is appropriate to confirm and refer to the conclusions of the
Proposal regarding the reasons why it is understood that these
tables with the alternative means that were included in the DPIA
of the processing, cannot be considered a valid analysis of the
discarding of alternatives.
o For the reasons indicated in the previous Legal Basis,
it is also ruled out that the freedom of enterprise
and academic freedom or teaching have been violated by stating the reasons why these
tables, nor the allegations to the initiation agreement and expert report
The information provided did not justify that the remaining assessment alternatives
were not valid or suitable for fulfilling the purposes of the
processing. These statements were made to
comply with the obligation to provide reasons for the administration's actions and
without expressly indicating which exact
assessment methods should be used by the UIV, always referring
to the fact that the UIV will be free to choose them, provided
they meet the requirements set forth in this GDPR, which this
supervisory authority has the duty to monitor.
The arguments against the proposal include a detailed explanation—made
after the fact, years after the processing began, with the
infringement already completed and ongoing—of
the reasons why they believe that each of the alternatives
presented in the DPIA “does not allow us to ensure that
identity theft does not occur.”
But this analysis, besides being belated, still fails to justify that there are no
alternatives that—individually or in combination—allow
the student to be assessed without identity theft.
It must be clarified that this Agency has never stated that
all the alternatives listed in report 36/2020 are
valid for fulfilling the purpose of the processing. They are simply
listed, as examples, without being exhaustive or
conclusive, a number of options that were already being applied
in 2020 for online student assessment that did not
involve facial recognition, as well as others that had been
proposed in education forums or by educational organizations
such as CRUE for online student assessment in a
combined manner. These are options that the UIV itself included in its DPIA,
adding those of the Dutch authority. This is simply with the
intention of explaining why the processing is considered unnecessary
and why the UIV acted negligently because it did not adequately analyze
these alternatives or justify with the required rigor
and from the perspective of their impact on the rights and
freedoms of the data subjects, whether any of these alternatives, or
several of them combined, could have been valid. (suitable)
to fulfill the purpose of the treatment, and this was not done.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 210/225
It wasn't until the comments on the Proposal submitted in
April 2025 that the UIV (Information and Data Protection Unit) analyzed why none
of these alternatives, in isolation, can be reliable for
preventing identity theft. However, this analysis still fails to
consider its impact on data protection, confuses concepts, and omits essential aspects that should
be assessed.
Indeed, for example, it can be admitted that the “assignment of
access identifiers” does not allow for reliably verifying
identity, as indicated in the CCN (National Cryptologic Center) report of December 2024, or that systems like the one
mentioned in the EU's Tesla project are not an appropriate example
because they use facial recognition.
The UIV states that facial recognition is the only valid means
to prevent identity theft, but it does not justify this in its
media analysis:
• First, the UIV overlooks the fact that the existence of a single
less intrusive evaluation method than facial recognition (which
arises from one or more of the listed alternatives or from
other possible methods) is sufficient to consider evaluation
using biometric systems unnecessary
from a data protection perspective. It has not been stated that all
alternatives must be valid, much less in isolation.
• The UIV still fails to analyze an evaluation method that combines
several alternatives, making no reference to why it does not
consider valid the use of combined or
isolated methods that the aforementioned Forum and the CRUE have
deemed valid methods that allow for an
acceptable level of risk in identity theft and academic
quality.
It fails to consider that none of the existing means
(neither biometrics, nor other automated means
of identity verification, nor manual verifications performed
remotely by human personnel) can completely prevent
identity theft.
Therefore, although there is a residual risk of unavoidable human error,
as indicated in the Ministry of Labor's technical note on human reliability analysis to which the university refers,
this would not preclude considering this
identity verification system suitable from the
perspective of personal data protection, which is
what we are analyzing.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 211/225
The UIV's approach to this analysis is flawed, since it does not
aim to reduce the risk of identity theft to almost 100%. This may be a strategic objective of the
organization, to increase its prestige. But it is not the objective
of a Data Protection Impact Assessment (DPIA), which requires evaluating the risks of identity theft
(and many other risks) associated with
each processing activity, and assessing its inherent risk level. Overall, if the residual risk is acceptable, it allows the
processing to continue, provided that appropriate mitigation measures are in place.
