
The Price of a Face
When a public hospital in Madeira introduced facial recognition to monitor staff attendance, it reignited a fundamental question in European data protection law: can biometric processing be justified when simpler alternatives exist? This article examines the legal framework governing biometric attendance systems under the GDPR, Portuguese law, and the EU AI Act, and argues that the principle of necessity (not technological capability) must remain the decisive test.
9 October 2026 · Abreu Advogados · Portugal























































