Dutch Holiday Parks Ordered to Stop Unlawful Facial Recognition at Pools
The Dutch data protection authority investigated eight holiday parks and found they all illegally used facial recognition to control access to swimming pools and playgrounds, failing to inform guests of alternatives. Seven parks amended their practices after regulatory pressure, while one faced potential fines if non-compliant by December.
What happened
The Dutch Autoriteit Persoonsgegevens (AP) investigated eight holiday parks after receiving approximately ten complaints from concerned citizens in September 2023. All eight parks were found to be in breach of privacy law by using facial recognition to control access to swimming pools and playgrounds instead of wristbands or passes.
The parks did not inform guests that they could access these facilities without undergoing facial recognition scanning. Seven parks have since adjusted their practices under pressure from the AP; one park remains non-compliant and faces potential fines or enforcement orders if it does not improve by December.
Reported impact
AP vice-chair Monique Verdier stated that guests, including children, were surprised to find facial recognition suddenly required where wristbands or passes had previously been used. Guests were presented with a choice: submit biometric data or forgo access to facilities they had paid for.
Index analysis
Under the General Data Protection Regulation (GDPR), facial recognition is generally prohibited except in three specific cases: personal or household use, essential security needs for vital interests like nuclear plant protection, or explicit informed consent. For swimming pool access, only explicit consent is relevant, which requires that individuals be fully informed, free to refuse, and offered alternatives.
Governance controls
The AP found that parks failed to inform guests of alternative access methods, effectively coercing submission of biometric data. Verdier emphasized that once facial scans are made, individuals lose control over the data and risk identification and tracking anywhere in the future.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.