• Furthermore, alternatives continue to be discarded on the grounds
that they do not fulfill the purpose of verifying identity because
they are aimed at preventing plagiarism, but at the same time, it is maintained that
human resources are not capable of detecting it in order to
discard them.
• Some methods are dismissed solely based on the previously rejected argument that this Agency is attempting to interfere with the university's freedom of enterprise and modify its assessment system, without providing further reasons (such as continuous student assessment, limiting the circumstances under which assessment is required, requesting explanatory videos, avoiding rote memorization questions, etc.).
• No reference is made to the alternatives proposed by the Dutch authority in its EIPD, nor to why version ***APPLICATION.3 is considered unsuitable for verifying student identity during the exam.
• The objections to the Proposed Resolution even suggest that the legal framework for official degrees is being violated, because it has not been understood that what this Agency did was list alternatives that could be applied or not, provided they complied with university regulations and the UIV freely decided to implement them. No
imperative mandate is made, nor is there any mention that
all of these alternatives must be used.
And finally, references are repeated to the fact that
biometric systems do not generate risks to the rights and freedoms
that have already been addressed. Appealing to the same
ruling that in no way determines that the processing of
biometric data does not generate risks.
Having dismissed the allegations made by the UIV in its various
written submissions and documents presented throughout the proceedings, it follows from the foregoing that the treatment implemented by the University, which employs a facial recognition system for students to conduct their online assessments,
is not and has never been necessary to verify the identity of students in order to prevent
identity theft, nor to prevent exam fraud and guarantee academic quality,
since it has been established that numerous alternative means exist
that the UIV was aware could be applied individually or in combination, and whose use
had been recommended by the CRUE and the academic experts who attended the aforementioned
Conference, as well as suggested by this Agency and the
Dutch data protection authority.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 212/225 Methods that, by not employing biometric identity authentication, were
far less intrusive to students' rights and freedoms. And yet, the
UIV has discarded them without adequate justification based on criteria of utility and
business viability for the organization, since, even having the
option in 2022 to contract a version of the same program (***APPLICATION.3) that
would have allowed it to evaluate its students 100% online with equal effectiveness and security
(although it would have involved a higher human cost and more research/pre-planning),
it still decided to continue contracting the more intrusive version of ***APPLICATION.1,
which involved the biometric processing of personal data.
3. Finally, it will be necessary to justify whether the decision is proportionate or balanced,
because it derives more benefits or advantages for the general interest than harm to
other conflicting goods or values (proportionality test in the strict sense).
This is established, among others, in “Constitutional Court Judgment 66/1995, of May 8, Section 5; Constitutional Court Judgment 55/1996, of March 28, Sections 7, 8, and 9; Constitutional Court Judgment 270/1996, of December 16, Section 4.e; Constitutional Court Judgment 37/1998, of February 17, Section 8; Constitutional Court Judgment 186/2000, of July 10, Section 6).”
In this respect, the severity of the risk to the rights and freedoms of the processing, and its intrusion into the fundamental right to the protection of personal data, must be appropriate to the objective pursued and proportionate to its urgency and seriousness. The benefit that the processing provides to society from a data protection perspective must be weighed, maintaining a balance with the impact it has on other fundamental rights. However,
even if it can be partially waived, in no case can the right to data protection be completely denied and emptied of its essential content.
There must be a logical link between the measure and the legitimate objective pursued.
In general, the principle of proportionality must ensure that the
intended objectives are achieved through actions that do not exceed what is necessary,
introducing here the concept of the measure's suitability. There must be a
logical link between the measure and the legitimate objective pursued. For the
principle of proportionality to be respected, the advantages resulting from the measure must not be
outweighed by the disadvantages it causes with respect to the exercise of
fundamental rights. And one of the factors that comes into play in proportionality is the
effectiveness of the measures, above and beyond the proposed one. If, in the same context,
measures already exist for a similar or identical purpose, they must be considered; otherwise, the
proportionality assessment has not been properly carried out.
Regarding the proportionality test, the UIV (Integrated Data Protection Unit) states the following:
- In its DPIA (Data Protection Impact Assessment), it indicates in its “risk-benefit balance analysis” that
this balance exists in the evaluator's opinion, without specifying the reasons why.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 213/225
it occurs, and in its conclusions, it states that it considers that “The
processing operations analyzed are proportionate, in the sense that
they are not excessive to achieve the purposes proposed by the
controller”... “in the analyzed processing, there is a
balance between the risks it generates for the data subject and the benefits that
the processing provides for the data subject and for the entity,” also arguing
the “right of all students to have equal
opportunities in matters such as:
-The cost associated with long journeys, even from other countries,
since not all students have the same economic level.
