Reviewed as of 10 October 2026. This guide offers general information and is not legal advice. If you spot an error, write to me.
A camera that tracks movement, a microphone that reacts to voice or a sensor that measures pulse can process personal data even if the work does not keep a recording. Before exhibiting it, you need to know what it captures, what it uses it for, who controls the system and what alternatives are available to anyone who does not want to take part.
When personal data exists
Personal data exists when the information makes it possible to identify a person, directly or indirectly. A recognisable image, a voice that can be linked to someone, a device identifier or a combination of location and time may all qualify.
Processing information in real time and deleting it reduces risk, yet processing continues as long as the information is captured, analysed or transformed.
Los datos verdaderamente anónimos quedan fuera del RGPD. «Anónimo» no significa que el artista no conozca el nombre: exige que la persona no pueda ser identificada razonablemente ni mediante la combinación con otra información disponible.
Biometrics and health
Not all data obtained from the body is automatically a special category. The GDPR defines biometric data by its technical origin and treats as a special category those processed in order to uniquely identify a person. The Spanish Data Protection Agency applies a particularly strict standard to biometric identification and authentication.
A physiological measurement linked to a person may reveal health data. These categories are subject to a general prohibition with specific exceptions. Explicit consent is one of them, but it does not resolve all compliance requirements on its own: there must also be a legal basis under Article 6, the consent must be freely given, and the measure must be necessary and proportionate. In unequal relationships, or if taking part is essential to access the exhibition, it may not be valid.
Do not assume that a signed clause legitimises a biometric installation. Seek a less invasive alternative and specialist advice.
Design the work to capture less
- Capture only what is necessary. If a silhouette suffices, do not record a face.
- Process locally. Avoid sending data to a remote service if the operation can be resolved within the gallery space.
- Do not keep data by default. Set a real time limit and verifiable deletion.
- Separate functions. Do not reuse captures for documentation, promotion or research without a specific basis and separate notification.
- Offer a real alternative. The person must be able to access the space or understand the work without undergoing unnecessary capture.
- Test without an audience. Verify what the system registers and what the providers retain, not merely what the interface claims.
Before opening to the public
Determine in writing:
- what data is captured;
- for what purpose;
- what the legal basis is;
- who acts as the controller: artist, institution or both;
- which providers process data on behalf of the controller;
- where it is stored and from which countries it is accessed;
- how long it is retained;
- how rights may be exercised;
- what security and deletion measures are applied;
- how to act in the event of an incident.
If a provider processes data on behalf of the controller, the corresponding data processing agreement must exist. If the artist and institution jointly determine the purposes and means, joint controllership may exist and they must distribute their obligations transparently.
Inform before capturing
Information must be made available before entering the capture zone. It must indicate, at a minimum, the identity of the controller, the purpose, the legal basis, the recipients, the retention period or criteria, the rights of the data subjects, and where to obtain full information.
A brief notice at the entrance may form part of layered information, but it does not replace the full information. Furthermore, a sign does not validate processing that lacks a legal basis.
Minors
In Spain, a minor may provide consent for the processing of their data from the age of 14, when consent is the basis used and the law does not require other assistance. Below that age, consent must be provided by the person holding parental authority or guardianship.
This does not mean that any processing directed at those over 14 is permissible. For biometrics, health, profiling, or installations in educational settings, additional limits may apply and consent may not be an appropriate basis.
Impact assessment
A data protection impact assessment must be conducted before initiating processing operations that are likely to result in a high risk. The AEPD publishes an indicative list and considers, among other criteria, the innovative use of technology, systematic monitoring, the processing of special categories of data, biometrics, profiling, and data concerning vulnerable individuals to be relevant.
An installation combining several of these elements may require an assessment even if it operates for only a few days. The assessment must be completed before determining that the system is technically closed.
What the AI Act adds
If the system uses AI, check the current consolidated version before opening, as the implementation schedule was modified in 2026.
The prohibition on inferring emotions in workplaces and educational establishments applies with the exceptions provided for medical or security purposes. A work installed in a university is not excluded from the prohibition by being presented as an artistic project.
The regulation also establishes transparency obligations for certain emotion recognition and biometric categorisation systems. In addition to providing information in accordance with the GDPR, the entity deploying the system must verify when the specific obligation becomes applicable and how it must be communicated to the individuals exposed to it.
Do not confuse:
- detecting a presence or movement;
- recognising an identity;
- inferring an emotion;
- classifying a person by biometric traits.
Each function involves distinct data, risks, and rules.
If the work displays or publishes individuals
Projecting an anonymous silhouette is not the same as keeping a recognisable portrait or publishing a recording. In addition to the GDPR, the right to one's own image, the terms of any assignment of rights and the rules on minors may apply. Define separately what the work shows in the room, what it records and what will be published afterwards.