Spain fines Yoti €950k for biometric GDPR breaches
Spain’s data protection authority hit biometric-ID app Yoti with a €950,000 fine for invalid consent on selfies, excessive biometric processing, and five‑year location retention — a stark lesson for consumer health apps handling sensitive identifiers. Regulators are clearly policing biometric and location use, so consent design and data minimization matter now. (x.com)
Spain’s data‑protection decision was published on 10 March 2026 under file reference EXP202317887 and the document bears the signature of AEPD president Lorenzo Cotino Hueso. (compliancehub.wiki) The regulator apportioned the penalties by legal provision: €500,000 under GDPR Article 9 for special‑category biometric processing, €200,000 under Article 7 for defective consent mechanisms, and €250,000 under Article 5(1)(e) for storage‑limitation failures. (compliancehub.wiki) The AEPD says the inquiry was opened by its Deputy Directorate for Data Inspection on 12 December 2023 and that the probe ran for roughly two years before the March 2026 resolution, with the authority ordering Yoti to implement corrective measures within six months of the decision becoming final. (compliancehub.wiki) Yoti published a company statement on 10 March 2026 rejecting the AEPD’s findings, confirming it has lodged an appeal to Spain’s High Court and asserting it was not previously notified that it was the subject of an investigation. (yoti.com) The AEPD’s reasoning cites Yoti’s own published revenue of €15,029,907 as of March 2025 and notes that figure was used as a reference point when calibrating proportionate and dissuasive penalties. (ppc.land) The agency’s published summary flags additional operational details: geolocation records retained for five years, video recordings held for 30 days, and fraudulent ID images kept for purposes including software training, all of which factored into the storage‑limitation finding. (stateofsurveillance.org)