-The unfair advantage over others that generates fraud in the assessment
for the students who commit it and the corresponding disadvantage for the student
who has made the effort to study.
-Maintaining the prestige and confidence in the qualification obtained by the student, and
ensuring that its market value does not decrease.”
However, when analyzing the risks in its Data Protection Impact Assessment (DPIA), it states that “These risks are
very similar to those that the student would have in an in-person registration and
authentication process, since the main objective is to prevent identity theft
and the commission of fraud and crimes.” Therefore, it is acknowledging
that this alleged risk of identity theft and fraud also exists
in an in-person examination process.
And in its arguments regarding the initial agreement, it insists on the same idea, stating:
“Proportionality test in the strict sense.
The use of biometric control through the application
***APPLICATION.1 is proportionate because it derives more benefits
or advantages for the general interest and for the student than harm
to other conflicting rights. This is demonstrated by the provided balancing report.
It should be added that the content of the biometric pattern is
strictly necessary to verify the student's identity in
a 1:1 comparison, that is, between two photos of the same person,
so that it does not include more data than necessary to
fulfill this purpose.
As can be seen in the balancing report of legitimate interest
that has been provided as DOCUMENT No. 1, the set of benefits
that biometric control provides for the student, for the university, and
for society more than compensates for the low risk that a limited and ephemeral biometric pattern, lasting 2 seconds, may
pose for the student. It follows that the application
***APPLICATION.1 is proportionate and appropriate to the needs and purposes
pursued by the contracting parties in the teaching agreement.”
As the Proposed Resolution pointed out, the proportionality assessment carried out
by the UIV in its arguments against the initial agreement is incorrect because it is not
weighing the advantages and disadvantages of using this biometric system, given that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 214/225
or The weighing carried out by the UIV in the EIPD, reflected in the following table,
regarding legitimate interest (p. 593 exp) is incorrect because
most of the supposed “benefits” it indicates for the interested parties are
actually benefits or interests for the UIV (e.g., “to prove that they are who they claim to be” or “to maintain the prestige and confidence in the qualifications issued by
the institution”). On the other hand, some of the alleged risks to the
rights and freedoms of data subjects are actually
regulatory compliance obligations on the part of data controllers (e.g.,
“processing without a legitimate basis or with an erroneous basis”; “disproportionate or unnecessary use of biometric data”)
(…)
The balancing carried out in the Balancing Report submitted as
Document 1 of the statement of objections to the initiation agreement also fails to justify
the proportionality of the processing.
It is true that this Report details the benefits and expands upon the
associated harms, since it expands the balancing table offered
in the DPIA, incorporating new harms that are indeed related to
the right to data protection, thus improving the analysis compared to the
previously carried out.
However, this balancing cannot be considered sufficient
to justify the processing that has been carried out since the entry into force
of the new GDPR, because: (i) in addition to having been carried out after the
processing, and in Specifically, in January 2024, as stated in the document itself,
(ii) it continues to refer to benefits for the organization, although
it includes some benefits for the student that are not denied and have never been
denied; (iii) it does not include all the harms arising from biometric processing,
and continues to refer to the harms involved in the processing from a data protection perspective, but rather based on
other considerations such as inconvenience or economic losses; (iv) it does not
explain the reasons why it believes there are more benefits than disadvantages from a data protection perspective;
and it also does not
compare this assessment with the result of applying the alternative means
referred to above.
It must be said that both the DPIA and this Report, which appears to have been
included as an update of it in January 2024, confuse the
legitimate interest of the University, to which it repeatedly refers,
with the requirement to comply with the judgment of proportionality. And in turn, the UIV
starts from an error in understanding that if the residual risk contained in the
risk analysis is considered acceptable, then this
proportionality requirement is met, which has little or nothing to do with it and is yet another
example of its lack of understanding. Since
acceptable risk does not imply that the additional obligation
to fully detail all the disadvantages or harms of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 215/225
treatment for the purposes of the proportionality assessment is not required, and the final result
obtained from the weighting of this type of treatment must be compared with the analysis
that results from weighing the benefits and disadvantages of
non-biometric treatments.
