What a vascular-pattern system identifies
Vascular recognition compares characteristics of finger or hand veins with an enrolled reference to support identity verification. Some designs use infrared illumination and a camera to obtain a pattern; processing extracts features and produces a template. Hitachi’s technical source describes this principle and variants, but does not establish identical performance across all products.
At work, recognising an identity is only part of access management. Authorisation also depends on location, task, time and permitted conditions. A matching result does not establish training, medical fitness, absence of fatigue or installation safety. Nor is the reader a clinical test of blood circulation: using a bodily characteristic for authentication does not turn equipment into a diagnostic instrument. Identity, entitlement and health assessment must remain separate decisions.
Authentication and identification searches
One-to-one authentication compares a sample with the template linked to the identity claimed by the person. One-to-many identification searches for matches within a collection of identities. This distinction affects architecture, tracking possibilities and impact assessment. It does not mean that all authentication falls outside the enhanced protection of biometric data.
The institutional position published by Spain’s AEPD in July 2025 retains that protection for both processes while distinguishing their intensity. Project assessment should map the information journey: where capture occurs, where comparison happens, who retains the reference and what the door or application receives. The device’s commercial name does not answer these questions or reveal its architecture. Two products using the same physical characteristic may create substantially different information flows and risks.
Purpose, legal basis and special-category data
The GDPR requires a lawful basis and, where biometric data are processed to uniquely identify someone, an applicable exception to the Article 9 prohibition. These are separate requirements. Legitimate interests under Article 6 are not, on their own, an Article 9 exception. General references to security, innovation or workplace prevention are insufficient to establish that exception.
Specify whether the purpose is recording working time, protecting a particularly sensitive area or another concrete objective. Then examine the law and conditions applicable to that purpose. An obligation to control entry does not automatically select biometrics as the necessary means. Assessment requires legal expertise and involvement of the data protection officer where appropriate. This article does not authorise deployment or presume that every activity has the same legal justification.
Sources: [2]
Interpreting current Spanish guidance
The AEPD’s November 2023 attendance-control guidance PDF was marked “EN REVISIÓN”, meaning under review, when consulted on 8 November 2026. That status should remain visible when using it, and the case should be checked against the GDPR and subsequent guidance. It should not be presented as either an authorisation or an immutable universal rule.
In July 2025, the AEPD published an institutional summary concerning police facilities with specific public-security needs. It describes contextual assessment of localised authentication and safeguards. That case is not equivalent to ordinary employee time recording. The editorial conclusion is to avoid both extremes: assuming every biometric system is allowed because it protects a door, or declaring every biometric operation unlawful regardless of purpose and legal framework. The source is a case summary, not the complete binding decision.
Consent and less intrusive alternatives
The EDPB highlights the imbalance between employer and employee: consent in most employment processing cannot be assumed freely given simply because someone signs. Exceptional circumstances require demonstrating that refusal has no adverse consequences. This does not remove requirements concerning necessity, minimisation and other applicable safeguards.
A checkbox that must be accepted to enter work does not resolve the assessment. Alternatives such as credentials, organisational controls and multifactor authentication should be examined where they fit the risk. Comparison must use the actual objective, rather than convenience or speed alone. An equally effective, less intrusive option is relevant to proportionality. A nominal alternative that imposes queues, unfavourable treatment or unjustified difficulties is insufficient as a practical guarantee of choice for the people expected to use it.
Impact assessment before collecting data
Where processing is high risk, the impact assessment must precede it and describe operations, necessity, proportionality, risks and safeguards. It is not paperwork completed after purchase. A favourable assessment does not create a missing lawful basis: lawfulness and the Article 9 exception must each be established separately.
A useful project sequence reviews purpose and alternatives first, architecture and safeguards next, and conditions for any lawful deployment afterwards. Even a pilot using real templates processes personal data. Collecting them merely to see whether the device works should therefore not precede resolution of these requirements. Where high risk remains and cannot be sufficiently mitigated, the controller must consult the supervisory authority before processing begins, under Article 36. Affected people need understandable information about the processing and their rights, including how concerns or errors can be raised.
Sources: [2]
Accuracy, exclusion and incident review
Biometric comparison can incorrectly accept a match or reject a legitimate user. A laboratory error rate does not automatically describe performance elsewhere. Technical assessment should retain testing conditions, included populations and the decision criterion, rather than convert an advertised percentage into individual certainty or a guarantee that the system cannot be mistaken.
An accessible route is needed for errors, injuries or inability to use the reader. Failure should not be interpreted as dishonesty, illness or misconduct without checking. Consequences of solely automated decisions producing legal or similarly significant effects also require assessment. Human review needs real authority to correct and resolve an outcome; merely confirming what the screen says does not provide that safeguard. Incidents should be recordable without unnecessarily disclosing bodily information or drawing unsupported conclusions about health.
Template security and continuity
A template remains personal information when it can link to or distinguish a person. Encryption or transformation does not automatically make it anonymous. Storage, administrative access, transfers, retention and deletion require assessment, along with data exposure during enrolment and maintenance. A central database and a reference controlled by the individual involve different architectures and risks.
Supplier contracts should clarify responsibilities and access, rather than permit indefinite secondary use for system training or expanded monitoring. Operational planning should address network failure, loss of availability and emergency exit without dependence on a biometric match. Retention periods should follow each purpose: keeping access records does not require keeping the authentication template indefinitely. A security design must protect people’s information throughout the lifecycle, not merely secure the door at the moment it opens.
Hypothetical example: a warehouse door
A company proposes vascular readers on every door after discovering that some access cards have been shared. The review team separates two objectives: controlling a restricted area and recording working time for the entire workforce. It examines incidents, existing authorisations and less intrusive alternatives before collecting biometric data from anyone.
Part of the problem turns out to be permissions that were never revoked and a door routinely held open. Correcting these conditions takes priority and does not require a database of bodily patterns. The company documents its decision and subjects any specific biometric proposal to the appropriate legal and impact assessment. The example does not establish that cards are always sufficient; it shows that selection should address a demonstrated need, rather than device novelty or a poorly defined security problem.
Relationship with OSH and Sabentis
The preventive relationship concerns access consistent with authorised tasks, protection of rights and avoiding exclusion or health decisions caused by technical failure. Biometrics do not replace risk assessment, training or occupational health surveillance. They should not become a source of individual fitness indicators inferred from bodily characteristics simply because a sensor is available at the entrance.
Sabentis relates to tracing requirements, authorisations and OSH actions; vascular recognition or automated diagnosis is not attributed to it here. Suggested management indicators include reviewed permissions, resolved incidents and functioning alternatives, using minimum necessary data. A project may reasonably conclude that biometrics are unnecessary. Decision quality rests on suitability, safeguards and verifiable outcomes, rather than the number of sensors installed or the volume of personal information collected.
Frequently asked questions
Does one-to-one authentication avoid GDPR Article 9?
No. Biometric authentication to verify identity also involves specially protected data, although its impact can differ from one-to-many searching.
Does an employee signature authorise deployment?
No. Legal conditions, necessity and safeguards must be established; employment imbalance limits freely given consent.
Is an encrypted template anonymous?
Not necessarily. If it can link to or distinguish a person, it remains personal data.
Can the reader determine medical fitness?
No. An identity match or reading error does not establish health, fatigue or fitness for a task.
