Spanish Data Protection Authority (AEPD) — SIDECU, S.A. (Supera)

Decided by

Agencia Española de Protección de Datos

Parties

Agencia Española de Protección de Datos v. SIDECU, S.A.

Remedy

SIDECU, S.A. was ordered to pay a reduced fine of 96,000 EUR following voluntary payment and acknowledgment of responsibility, implement corrective measures, and suspend all processing of special category biometric personal data for facility access control.

Amount

€96,000

Appeal

No appeal

Key holdings

1. Numerical facial templates generated from raw user images constitute biometric personal data under data protection law.

   “el patrón biométrico o plantilla biométrica es verdaderamente el dato biométrico de carácter personal al que se refiere el artículo 4.14 del RGPD” — page 25, paragraph 3

2. The data protection authority initiated sanctioning proceedings against SIDECU for three administrative infractions relating to biometric data, impact assessments, and transparency.

   “SE ACUERDA: PRIMERO: INICIAR PROCEDIMIENTO SANCIONADOR a SIDECU, S.A., con NIF A15435092, por la presunta comisión de tres infracciones administrativas:” — page 87, section SE ACUERDA

3. Following voluntary payment and acknowledgment of responsibility, the total fine was reduced by forty percent to ninety-six thousand euros.

   “Tras haber procedido SIDECU, S.A. al pronto pago y reconocimiento de responsabilidad, se procede, en virtud del artículo 85 de la LPACAP, a la reducción de un 40% del total” — page 92, section PRIMERO

4. The authority confirmed the provisional measure ordering the suspension of biometric data processing for access control across sports centers.

   “CONFIRMAR, elevándola a definitiva, la medida provisional impuesta a SIDECU, S.A. cuyo cumplimiento deberá acreditarse a partir del día siguiente de la notificación de la presente resolución” — page 92, section CUARTO

In plain English

Several members of sports centers operated by SIDECU, S.A. filed complaints with the Spanish Data Protection Authority after the company implemented a facial recognition system for facility access. The users argued that the system was intrusive and mandatory, replacing previous card or fingerprint access methods without prior notice or consent. SIDECU claimed that the system did not process personal data because raw images were not stored, only encrypted numerical mathematical templates. The Spanish Data Protection Authority investigated and determined that facial recognition templates derived from user faces constitute special category biometric personal data. The authority found that SIDECU processed these biometric templates without a valid legal exception, failed to conduct a prior data protection impact assessment, and failed to properly inform users under transparency requirements. The facial recognition system had been installed across 5 sports centers serving 36.483 users, including 8.978 users at one center where 26 users voiced opposition. The authority initially proposed fines totaling 160.000 euros, comprising 80.000 euros for processing special category data, 50.000 euros for failing to perform an impact assessment, and 30.000 euros for transparency violations. SIDECU acknowledged its responsibility and made a voluntary payment, receiving a 40% total reduction that brought the final fine to 96.000 euros. The authority terminated the proceeding, confirmed the fine, ordered corrective compliance measures within 7 months and 1 month respectively, and ordered the suspension of all biometric data processing for access control across its sports facilities.