Spanish Data Protection Authority (AEPD) — Mercadona, S.A.

Decided by

Agencia Española de Protección de Datos

Parties

Agencia Española de Protección de Datos v. Mercadona, S.A.

Decision date

July 19, 2021

Remedy

Mercadona paid a fine of €2,520,000 after a voluntary payment discount and was prohibited from processing personal data using facial recognition in its establishments.

Amount

€2,520,000

Appeal

Appeal status not stated

Key holdings

1. The AEPD found that Mercadona's store facial recognition system processed special categories of personal biometric data under European and Spanish data protection law.

   “constituye un tratamiento de datos de categoría especial de los regulados en el art. 9 del RGPD y art 9 de la LOPDGDD.” — HECHOS PROBADOS, PRIMERO

2. The AEPD concluded that Mercadona lacked a lawful basis under Article 6 GDPR and an applicable exception under Article 9 GDPR to process biometric data of store entrants.

   “no consta base legítima conforme señala el art. 6 del RGPD, ni normativa legal que lo permita según dispone el art. 8 de la LOPDGDD.” — HECHOS PROBADOS, TERCERO

3. The AEPD formally terminated the sanctioning proceedings following Mercadona's voluntary payment of the reduced fine of €2,520,000.

   “En fecha 19 de julio de 2021, la parte reclamada ha procedido al pago de la sanción en la cuantía de 2.520.000 € haciendo uso de la reducción prevista” — ANTECEDENTES, SEGUNDO

4. The AEPD ordered a complete ban on personal data processing involving facial recognition across Mercadona's establishments.

   “Prohibir todo el tratamiento de datos personales relativo al reconocimiento facial en sus establecimientos, de acuerdo con el artículo 58.2.f).” — RESUELVE, PRIMERO

In plain English

In July 2020, the Spanish Data Protection Authority (AEPD) initiated an investigation into supermarket chain Mercadona, S.A. after media reports indicated that the company was implementing a facial recognition system across its stores. Mercadona deployed the system in 40 stores starting in July 2020 to detect individuals subject to court-ordered restraining orders protecting Mercadona or its workers. The system scanned faces of everyone entering the stores, converted them into biometric templates within 0.3 seconds, and matched them against a database of convicted individuals. In May 2021, the AEPD initiated formal sanctioning proceedings. The authority found that facial recognition processes special categories of biometric data under Article 9 of the GDPR. The AEPD determined that Mercadona lacked a valid exception under Article 9 to process biometric data of all store visitors and had no legal basis under Article 6 of the GDPR. Furthermore, Mercadona failed to provide adequate information to customers and employees, failed to conduct a proper impact assessment covering all affected groups, and violated data minimization and privacy by design requirements. The AEPD proposed administrative fines for multiple GDPR violations and ordered the suspension of the system. Mercadona voluntarily paid a reduced fine of 2,520,000 euros on July 19, 2021, exercising a 20 percent statutory reduction, which entailed waiving administrative appeals. Consequently, the AEPD formally terminated the proceedings and permanently prohibited Mercadona from processing personal data through facial recognition in its establishments.