This decision by the Spanish authority constitutes one of the first applications of its guide on the processing of neurodata, sanctioning a company specialized in this field for breaches related to the legal basis of processing, obligations as a processor, and the conduct of the data protection impact assessment.

Facts and context

The Spanish Data Protection Authority (AEPD) issued a sanction decision against BIT&BRAIN TECHNOLOGIES S.L. (including the imposition of a fine of €4,800) for breaches related to the processing of neurodata.

The case originated from an ex officio investigation opened by the authority following information about the company's neurotechnology activities, notably the marketing of devices and software processing neurological data.

Grounds for the decision

• Obligation to have a valid legal basis (Article 6 of the GDPR): The authority found that for its "Service" activity, where it acts as controller, the company relied on the consent of participants. However, this consent was neither specific, as it did not distinguish between different purposes such as conducting the study and internal improvement of algorithms, nor sufficiently informed, omitting to mention the processing of biometric data or the right to withdraw consent. Referring to the European Data Protection Board (EDPB) Guidelines 5/2020 on consent, the authority concluded the legal basis was invalid.
• Obligation to govern processing by a contract (Article 28 of the GDPR): For its "Laboratory" activity, the company acted as a processor for its clients. It itself used sub-processors (Amazon and DigitalOcean) for data processing on its cloud platform. The authority noted that the company had neither obtained prior written authorization from the controllers for this use, violating Article 28(2) of the GDPR, nor formalized contracts with these sub-processors imposing the same obligations, as required by Article 28(4) of the GDPR.
• Obligation to conduct a comprehensive impact assessment (Article 35 of the GDPR): Although a data protection impact assessment (DPIA) was conducted in 2019, the authority found it substantially deficient. The analysis of necessity and proportionality was insufficient, not considering less intrusive alternatives to neurodata processing. The risk assessment was superficial and the mitigation measures described as generic. Finally, the opinion of the data protection officer, appointed in 2023, had not been sought for an update of the DPIA, contrary to Article 35(2) of the GDPR.

Decision of the authority

Consequently, the authority imposed a fine of €4,800 on BIT&BRAIN TECHNOLOGIES S.L., after applying a 40% reduction for acknowledgment of responsibility and voluntary payment.

Furthermore, the authority ordered the company to bring its processing into compliance within 3 months, notably by establishing a valid legal basis for each purpose, formalizing its processing relationships, and conducting a new impact assessment addressing the identified deficiencies.

Lessons learned

This decision reminds that:

• The processing of physiological signals (electroencephalogram, galvanic skin response) allowing inference of emotional or cognitive states is likely to be qualified as processing of health or biometric data, which requires increased vigilance on the legal basis and conducting a rigorous DPIA.
• Consent obtained for a primary purpose, such as participation in a study, must be clearly distinguished from that obtained for secondary purposes, such as algorithm improvement. Combining these purposes invalidates consent due to lack of specificity.
• A processor cannot rely on an erroneous qualification of data (anonymous instead of pseudonymized) to exempt itself from its obligations under Article 28 of the GDPR, notably the obligation to obtain the controller's authorization before engaging a sub-processor.