Spanish Football Club Fined €200,000 Over Stadium Facial Recognition System

Spanish football club Osasuna has received a €200,000 fine from the Spanish Data Protection Agency (AEPD) for its facial recognition system at El Sadar stadium, which was implemented in 2022 as the first such system in Spanish football. The penalty marks another significant regulatory action against biometric systems in European sports venues, following increased scrutiny of such technologies under GDPR guidelines.

The technology, developed by Veridas, a joint venture between BBVA and das-Nano, was used by approximately 2,000 season ticket holders – representing about 25 percent of the club’s pass holders – during the 2023/24 season. The system was suspended last summer for reconfiguration and to ensure compliance with updated data protection standards.

Following an investigation, the AEPD issued three directives in December: a monetary penalty, a prohibition on the system’s continued use, and an order to delete all collected data. Osasuna has announced its intention to appeal the decision to the National High Court.

In a statement, Osasuna expressed disagreement with the AEPD’s decision, stating that the agency is “using arguments relating to older software, while the current one, designed by local company Veridas, is internationally recognized and fully safe.” Veridas has successfully deployed similar systems internationally, including a recent implementation at Argentina’s River Plate stadium.

A similar case involved Burgos CF, which received a €200,000 fine in April 2024 for implementing a fingerprint-based system. Burgos CF’s fine was subsequently reduced to €120,000 after acknowledging responsibility. These cases reflect a broader trend of increased regulatory oversight of biometric systems in sports venues across Europe, with several countries implementing or considering similar technologies.

The National Cryptologic Center has issued a report supporting the implementation of such systems, indicating they pose low or nonexistent risk to fundamental human rights. That assessment contrasts with the AEPD’s stricter interpretation of GDPR requirements for biometric data processing in public spaces.

Sources: StadiumDB

–

January 27, 2025 – by Ali Nassar-Smith