Agencia Espanola de Proteccion de Datos (AEPD) — AENA, S.M.E., S.A.

Decided by

Agencia Española de Protección de Datos

Parties

Agencia Española de Protección de Datos v. AENA, S.M.E., S.A.

Remedy

AENA was fined 10,043,002 EUR and ordered to maintain the temporary suspension of biometric facial recognition systems for airport access control until a compliant data protection impact assessment is completed.

Amount

€10,043,002

Appeal

Appeal status not stated

Key holdings

1. The AEPD determined that AENA failed to properly demonstrate the necessity and proportionality of centralized facial recognition processing.

   “no justifica que el tratamiento cumpliese con los requisitos de necesidad y proporcionalidad del tratamiento.” — page 76, section IV

2. The regulator penalized AENA for breaching Article 35 of the GDPR regarding data protection impact assessments.

   “por una infracción del artículo 35 del RGPD, tipificada en el Artículo 83.4.a) del RGPD, una multa de DIEZ MILLONES CUARENTA Y TRES MIL DOS EUROS” — page 83, RESUELVE PRIMERO

3. The authority confirmed the temporary suspension of facial recognition biometric processing at AENA airports until a valid impact assessment is conducted.

   “CONFIRMAR la suspensión temporal de todo tratamiento de datos biométricos y en especial de los referidos al sistema de identificación por reconocimiento facial para controlar el acceso de los pasajeros” — page 83, RESUELVE SEGUNDO

4. Biometric identification systems carry heightened risks for individuals and demand solid justification over less intrusive alternatives.

   “la identificación tiende a requerir justificaciones mucho más sólidas, siquiera sea porque un número mayor de interesados se ven afectados” — page 76, section IV

In plain English

The Spanish Data Protection Agency investigated AENA, the state-owned airport operator, following a complaint concerning a facial recognition pilot project deployed at Barcelona airport. AENA had implemented biometric facial recognition systems across pilot programs starting in 2019 and expanding to an operational phase across 8 Spanish airports, enrolling 62.054 passengers. The system allowed passengers to voluntarily register their face image to pass through security filters and boarding gates without physically presenting identity cards or boarding passes. Following its investigation, the authority found that AENA violated Article 35 of the General Data Protection Regulation by failing to conduct a complete and valid data protection impact assessment prior to deploying the biometric processing. Specifically, AENA failed to demonstrate that using centralized facial recognition was necessary and proportional compared to less intrusive identity verification methods, such as traditional visual checks or non-contact digital inspection. The authority noted that storing biometric tokens and personal identity data centrally created significant high-level risks for passengers. As a consequence, the regulator imposed a fine of 10.043.002 euros on AENA and confirmed the temporary suspension of all facial recognition processing for passenger access control across AENA-managed airports until a fully compliant impact assessment is completed. This decision underscores that public infrastructure operators cannot introduce high-risk biometric processing solely for operational efficiency or passenger convenience without rigorously demonstrating necessity and implementing robust safeguards.