The Spanish autonomous region of Catalonia's data protection authority, the Autoritat Catalana de Proteccio de Dades, released guidance on the use of biometric data, including iris scans in exchange for cryptocurrency. The DPA stated informed consent must be given before biometric data is collected to ensure citizens are "aware of the value of personal data and the risks associated with sharing and transferring it without control."