Aena fined €10 million and facial-recognition boarding halted at Spanish airports

Spain’s data protection authority (AEPD) fined airport operator Aena with a €10 million fine over facial-recognition boarding technology practices at eight major airports. The regulator found that Aena did not carry out a proper data-protection impact assessment before deploying the biometric system, despite processing highly sensitive facial data, a category that triggers strict requirements under EU law. 

Authorities also stated that they were not convinced the highly intrusive technology was necessary or that less intrusive alternatives could not achieve the same goals.

In response, Aena insists that passengers opted in voluntarily, that data were encrypted, and that no breaches have occurred. The company said it plans to appeal this decision.