The National Court annuls the AEPD guide on biometric time tracking

The National Court (Audiencia Nacional) has annulled the AEPD guide on attendance monitoring through biometric systems, the document that since November 2023 had served as the reference for treating fingerprint or facial recognition clock-ins as, in practice, unworkable. The ruling is SAN 367/2026 of 30 June 2026 (Section 1 of the Contentious-Administrative Chamber, ECLI ES:AN:2026:2870), issued following a challenge brought by an association against the guide.

The ruling has to be read closely, because the headline invites a costly misunderstanding. The National Court has not said that biometrics for clocking in are legal. What it strikes down is the way the guide was approved, not its content.

What the court annuls, and why

The AEPD published the guide on 23 November 2023 with the label of a guidance document. The court reads it and concludes that there was little guidance about it: it contained “a genuine setting of criteria to which the Agency’s action would conform”, with external effects on data controllers. It operated, in practice, as a rule that imposed obligations on third parties.

The problem is that a rule of that kind has a proper channel. According to the ruling, the AEPD should have processed it as a circular, following the procedure required by Article 55 of the LOPDGDD (Spain’s Data Protection Act) and Article 6 of Royal Decree 389/2021: reports, a hearing and formal publication. By skipping that channel and pushing out through the back door something that was substantively binding, the guide is tainted by a procedural defect that invalidates it in full.

This nuance is what makes the ruling easy to misread. A court can strike down a rule on the merits, because its content is contrary to law, or on procedure, because the body lacked competence or failed to follow the procedure. Here it is the latter. The guide’s legal reasoning on proportionality, consent or special categories has not been reviewed or overruled. It simply no longer exists as a document with effects.

Why this does not open the door to fingerprint or face

The temptation is to read the annulment as a green light, and that is the mistake: the guide was never the source of the obligations, it only interpreted them.

What prohibits or restricts the use of biometric data is not the guide, it is Article 9 of the GDPR, which classifies biometric data used to identify a person as a special category with reinforced protection. That article remains in force, as does Article 34.9 of the Workers’ Statute, which requires a record of working hours but says nothing about doing it with a fingerprint. Annulling the guide touches neither of those two rules.

From this comes the practical consequence that matters most to a company: a penalty can still hold up even though the guide no longer exists, provided the AEPD grounds it directly in the GDPR rather than merely referring back to the annulled guide. The obligations of a valid legal basis, minimisation, impact assessment and proportionality have not moved an inch.

There is even a less intuitive reading. The guide, restrictive as it was, provided certainty: a company knew which criterion the Agency would apply. With it annulled, that criterion is no longer written down anywhere until the AEPD reacts, and the Agency has already signalled that it is studying a new response. For anyone who wanted a clear reference before installing a fingerprint reader, right now there is none.

What to do if you already clock in with biometrics (or planned to)

With the ruling on the table, this is the terrain for a company using or weighing up fingerprint or facial recognition:

• Employee consent remains a fragile basis. The power imbalance in the employment relationship, which prevents it from being considered freely given, is GDPR doctrine, not something the guide invented.
• The impact assessment and the proportionality test remain mandatory, and now without an official document telling you where the line falls. Any biometric deployment has to stand on its own justification.
• The ruling is not final. It can be appealed on points of law before the Supreme Court, so building a biometric system on the idea that “there is no guide anymore” is building on something that could be reversed within months.

For a company, the choice to use biometrics has to be justified today under the same requirements as before the ruling, and with fewer public references to lean on.

The route that sidesteps the whole debate

The heart of the matter is that clocking in does not require biometric data. It requires knowing who is clocking in and at what time, and that is resolved without touching the special category of Article 9.

That is precisely the approach behind Cleverfy. Clocking in is done from the browser, the mobile app, via WhatsApp, or on a shared device in kiosk mode, a tablet where each person clocks in with their PIN. None of those systems process biometric data, so they fall outside the terrain this entire ruling is about.

The result is a record that meets Article 34.9 of the Workers’ Statute and is ready for the new Royal Decree on digital time-tracking records, without handling special-category data and without depending on what the AEPD or the Supreme Court eventually decide about biometrics. If you are rethinking how your team clocks in, you can see a demo or check the plans.

---

This article is general information about a specific court ruling and does not constitute legal advice. For specific situations, consult a lawyer specialising in data protection.

Sources:

• La AN anula la guía de la AEPD sobre fichaje biométrico — Iberley
• LOPDGDD — Ley Orgánica 3/2018 (art. 55)
• Reglamento General de Protección de Datos — RGPD (art. 9)