Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), has fined airport operator Aena just over €10 million for deploying facial recognition systems at eight airports without carrying out a valid data protection impact assessment (DPIA). The decision, dated November 6 and reported this week, finds that Aena’s biometric boarding programme amounted to "high-risk" processing and that the company failed to demonstrate the necessity, proportionality and safeguards required under Article 35 of the GDPR.
According to Spanish and international press reports, the systems were used to control access to certain zones and to support biometric boarding at major hubs including Madrid-Barajas and Barcelona-El Prat, as well as several other tourist-heavy airports. The AEPD has ordered the temporary suspension of all biometric data processing linked to these systems, including facial recognition used for passenger identification, until an adequate DPIA is completed and any non-compliant processing is brought into line with EU data protection rules.
Aena has said it will appeal the fine, arguing that passengers who enrolled in the programme did so voluntarily and with informed consent, and that no data breaches or security incidents have occurred. The company maintains that the biometric boarding trials were intended to improve passenger experience and reduce congestion at boarding gates.
However, the AEPD’s decision focuses less on consent and more on structural compliance failures, including the choice of a one-to-many (1:N) facial recognition architecture and the lack of an adequate impact assessment before deployment. For airlines, airport operators and biometric vendors operating in the EU, the case is a clear warning that biometric pilots and "innovation" projects are subject to the same GDPR requirements as full-scale rollouts.
The case follows Italy’s suspension of facial recognition boarding at Milan’s Linate Airport earlier this year, also citing GDPR violations, and underscores growing regulatory scrutiny of airport biometric systems across Europe. Robust DPIAs, clear legal bases and careful evaluation of system design choices, particularly one-to-many facial recognition, will be essential to withstand regulatory scrutiny.
Sources: El País, EFE, La Sexta, Majorca Daily Bulletin, VisaHQ
—
By the ID Tech Editorial Team
