All news
Enforcement May 25, 2026 8 min

Spain: AEPD fines Aena EUR 10 million for biometric boarding without adequate DPIA

November 2025 - the Spanish airport operator launched facial recognition at 8 airports without a complete impact assessment. Biometrics is the new enforcement frontier

TL;DR for the DPO

November 2025: Spain's AEPD fines Aena (airport operator) EUR 10,043,002. The facial-recognition boarding system was launched at 8 airports WITHOUT an adequate DPIA. The Authority's conclusion was not that the system was insecure: it was that the preventive impact assessment required by Art. 35 GDPR for high-risk biometric processing was missing. Biometrics is the 2025-2026 enforcement focus.

The facts

Aena, the operator of Spanish airports, deployed a facial-recognition boarding system at eight major airports. The processing involves biometric data, a special category under Art. 9 GDPR, high-risk by definition. The AEPD found Aena had launched the programme without completing an adequate DPIA before activation.

10MEUR
AEPD fine
8
Airports involved

The point: a fine WITHOUT a breach

Aena suffered no data breach. No data was compromised. The fine is for a failure of PREVENTIVE accountability: not having done the adequate DPIA BEFORE activating the processing. Authorities no longer wait for the incident.

Official source:Spanish Compliance Institute

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement
€16,7Mfor telemarketing and contracts activated without consent

Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge

People who had objected kept receiving calls, and some contracts were activated without the person knowing. The Garante fines Wind Tre €16.7 million and restates a principle for every company with an agency network: responsibility is not outsourced along with sales.

Oct 12, 2026New 5 min
Enforcement
€350kto controller and processor over outdated systems

Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract

An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.

Oct 08, 2026New 5 min
Enforcement
€4kfor a camera pointed at a home

Italian DPA fines the municipality of Arvier €4,000: a camera filmed a resident's windows and balconies, and the masking came too late

A small municipality in the Aosta Valley uses cameras for traffic, parking, number plates, the environment and civil protection. A resident finds that one covers her home. The Garante imposes a fine and makes a point that applies to every system: masking private areas is designed before the camera is switched on, not after the complaint.

Oct 08, 2026New 5 min