Garante per la protezione dei dati personali — SEA - Milan Linate Airport operator
On 11 September 2025 the Garante adopted an urgent measure (Provvedimento n. 489) imposing a provisional limitation of processing on SEA, the operator of Milan Linate Airport, over its "FaceBoarding" facial-recognition system. It found that biometric templates were held in a central SEA database, unencrypted and without the passenger having exclusive control, and that the processing breached GDPR Articles 5, 6, 13 and 32; it reserved further decisions pending its ongoing investigation.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-18. Every holding carries a short verbatim quote from that text (in IT, the document's language).
- Decided by
- Garante per la protezione dei dati personali
- Parties
- Garante per la protezione dei dati personali v. Società per Azioni Esercizi Aeroportuali S.E.A.
- Decision date
- September 11, 2025
- Remedy
- The Garante ordered an immediate provisional limitation on the processing of passengers' biometric data via the FaceBoarding system at Milan Linate Airport pending the conclusion of the ongoing inquiry.
- Appeal
- Appeal status not stated
Key holdings
SEA centralizes the storage of passenger biometric templates within its own system rather than giving passengers exclusive control over their data.
“il template biometrico resta conservato esclusivamente nel sistema centralizzato della Società” — CONSIDERATO che dalle verifiche in loco è emerso che
SEA provided inaccurate information in its privacy disclosures regarding where passenger biometric models were stored.
“l’informativa rilasciata da Società per Azioni Esercizi Aeroportuali S.E.A. agli interessati contiene indicazioni inesatte” — CONSIDERATO che dalle verifiche in loco è emerso che
SEA failed to implement encryption measures for biometric templates stored in its central database.
“la Società non ha adottato misure di cifratura del template biometrico, all’atto della conservazione di quest’ultimo nei propri sistemi” — CONSIDERATO che dalle verifiche in loco è emerso che
The hybrid FaceBoarding gates captured facial images and generated biometric templates for passengers who had not consented to the processing.
“viene comunque generato un template biometrico dell'interessato, sebbene quest’ultimo non abbia rilasciato il consenso al relativo trattamento” — CONSIDERATO che dalle verifiche in loco è emerso che
In plain English
The Italian Data Protection Authority (Garante per la protezione dei dati personali) issued an urgent order against Società per Azioni Esercizi Aeroportuali S.E.A., the operator of Milan Linate Airport. The investigation focused on the airport's FaceBoarding facial recognition system, which processes passenger biometrics for airport access and boarding. On-site inspections conducted in July 2025 revealed serious violations of the General Data Protection Regulation. The Garante found that passenger biometric templates were stored unencrypted in SEA's central system rather than remaining under the passengers' exclusive control. Additionally, SEA provided inaccurate privacy information by wrongly stating that biometric data was stored only on smartphones. The system retained biometric templates for up to 12 months for long-term participants and generated biometric templates even for non-consenting passengers using hybrid gates. By July 31, 2025, the system had processed data from 24,550 individuals. Due to the high risk and severity of the non-compliance, the authority imposed an immediate provisional limitation on processing passenger biometric data via FaceBoarding. Appeals may be filed within 30 days, or 60 days for entities based abroad.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.