An AI feature being available is not reason enough to switch it on, says Spain’s data protection agency
Spain’s AEPD warned two town councils planning AI analysis of their camera footage. Its reasoning applies to the AI features now built into everyday business tools.
On October 6, 2026, Spain’s data protection agency, the AEPD, announced preventive warnings to two town councils that plan to add AI image analysis to their video surveillance. One project planned facial detection or recognition. The other would detect people and vehicles and allow searches for a person by appearance (clothing, hair, sex or age group), including from a photograph. Neither project had started, and the AEPD notes that this kind of warning does not mean the council committed an infringement.
The agency’s central point is that having a technology available does not by itself justify using it. Each automated analysis function added to the cameras has to be assessed on its own: whether it is necessary for the purpose pursued, and whether it is proportionate. Deciding to install cameras does not settle that. Before launch, the organization must define what data each function generates, how long it is kept and who can see it. If the processing may pose a high risk, a data protection impact assessment has to come first, and if a function can identify someone uniquely, the stricter rules for biometric data apply. People must be told clearly what is happening, and data protection has to be part of the decisions on buying, configuring and deploying the system.
What it means for your work
The reasoning reaches well beyond cameras. Business tools keep adding AI features, sometimes switched on by default: meeting transcription, sentiment scoring of customer calls or résumé screening, for example.
Assess each feature on its own and switch off any that has no clear purpose. For the ones you keep, decide in advance what data they store, for how long and who can read it, and ask the vendor these questions before you sign. Organizations under the GDPR can use the AEPD’s criteria as a checklist, and they hold up well in other countries too.
Sources
This page is educational and is not legal advice.