The Spanish authority issued preventive warnings to two municipalities regarding their video surveillance projects incorporating artificial intelligence. It reminds that the availability of a technology does not justify its use, which must be preceded by an analysis of necessity and proportionality for each intended functionality, and include data protection safeguards by design.

Facts and context

The Spanish data protection authority (AEPD) issued warnings to two municipalities regarding their video surveillance projects involving automated image analysis functionalities by artificial intelligence.

The case originates from the authority's preventive function, which examined processing projects not yet initiated by two municipalities, one involving facial detection or recognition, and the other searching for persons by physical or clothing characteristics.

Reasons for the decision

The authority recalled several fundamental safeguards to be integrated before implementing such systems:

• Analysis of necessity and proportionality (Article 5 of the GDPR): The authority emphasizes that the mere technical availability of an identification, search, or tracking functionality does not justify its use. The data controller must analyze in advance which functionalities are necessary for the pursued purpose and whether their implementation is proportionate, assessing this aspect for each automated analysis capability and not globally for the camera installation.
• Integration of data protection by design (Article 25 of the GDPR): The authority reminds that data protection must be integrated from the earliest phases of the project, influencing decisions on acquisition, selection, configuration, and deployment of systems. This implies determining which data are generated by each function, their retention period, and the persons authorized to access them.
• Processing of high-risk data and biometric data (Article 9 of the GDPR): The authority highlights the risks to rights and freedoms, which must be assessed through a data protection impact assessment when the processing is likely to result in a high risk. It specifies that if the technical analysis reveals processing of biometric data for the purpose of uniquely identifying a person, the enhanced regime provided for such data must apply and specific safeguards must be implemented.
• Transparency obligation (Article 5 of the GDPR): The authority insists that data subjects must receive clear, accessible, and understandable information about the processing of their data, its purposes, and the role played by the artificial intelligence system.

Authority's decision

Consequently, the authority issued preventive warnings to the two municipalities, in accordance with Article 58, paragraph 2, point a) of the GDPR.

Lessons learned

This decision reminds that:

• The justification for the use of artificial intelligence in video surveillance must be carried out functionality by functionality (e.g., facial recognition, attribute-based search), and not for the system as a whole.
• The integration of data protection principles by design is a prerequisite for the acquisition and deployment of such technologies, not merely a formal compliance procedure afterwards.
• The prior technical analysis must precisely determine whether a functionality constitutes processing of biometric data for unique identification purposes, as this triggers the application of a reinforced legal regime and specific safeguards.