The Spanish National Court (Audiencia Nacional) has annulled one of the most controversial data protection documents issued by the Spanish Data Protection Agency (AEPD): its November 2023 Guidance on the use of biometric systems for employee attendance control.
At first sight, the judgment may appear to represent a major shift in the regulation of biometric timekeeping. It does not.
The decision is important, but for reasons very different from those suggested by many headlines. The Court did not conclude that fingerprint or facial recognition systems are compatible with the GDPR. Nor did it relax the legal requirements applicable to biometric processing.
Instead, the judgment focuses on an administrative law question with potentially wider implications: when does regulatory guidance cease to be guidance and become binding regulation?
1. One of the AEPD’s most controversial publications
The AEPD’s 2023 Guidance radically changed the practical landscape for organisations using biometric authentication in the workplace.
Building on recent European Data Protection Board (EDPB) guidance, the AEPD adopted an extremely restrictive interpretation of Article 9 GDPR, concluding that biometric systems used for attendance monitoring would, in practice, be extraordinarily difficult to justify.
For many organisations, the Guidance effectively closed the door on fingerprint-based time recording systems that had been widely used for years.
Although formally described as a “guide”, the document rapidly became the reference point for the AEPD’s own investigations and enforcement activity.
2. Why did the Court annul it?
Importantly, the Court did not examine whether the AEPD’s interpretation of the GDPR was legally correct.
Instead, it focused on the legal nature of the document itself.
According to the judgment, the Guidance did far more than provide practical recommendations. It established general criteria intended to guide the behaviour of controllers and processors and was subsequently relied upon by the AEPD in its supervisory and enforcement activities.
In substance, therefore, it operated as a regulatory circular.
Spanish administrative law has long recognised that the legal nature of an instrument depends on its content and practical effects rather than its title. Simply calling a document a “guide” does not prevent it from being treated as a regulatory measure where it effectively produces binding external effects.
Because the AEPD did not follow the statutory procedure required for adopting such instruments, including the procedural safeguards applicable under the Spanish Data Protection Act, the Court annulled the Guidance.
The judgment therefore reinforces an important constitutional principle: public authorities cannot avoid procedural safeguards simply by labelling regulatory instruments as guidance.
3. What the judgment does not mean
Perhaps the most important takeaway is what the judgment does not say.
It does not hold that biometric attendance systems comply with the GDPR.
It does not reject the interpretation adopted by the EDPB.
It does not invalidate Article 9 GDPR or the strict conditions applicable to the processing of biometric data.
Nor does it establish that fingerprint or facial recognition systems may once again be freely deployed for employee attendance monitoring.
The Court deliberately avoided examining those substantive questions.
4. The GDPR analysis remains largely unchanged
For organisations considering biometric attendance systems, the practical legal position changes very little.
Biometric data processed for the purpose of uniquely identifying individuals remains a special category of personal data under Article 9 GDPR.
Controllers must still identify an appropriate legal basis under Articles 6 and 9 GDPR, demonstrate strict necessity, comply with the principles of proportionality and data minimisation, and carefully assess whether less intrusive alternatives exist.
In practice, this remains a demanding exercise.
Indeed, the reasoning reflected in the AEPD’s Guidance largely mirrored the restrictive approach already emerging at European level.
5. Why this judgment matters beyond biometrics
The significance of the judgment extends well beyond attendance systems.
European supervisory authorities increasingly publish guidelines, FAQs, recommendations, position papers and similar documents intended to assist organisations with compliance.
Such guidance undoubtedly plays an important role.
However, where these documents effectively establish binding rules or predetermined enforcement criteria, questions inevitably arise regarding their legal status and the procedural safeguards that should accompany their adoption.
The judgment therefore serves as an important reminder that regulatory certainty must be achieved through legally appropriate instruments.
Authorities may interpret the law. They may explain the law.
But where guidance effectively becomes regulation, the procedural requirements applicable to regulation cannot simply be bypassed.
Final thoughts
The judgment represents an important procedural victory for the rule of law and for legal certainty.
It does not, however, represent a substantive victory for organisations wishing to rely on biometric attendance systems.
For most employers, fingerprint and facial recognition systems remain very difficult to justify under the GDPR. The legal debate surrounding biometric processing therefore continues largely unchanged, even if the vehicle through which the AEPD sought to articulate its position has now been set aside.