And indeed, no document makes any reference to the benefits
and disadvantages of the alternative assessment methods that could be used
by the university, and especially, by those employed prior to implementing
biometric methods, in order to compare them with the benefits and
disadvantages of their use.
Therefore, it is not simply a matter of listing benefits and drawbacks, but rather the balancing analysis
required by the strict proportionality requirement must
include all concurrent benefits and drawbacks from the perspective
of data protection, compare or weigh them
to arrive at a favorable result because the benefits outweigh the drawbacks, and compare this result with the one obtained by applying the same
method of weighing benefits and drawbacks to each of the
existing less intrusive processing alternatives, which has not been done
in the present case.
The arguments against the Proposed Resolution also fail to justify exceeding the
requirement of proportionality of processing, given that:
o The argument that “The principle of proportionality, as understood here,
implies that the biometric data to be collected must be
adequate and never excessive for the purposes for which it is processed” is inadmissible, since
this definition corresponds to the requirement of necessity and not to that of
proportionality.
o Nor is it acceptable to argue that “the aforementioned program is suitable, necessary, and
proportionate (given the low risk of biometric data as established by the
latest European Union law) to verify that
the student is not impersonating someone or plagiarizing or copying during
the test,” since these risks are always much greater than those
generated by the processing of non-biometric personal data that would be
carried out if other assessment alternatives were chosen, for the
reasons already stated repeatedly.
Nor can it be accepted that it is unnecessary to assess the benefits and drawbacks
of the alleged alternative means of evaluation in order to compare them
with the benefits and drawbacks derived from biometric processing, since
it is necessary to compare this system with the alternatives because that is precisely what
this balancing entails. Nor can it be argued that it is inappropriate to do so by claiming that they were not
suitable for the intended purpose, since the analysis must be carried out on
those measures that, if they pass the suitability analysis, have been
established as valid for fulfilling the purpose of the
processing.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 216/225
However, it should be clarified that in this case, and as the Proposal already pointed out,
the proportionality requirement is not met because the UIV has not yet managed to
justify that the benefits of the implemented treatment outweigh the
harms that result for the rights and freedoms of the students (and not
for the interests of the organization).
Indeed, even if this balancing test had not been assessed in the DPIA, it would suffice for the treatment carried out to pass this
proportionality test, as the UIV points out. This Agency has never denied
that hypothesis, but this is not the case here. It has been proven that the facial recognition assessment method was not proportionate, as it resulted
in more harm or disadvantages than benefits. Having justified the decision based on the proven facts and in responding to the Proposed Resolution, the reasons were given
for which it is understood that the treatment does not, in fact, pass the proportionality test.
... Thus, the evidence shows that the UIV has carried out
processing operations involving biometric personal data (facial recognition)
for the purpose of uniquely identifying students taking its online exams
in order to control fraud and guarantee academic quality, and that it continued
to carry out these operations after the GDPR came into force in May 2018 until the
present day without having previously justified that such processing was necessary or
proportionate, given the existence of multiple less intrusive alternative means capable of
effectively and securely achieving the same purpose, which the UIV was aware of at least
since preparing its first DPIA in September 2020.
In conclusion, it follows from all of the above that the processing of biometric data through facial recognition carried out by the UIV is neither necessary nor
proportionate, and therefore infringes the principle of data minimization
contained in Article 5.1.c), which stipulates that data that are processed must be
“adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.”
VIII. Classification of infringements and their application for the purposes of the statute of limitations.
As set out in Legal Grounds II to VII of this
Resolution, the UIV is considered to have committed the following infringements of the
current data protection regulations:
8.1. Infringement of Article 9 of the GDPR.
As explained in Legal Basis VI, in accordance with the evidence currently available, and following the investigation, it is considered that the facts presented violate the provisions of Article 9 of the GDPR, which could constitute an administrative infringement as defined in Article 83.5 of the GDPR, which states the following:
“Infringements of the following provisions shall be sanctioned, in accordance with paragraph 2, by administrative fines of up to EUR 20,000,000 or, in the case of an undertaking, up to 4% of the total global annual turnover of the preceding financial year, whichever is higher:
a) the basic principles for processing, including the conditions for
consent pursuant to Articles 5, 6, 7, and 9.”
