fineConcluded€96,000
Spanish Data Protection Authority (AEPD) — SIDECU, S.A. (Supera)
June 26, 2025 · Spain · Sports Centers / Gyms
The AEPD fined SIDECU for implementing a facial recognition system as the sole access method to its sports centers without providing alternatives, failing to conduct a Data Protection Impact Assessment (DPIA) and adequately inform members.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.