fineConcluded€2,520,000
Spanish Data Protection Authority (AEPD) — Mercadona, S.A.
July 27, 2021 · Spain · Retail (Supermarket)
The AEPD fined Mercadona for the unlawful use of a facial recognition system in its supermarkets to detect individuals with criminal convictions or restraining orders, processing biometric data of customers and employees without a valid legal basis.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.