- Enforcing jurisdiction
- Spain · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case PS/00129/2020 – Dismissed (Spain, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A complaint against the Spanish Tax Authority was dismissed because they provided adequate information about their use of a biometric system. This decision is important as it shows that organizations can use such systems if they inform employees properly.
What happened
A civil servant complained that their employer used a biometric system without proper information.
Who was affected
Employees of the Spanish Tax Authority who were affected by the biometric system.
What the authority found
The authority found that the Tax Authority had provided clear information to employees about the biometric system.
Why this matters
This ruling emphasizes the need for transparency when using biometric data. Organizations must ensure they communicate clearly with their employees about data collection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A civil servant of the Spanish Tax Authority complained about their employer beginning to use a biometric system to register access and working hours of employees without proper information to the affected data subjects. The Tax Authority rejected the claim by providing evidence of the information provided to the employees before starting the collection of their fingerprints and the further information provided before starting to actually use the new system The Spanish DPA held that the information provided by the Tax Authority to its employees was clear, precise and concise enough to satisfy the requirements of the GDPR. Furthermore, the Tax Authority also complied with the requirements of choosing the correct legal basis for the processing of sensitive data and of performing a Data Protection Impact Assessment.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case PS/00129/2020 in ES
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case PS/00129/2020 - Spain (2021). Retrieved from cookiefines.eu
Last updated: