AEPD warns Spanish municipality over facial AI cameras

Spain’s data protection regulator issued a preventive warning on 6 October 2026 about an unnamed municipality’s planned AI-enabled video surveillance project. The action concerned facial detection or recognition capabilities—not a finding that the municipality had broken the rules.

What's changing

The Agencia Española de Protección de Datos (AEPD) warned that the planned processing could breach data protection requirements. No fine was reported, and the warning did not establish an infringement. The important distinction is timing: the regulator intervened at the planning stage, rather than announcing a penalty for unlawful processing already carried out.

The GDPR expressly allows this approach. Article 58(2)(a) gives supervisory authorities the power to warn a controller or processor that intended processing is likely to infringe the regulation. A preventive warning is therefore a regulatory intervention, but it should not be described as a conviction, a fine or proof of wrongdoing.

The supplied facts do not identify the municipality, the camera locations, the technology provider or the precise configuration. They also do not establish whether the project would merely detect faces or identify particular people. Those details matter because different functions can create different legal risks.

Face detection generally locates a face in an image. Facial recognition can compare facial characteristics to identify or authenticate someone. Under GDPR Article 9(1), biometric data processed to uniquely identify a person falls within a specially protected category. Not every camera image or face-detection feature automatically meets that test, although identifiable video can still be personal data subject to ordinary GDPR requirements.

For municipalities, the warning makes the practical message clear: assess the actual processing before buying or switching on the system. Calling a product “AI-enabled” does not establish that it is unlawful, but calling it “security equipment” does not remove privacy obligations either.

Who is affected

The immediate target was a municipality in Spain. The action is not a new national surveillance law, nor does it establish that every Spanish council using cameras has infringed the GDPR.

Its relevance nevertheless extends to Spanish public bodies considering camera systems, especially procurement teams, security departments, IT staff and data protection officers. Technology suppliers and installers also need to explain accurately what their products collect, infer, compare and retain. A council cannot assess a system properly if the supplier’s description blurs detection and identification.

Residents, visitors and municipal employees may be affected when cameras capture them in streets, facilities or workplaces. The scale and setting matter. GDPR Article 35(3)(c) specifically requires a data protection impact assessment for systematic monitoring of a publicly accessible area on a large scale. Article 35 also requires an assessment where processing is otherwise likely to create high risks to people’s rights and freedoms.

There is no general exemption simply because a council is small or buys an off-the-shelf product. Equally, the warning should not be read as imposing identical requirements on every camera deployment. Purpose, coverage, identification capability and risk all need individual assessment.

Three things to do this week

1. Establish exactly what the proposed system does. Ask the supplier for a written feature inventory: face detection, identity matching, biometric templates, watchlists, tracking, storage and access. Record which functions are enabled, optional or remotely configurable. Map where footage and derived data go, including any supplier access. Do not rely on a marketing label or assume that disabling one feature resolves every privacy risk.

2. Check the legal basis and necessity before proceeding. Document the surveillance purpose and why less intrusive measures would not adequately achieve it. If relying on a public-interest task or official authority, examine GDPR Articles 6(1)(e) and 6(3), including the relevant legal foundation. If the system processes biometric data to uniquely identify people, identify an applicable Article 9 exception as well; an ordinary lawful basis alone is insufficient. Review data minimisation and retention under Article 5, alongside notices, access controls and supplier responsibilities.

3. Complete the risk assessment—and act on it. Involve the municipality’s data protection officer and determine whether Article 35 requires a data protection impact assessment. Where required, complete it before processing begins, not after installation. Assess false matches, unauthorised access, excessive coverage and effects on people who cannot realistically avoid the cameras. If high residual risk remains despite safeguards, Article 36 requires prior consultation with the supervisory authority. Translate findings into procurement conditions, technical restrictions or a decision not to proceed.

Related context

Spain’s broader framework includes AESIA, whose statute was approved by Royal Decree 729/2023, which entered into force on 3 September 2023. That institutional framework does not replace the AEPD’s data protection role.

The AI governance bill was approved by the Council of Ministers and sent to the Cortes Generales on 26 May 2026. That step should not be treated as proof that the bill became binding law.

The immediate lesson is narrower: existing GDPR duties are live now, and planned AI surveillance can attract regulatory scrutiny before deployment.

Note: this article was drafted by AI - OpenAI GPT-6.1