AEPD issues warnings to two Spanish municipalities over AI‑enabled video surveillance projects

What happened

The Spanish Data Protection Agency (AEPD) sent preventive warnings (AI‑00170‑2026 and AI‑00171‑2026) to two local councils regarding planned video‑surveillance systems that use automated image analysis with AI. The agency stresses that the mere availability of AI capabilities does not justify their use and that data‑protection safeguards must be built in from design, including necessity, proportionality, DPIA and specific measures for biometric data. The warnings aim to ensure compliance before the systems become operational.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The action highlights the need for data‑protection‑by‑design and proportionality when deploying AI‑driven video surveillance in the public sector.
• Takes effect October 6, 2026.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.
3. Revisit retention schedules and data minimisation for the data involved.
4. Map the security requirements to existing controls and close gaps.
5. Inventory AI or automated decision systems in scope and their assessments.
6. Confirm handling of sensitive data categories meets the stricter rules.