For the purposes of the statute of limitations, the LOPDGDD establishes in its Article 72(e): “Based on the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial breach of the articles mentioned therein, and in particular the following, are considered very
serious and shall be subject to a three-year statute of limitations:
“(e) The processing of personal data of the categories referred to in Article 9 of Regulation (EU) 2016/679, without any of the circumstances provided for in said provision and in Article 9 of this Organic Law being present.”
8.2. Infringement of Article 5.1.c of the GDPR.
As explained in Legal Basis VII, following the investigation
carried out, it is considered that the facts presented infringe the provisions of
Article 5.1.c) of the GDPR, and therefore constitute an administrative infringement as defined in Article 83.5 of the GDPR, which states the following:
“Infringements of the following provisions shall be sanctioned, in accordance with
paragraph 2, by administrative fines of up to EUR 20,000,000 or,
in the case of an undertaking, up to 4% of its
total worldwide annual turnover of the preceding financial year, whichever is higher:
(a) the basic principles for processing, including the conditions for
consent pursuant to Articles 5, 6, 7 and 9.”
For the purposes of the statute of limitations for infringements, the LOPDGDD establishes in its
Article 72: “In accordance with the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that
constitute a substantial breach of the articles mentioned therein, and in
particularly the following, shall be considered very serious and shall be subject to a three-year statute of limitations:
a) The processing of personal data in violation of the principles and safeguards
established in Article 5 of Regulation (EU) 2016/679.”
IX. Sanction to be imposed
9.1. Applicable regulations.
Article 58.2 of the GDPR provides the following: “Each supervisory authority shall have
all of the following corrective powers indicated below:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 218/225
i) to impose a an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each individual case;”
Determining the appropriate sanctions in this case requires compliance with the provisions of Articles 83.1 and 2 of the GDPR, which, respectively, provide as follows:
“1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 9 and 6 is, in each individual case, effective, proportionate and dissuasive.”
“2. Administrative fines shall be imposed, depending on the circumstances of each individual case, as an additional measure to, or in lieu of, the measures provided for in Article 58(2)(a) to (h) and (j).” When deciding on the imposition of an
administrative fine and its amount in each individual case, due consideration shall be given to:
(a) the nature, seriousness, and duration of the infringement, taking into account the
nature, scope, or purpose of the processing operation concerned,
as well as the number of data subjects affected and the level of damage
they have suffered;
(b) whether the infringement was intentional or negligent;
(c) any measures taken by the controller or processor to
remedy the damage suffered by the data subjects;
(d) the degree of responsibility of the controller or processor,
taking into account the technical or organizational measures they have implemented
pursuant to Articles 25 and 32;
(e) any prior infringements committed by the controller or processor;
(f) the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its possible adverse effects;
(g) the categories of personal data affected by the infringement; (h) how the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the controller or processor notified the infringement; (i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement.
(i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement. Likewise, the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates in its Article 76, entitled “Sanctions and Corrective Measures”:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 219/225
“1. The sanctions provided for in paragraphs 4, 5 and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of the aforementioned article.”
2. In accordance with Article 83.2(k) of Regulation (EU) 2016/679, the following may also be taken into account:
a) The ongoing nature of the infringement.
b) The connection between the infringer's activity and the processing of personal data.
c) The benefits obtained as a result of committing the infringement.
d) The possibility that the data subject's conduct may have induced the commission of the infringement.
e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the acquiring entity.
f) The impact on the rights of minors.
g) The appointment of a data protection officer, where not mandatory.
h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where disputes arise between them and any data subject.
3. It will be possible, either as a complement or alternative, where appropriate, to adopt the remaining corrective measures referred to in Article 83.2 of Regulation (EU) 2016/679.
* ...
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
* In this case, considering the seriousness of the infringement found regarding the violation of Article 5.1.c of the GDPR and Article 9 of the GDPR, and paying particular attention to the consequences of its commission for the data subjects, a fine is warranted in both cases.
The fine imposed must be, in each individual case, effective, proportionate, and dissuasive, in accordance with Article 83.1 of the GDPR. To guarantee these principles, the status of a large company and the turnover of the party being complained against in the 2022 financial year are taken into consideration beforehand.
