Spain's data regulator fines LaLiga €1m for biometric stadium access
Spain's data protection authority (AEPD) fined LaLiga €1 million for improperly collecting spectators' biometric data at stadium entrances without adequate safeguards under GDPR. The regulator ordered suspension of the facial recognition systems in fan sections until a compliant data impact assessment is completed.
What happened
The AEPD imposed a €1 million fine on LaLiga in March 2025 for improper use of biometric recognition systems in stadium access points. The regulator found that LaLiga violated Article 35 of the GDPR by collecting spectators' facial data without adequate data protection impact assessments or safeguards.
The systems were deployed in fan section (animación) entrances at affiliated LaLiga clubs' stadiums, ostensibly to prevent previously banned violent individuals from entering. The AEPD ordered suspension of biometric data processing in these areas pending completion of a valid data protection impact assessment addressing necessity, suitability, and proportionality.
Reported impact
The practice affected tens of thousands of spectators whose facial data was collected without proper legal justification. The AEPD found that storing and processing immutable biometric data caused erosion of privacy rights that was not proportionate to the security benefit claimed.
Index analysis
The AEPD initially considered a fine of €10 million, which was reduced to €1 million. LaLiga disputed the decision, arguing the regulator relied on faulty premises, including that LaLiga was directly responsible for biometric data processing that it stated clubs managed independently.
Governance controls
The AEPD required LaLiga to instruct affiliated clubs and sports associations to definitively suspend biometric data processing for fan section access until a data protection impact assessment meeting GDPR Article 36 requirements is executed and validated.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.