Everyday technology, invisible sensitive data: the lock and the camera nobody put in the RAT
The fingerprint lock protecting the server room has been installed for three years. The camera system in the main corridor has been there for five. Neither appears in the Activity Treatment Register. Neither has a documented lawfulness basis. Both technologies have been processing personal data under the LOPDP since day one. The problem is not the technology: it's that nobody registered it.
Why the LOPDP applies to technology that doesn't look like a data system
Ecuador's LOPDP defines personal data processing broadly: it includes any operation performed on data of identifiable natural persons, in any type of medium, automated or not. Art. 2 LOPDP does not require the system to be connected to a network, to have a centralized database, or to be part of software labeled as an "information system".
Art. 4 LOPDP defines biometric data as "unique personal data relating to the physical or physiological characteristics, or behaviors of a natural person that allows or confirms the unique identification of that person". Fingerprints, facial recognition and vein geometry are biometric data — all sensitive data. Their processing requires a reinforced lawfulness basis under Art. 26 LOPDP.
What the SPDP expressly prohibits for video surveillance
Resolution SPDP-SPD-2025-0041-R establishes specific prohibitions that admit no exception or alternative lawfulness basis:
- Video monitoring of privacy-sensitive areas: bathrooms, changing rooms, lactation rooms, cafeterias. This prohibition is absolute — no lawfulness basis overrides it.
- Audio recording under legitimate interest: the resolution expressly prohibits audio recording when legitimate interest is the basis, particularly for workplace supervision or performance control.
- Using footage for a purpose other than the declared one: disseminating security footage violates the purpose limitation principle of Art. 10 lit. d) LOPDP.
These are two of the most frequent and easiest-to-correct non-compliances in any organization. They don't require changing the technology: they require documenting it correctly, establishing the lawfulness basis, informing data subjects and defining retention periods. The operational cost is low; the risk of not doing so, high.
Are your cameras and access locks in your RAT? Do they have documented lawfulness bases?
Wiibiq's free DataGuard diagnosis reviews biometric access control and video surveillance systems, verifies whether they are in the RAT with the correct classification, and identifies any areas or practices the SPDP expressly prohibits.
Request free DataGuard diagnosis →