Spain's data protection authority, the Agencia Española de Protección de Datos, published guidance on the use of biometric data for work and personal purposes, noting employers must follow the EU General Data Protection Regulation regardless of employee consent. The AEPD said consent is not a legal basis due to an "imbalance between the person who is subjected to the treatment and the person who is carrying it out."