9.2. Gradation of the penalty for the infringement of Article 9 of the GDPR.
In the commission of the infringement of Article 9 of the GDPR, the following circumstances for gradation of the penalty are confirmed to exist in this case, and these circumstances have been assessed to determine the penalty established in this Resolution:
o Art. 83.2.a) GDPR: “the nature, seriousness, and duration of the infringement,
taking into account the nature, scope, or purpose of the processing operation
in question, as well as the number of data subjects affected and the
level of damage suffered.”
The conduct that constitutes the nature of the infringement attributed to the
reported university involves violating the prohibition on processing data of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 220/225
special categories without an exception, as provided for in Article 9 of the
GDPR, which, as mentioned, is punishable by a fine of up to €20 million
or 4% of the respondent's annual turnover.
In this case, after conducting the investigation and partially upholding the
sixth allegation made against the Proposed Resolution, it is decided to reduce
the duration of the infringement and the number of affected parties
considered by the Proposed Resolution, for the reasons set forth in
Legal Basis V of this Resolution. And, consequently, it is
considered that:
- Since the UIV has not demonstrated that it has suspended the
processing at present, it is considered that a continuing infringement of Article 9.1 of the GDPR has been committed
from the entry into force of the GDPR in
May 2018 to the present, although liability for negligent conduct can only be imputed to the UIV for committing the same
from November 2023, when the Biometrics Guide was published by this
Agency, from which point it cannot claim to have committed an error of law based on the Principle of Legitimate Expectation, calculating the duration of the infringement from
that date and therefore reducing the sanction to be imposed.
It is considered that the imputed infringement will not end until it is
demonstrated that the processing of special category biometric data has ceased. carried out, or that the requirements stipulated by the GDPR for this type of processing have been met.
- For the same reason, it is also agreed to reduce the number of those affected by the infringement to those enrolled in the 2023-24 academic year, in accordance with the report issued by the investigating officer on December 16, 2024, as well as those enrolled in the 2024-25 academic year and subsequent years in which the UIV chooses to continue processing this biometric data
without justifying the existence of an exception under Article 9.2 of the GDPR.
Finally, as mentioned, the fact that the software used by the UIV had the technical measures adopted for the processing carried out, as indicated in Finding Six, as well as the software's default design characteristics, is taken into consideration in favor of the UIV
when determining the severity of the sanction to be imposed. ***APPLICATION.1 employee,
and especially the fact that a 1.1 authentication system was used and
that the biometric templates were not stored.
or Art. 83.2b) “the intent or negligence in the infringement”.
In this regard, the UIV is obliged to act with the special diligence
required of an entity of this nature. In this respect, it is appropriate to
recall the Judgment cited by the University in its arguments from the
National Court of 17/10/2007 (rec. 63/2006), which, with respect to entities
whose activity involves the continuous processing of customer data,
indicates “…the Supreme Court has held that negligence exists
whenever a legal duty of care is disregarded, that is, when the
offender does not act with the required diligence. And in assessing the degree of diligence
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 221/225
the professionalism of the individual must be given special consideration, and there is no doubt that, in the case now examined, when the entity's activity involves the constant and extensive handling of personal data,
the rigor and meticulous care to comply with the relevant legal provisions must be emphasized.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 221/225
The fifth allegation has been partially upheld, and it is understood that the requirement of culpability was not met
until the publication of this Agency's Biometrics Guide,
however, it is considered that from November 2023 onwards, the UIV should have
regularized its situation, after learning that the criterion on which it relied had been
superseded, and that the present proceedings had been initiated.
Nevertheless, for the reasons expressed in response to the sixth allegation, it is
understood that the UIV cannot be considered to have acted with gross negligence
from 2020 onwards, nor from 2023, as the Proposed Resolution indicated.
And, making an interpretation favorable to the UIV, it is considered that a level of gross negligence exists
from November 2023 onwards.
or Article 76.2.f) of the LOPDGDD. The connection of the infringer's activity with
the processing of personal data.
In this regard, the UIV, due to the activity it carries out, processes numerous
personal data and on an ongoing basis, both with respect to the data of all
students, as well as the teaching staff and the rest of the employees. That is,
in this case, the processing operations are inherent to the corporate
purpose or main activity of the data controller, since this consists of the
teaching function with respect to the students and includes carrying out all kinds of
activities, including administering exams, grading them, compiling
students' academic records, etc.
