Aena fined €10 million for facial recognition without impact assessment
Spain's data protection authority fined airport operator Aena €10 million for deploying facial recognition systems at eight airports without conducting a required data protection impact assessment. Aena has announced it will appeal the decision and disputes the proportionality of the penalty.
What happened
The Spanish data protection authority (AEPD) fined Aena €10,043,002 for deploying facial recognition systems at eight airports without conducting a valid data protection impact assessment as required by GDPR Article 35.
The facial recognition systems, which operated at Madrid-Barajas, Barcelona-El Prat, Alicante, Gran Canaria, Tenerife-Norte, Palma de Mallorca, Menorca and Ibiza airports, used one-to-many matching to control passenger access to airport zones.
The AEPD classified the biometric processing as high-risk without justification and ordered the temporary suspension of all biometric data processing until Aena completes a proper impact assessment.
Reported impact
Aena stated that no security breach had occurred and no user data had been leaked or compromised. The company asserted that passenger enrolment in the biometric program was voluntary and based on informed consent, and that biometric data received proper conservation, blocking and deletion treatment under GDPR and Spanish data protection law.
Index analysis
The AEPD determined that Aena had not complied with the mandatory requirement to conduct a Data Protection Impact Assessment before deploying the high-risk biometric system, and that the one-to-many facial matching approach posed greater risks to fundamental rights than less intrusive alternatives.
Aena argued that it had prepared evaluations before launching the biometric boarding programs and that the requirement for an impact assessment was merely procedural. The company also contended that the €10 million penalty was disproportionate and cited Google's €10 million fine in 2022 for data misuse as a comparison.
Governance controls
The AEPD required Aena to suspend all biometric data processing until the operator conducts a data protection impact assessment meeting GDPR standards that examines the necessity, suitability and proportionality of the measure.
Aena announced it would appeal the sanction in court, stating it disagreed with the regulator's conclusions on both substantive and procedural grounds.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.