The AEPD sets out safeguards for incorporating artificial intelligence into video surveillance systems
- Background
On 6 October 2026, the AEPD reported that it had issued two warnings to local councils whose CCTV projects included AI capabilities for the automated analysis of images.
Both actions fall within the remit set out in Article 58 of the GDPR, which allows supervisory authorities to issue warnings where certain planned processing operations may breach data protection regulations. The AEPD points out that the purpose of this measure is not to penalise conduct or to declare the existence of an infringement, but rather to warn that certain processing operations could be contrary to the regulations.
The AEPD’s warnings stem from two municipal video surveillance projects which envisaged the incorporation of artificial intelligence capabilities for the automated analysis of images. The planned capabilities included the detection and classification of people and vehicles, the generation of metadata, searches for individuals based on specific physical attributes or reference images and, in one of the projects, facial recognition capabilities.
2. The AEPD’s analysis
Looking beyond the specific circumstances of the cases analysed, the AEPD considered it necessary to reiterate the main obligations and safeguards that must be observed when incorporating artificial intelligence tools into video surveillance systems, particularly where these may significantly affect individuals’ rights and freedoms or involve the processing of biometric data.
a. Data protection by design and by default
The Agency emphasises the importance of integrating the principles of data protection by design and by default into projects that incorporate AI into video surveillance systems.
In accordance with Article 25 of the GDPR and Article 28 of Organic Law 7/2021, these safeguards must be taken into account both when determining the means of processing and throughout its implementation.
According to the AEPD, this approach enables the risks associated with processing to be identified and mitigated before the technology is put into operation and requires the adoption of appropriate technical and organisational measures to ensure compliance with the regulations.
As an illustration of these principles, the AEPD points out that the mere technical availability of a feature does not constitute sufficient justification for its use. Features such as facial recognition, searching by attributes or locating individuals must be analysed and justified on a case-by-case basis in light of the intended purpose, demonstrating their necessity, suitability and proportionality.
b. Special attention to the processing of biometric data
The AEPD pays particular attention to those functions that may involve the processing of biometric data intended to uniquely identify an individual.
The Agency warns that in such cases, the stricter regime set out in Articles 4(14) and 9 of the GDPR and in Article 13 of Organic Law 7/2021 will apply, and there must also be an appropriate legal basis and specific safeguards for the rights and freedoms of the data subjects.
The Agency’s considerations are in line with the AI Regulation, which subjects remote biometric identification systems to a particularly strict regime. In particular, the use of real-time remote biometric identification systems in public spaces for law enforcement purposes is, as a general rule, prohibited, except in the exceptional cases expressly provided for by the legislation and subject to specific conditions. For their part, remote biometric identification systems not covered by this prohibition may be classified as high-risk systems, in which case the corresponding enhanced obligations regarding risk management, governance and data quality, human oversight, documentation and conformity assessment apply to them.
c. Prior assessment of risks to the rights and freedoms of data subjects
The AEPD points out that data controllers must assess, prior to the system’s implementation, the risks that the processing may pose to the rights and freedoms of the individuals concerned, including users, staff and third parties.
In this regard, the Agency emphasises that the incorporation of advanced artificial intelligence functionalities applied to video surveillance – particularly those that enable the classification of individuals, the generation of metadata, searches based on physical attributes, the use of reference images or the incorporation of identification capabilities – requires a specific assessment of their impact on the fundamental rights of data subjects.
It also points out that, where the processing is likely to result in a high risk within the terms set out in Article 35 of the GDPR and Article 35 of Organic Law 7/2021, the relevant data protection impact assessment must be carried out prior to the start of the processing.
Furthermore, the Agency points out that, in the case of fixed CCTV cameras installed in public places, a necessity and proportionality analysis must also be carried out, taking into account both the intended purpose and the potential impact on the public. This assessment must not be limited to the installation of the cameras, but must extend to each of the artificial intelligence functionalities incorporated into the system.
Although the warnings do not expressly classify the projects analysed as high-risk processing operations, the functionalities examined highlight the need to carry out a rigorous assessment of the risks associated with the processing and, where appropriate, to conduct a data protection impact assessment prior to their deployment.