It should be added that there is no doubt about the connection of the offender to the
massive processing of students' personal data, which should have
led the UIV to exercise due diligence, given its
familiarity with processing operations, considering the number of
students enrolled each year at its university, as documented
in this proceeding.
Consequently, with the available information, and considering the University's
business volume, the investigation concludes that it is appropriate to
modify the amount of the fine that was set in the Initiation Agreement and in
the Proposed Resolution, and to impose a fine of
300,000 euros for committing an infringement of Article 9 of the GDPR.
Considering jointly the concurrence of all the criteria for determining the severity of the penalty that
have been established during the investigation phase.
9.3. Determination of the penalty for the infringement of Article 5.1.c) of the GDPR.
With regard to the infringement of Article 5.1.c) of the GDPR, the following circumstances have been considered for determining the penalty established in this
Resolution:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 222/225
-Article 83.2.a) GDPR. “the nature, seriousness and duration of the infringement, taking into account the nature, scope or purpose of the treatment operation in question, as well as the number of affected parties and the level of damages they have suffered.”
In this regard, the same factors that have been indicated regarding the infringement of Article 9 of the GDPR apply, specifically: (i) the nature of the infringement, punishable by a fine of €20 million or 4% of turnover; (ii) the number of students affected by the prohibited processing (which is neither necessary nor proportionate); and (iii) the security measures and design of the software used.
However, with respect to the duration of the infringement, it is understood that the Principle of Legitimate Expectation cannot be invoked, since the application of the Principle of Data Minimization in Article 5.1(c) of the GDPR is required in all types of processing, not just those involving special categories of personal data.
Therefore, it is understood that the UIV should have analyzed whether the processing was necessary, proportionate, and appropriate, and that it committed the infringement from the date the GDPR came into force in May 2018. And it continues with the processing. Currently, despite being prohibited, the infringement covers the period between the entry into force of the GDPR and the present.
Regarding the severity of the infringement, it is considered that UIV included an incomplete analysis of the necessity and proportionality assessment in its 2020, 2023, and 2024 Data Protection Impact Assessments (DPIAs), based on criteria of utility and expediency for the organization, rather than on the protection of its students' personal data. UIV dismissed, without analysis, multiple alternatives that would have allowed for online assessment of its students without using biometric methods. Furthermore, it chose not to contract the option
***APPLICATION.3 that did not use the biometric facial recognition system. And
furthermore, it did not include a weighing of benefits and harms until the
update of January 2024, which still fails to justify that the processing was
proportionate or necessary in the terms set forth in Legal Basis VI of this Resolution.
- Art. 83.2b) “the intent or negligence in the infringement”.
For the same reasons stated regarding the infringement of Article 9
of the GDPR, it is understood that negligence also occurred in the commission of this
infringement because the university continued, after the entry into force of the new
GDPR, with a highly intrusive processing of biometric data without having
thoroughly analyzed its necessity and proportionality, and without having ruled out the
multiple alternatives recommended in the reports mentioned. Being aware of the criteria that have been applied regarding the
necessity and proportionality of the treatment, and having reviewed the reports and opinions
referenced since the first EIPD of 2020, in addition to
the recommendations of the CRUE and other specialist education forums regarding
the use of this type of E-Proctoring software, which employs
facial recognition.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 223/225
However, the allegation made by the UIV regarding the degree of negligence attributed to the UIV for this infringement is partially upheld. The elevation to the level of very serious negligence indicated in the Proposed Resolution is not warranted, as it is considered that the same level of serious negligence was present throughout the entire processing period. While it is true that the UIV did not act with the required diligence in analyzing the necessity and proportionality of the processing carried out, it did prepare a Data Protection Impact Assessment (DPIA) in 2020 and included a mention of existing alternatives, updating the DPIA twice, albeit insufficiently and belatedly. Therefore, although the analysis
carried out is considered manifestly insufficient and the UIV was in a position to know
that the processing carried out was neither necessary nor proportionate because it was
aware of this Agency's report 36/2020 from the outset of the processing, it is
considered that the negligence should not be classified as very serious, but rather as serious,
also reducing the proposed sanction for this infringement.
It is also worth mentioning the actions taken by the UIV to adapt its
personal data processing to the GDPR requirements, which, while
not sufficient, should be welcomed.
- Article 83.2 g) “the categories of personal data affected by the
infringement”.
