Constitutional limits and guarantees with biometric identification

Abstract

This article examines the constitutional limits and guarantees with the use of biometric identification techniques in the light of sanction PS/00120/2021 instructed by the AEPD and passed in Spring 2021. Biometric data, according to the GDPR, are those personal data obtained via a specific technical treatment, relative to the characteristics of a physical person, which allow for the confirmation of the unique or unambiguous identification of said person, such as biometric facial patterns as the case may be. There is much confusion with regard to this, and the AEPD itself has acknowledged that there have been a series of errors in relation to this technology (fingerprints or facial recognition) for the purposes of identification and authentication. For this task, the indeterminate legal concept of “essential public interest” is analyzed in accordance with jurisprudence, as an exception to the general prohibition of the treatment of biometric data ex article 9.2.g) GDPR. More specifically, the problem is approached from a triple perspective: from the point of view of the subject, especially with relation to that responsible for treatment (with special mention of the event that this is not a public organization), from a formal point of view, the limits relating to legal discretion, and finally from a substantive point of view, the material limits pertaining to the principle of proportionality and the minimum content of the fundamental right to the protection of personal data are studied.