In this case, the processing carried out by the UIV affects one of the special categories of data, biometric data, whose need for protection is greater than that of other personal data, according to the Constitutional Court's ruling 76/2019 of May 22, 2019, appeal 1405/2019. However, it is considered that this aggravating circumstance should only apply to the processing carried out from November 2023 onwards, as already stated, and therefore the fine should also be reduced for this reason.
- Article 76.2.f) of the LOPDGDD. The connection between the offender's activity and the processing of personal data.
In this regard, the UIV, due to its activities, processes numerous personal data on an ongoing basis, both with respect to the data of all students, as well as the faculty and other employees.
As a consequence of the available evidence, and considering the University's business volume and the investigation carried out, it is deduced that the amount of the fine initially set in the initial agreement and the Proposed Resolution should be modified, and a fine of €350,000 should be imposed for the commission of an infringement of Article 5.1 c) of the GDPR, taking into account the concurrence of all the criteria for determining the severity of the penalty that have been established during the investigation phase.
In accordance with the grounds set forth in this resolution of the sanctioning procedure, the violation by the International University of Valencia of the provisions of Articles 9 and 5.1 c) of the GDPR has been proven, a situation that must be rectified so that the actions of the aforementioned University comply with the applicable regulations.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 224/225
Therefore, in accordance with applicable legislation and having assessed the criteria for
graduating the sanctions, the existence of which has been proven, the Presidency of
the Spanish Data Protection Agency
RESOLVES:
FIRST: TO IMPOSE on UNIVERSITAT INTERNACIONAL VALENCIANA-
VALENCIAN INTERNATIONAL UNIVERSITY, S.L., with Tax Identification Number B98585797:
- A fine of 300,000 euros for committing an infringement of Article 9 of the
GDPR, specifically as defined in Article 83.5 of the GDPR.
- A fine of €350,000 for committing an infringement of Article 5.1.c) of the GDPR, as defined in Article 83.5 of the GDPR.
SECOND: NOTIFY this resolution to UNIVERSITAT INTERNACIONAL VALENCIANA-VALENCIAN INTERNATIONAL UNIVERSITY, S.L.
THIRD: This resolution will become enforceable once the deadline for filing an optional appeal for reconsideration (one month from the day following notification of this resolution) has expired without the interested party having exercised this right.
The sanctioned party is advised that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Article 83.5 of the GDPR. 98.1.b)
of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), within the voluntary payment period established in Article 68 of the General Collection Regulations, approved by Royal Decree 939/2005, of July 29, in relation to Article 68. 62 of Law 58/2003, of December 17, by depositing the sanctioned party's Tax Identification Number (NIF) and the procedure number shown in the heading of this document into the restricted account IBAN: ES00-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A. Otherwise, collection will be initiated during the enforcement period.
... Once the notification is received and becomes enforceable, if the enforceability date falls between the 1st and 15th of each month, inclusive, the deadline for making a voluntary payment will be the 20th of the following month or the next business day thereafter. If the date falls between the 16th and the last day of each month, inclusive, the payment deadline will be the 5th of the second following month or the next business day thereafter.
In accordance with Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), this Resolution will be made public once it has been notified to the interested parties.
This resolution, which concludes the administrative process pursuant to Article 50 of the LOPDGDD, may be appealed. 48.6 of the
LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, the
interested parties may, optionally, file an appeal for reconsideration with the
Presidency of the Spanish Data Protection Agency within one month from the day following notification of this resolution or directly at
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 225/225
contentious-administrative appeal before the Contentious-Administrative Chamber of the
National Court, in accordance with the provisions of Article 25 and paragraph 5 of
the fourth additional provision of Law 29/1998, of July 13, regulating the
Contentious-Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the
referred Law.
Finally, it should be noted that, in accordance with Article 90.3 a) of the LPACAP (Law on the Common Administrative Procedure of Public Administrations), a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an appeal with the Administrative Court.
If this is the case, the interested party must formally notify the Spanish Data Protection Agency of this fact by submitting a written request through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in Article 16.4 of Law 39/2015, of October 1. They must also provide the Agency with documentation proving the effective filing of the appeal with the Administrative Court. If the Agency does not receive notification of the filing of an administrative appeal within two months from the day following notification of this resolution, it will terminate the precautionary suspension.
938-100325
Lorenzo Cotino Hueso
President of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
