Enforcement · Spanish Data Protection Authority (aepd) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Aena, S.M.E., S.A.: Non-compliance with general data processing principles
The Spanish DPA has imposed a fine of EUR 10,043,002 on Aena, S.M.E., S.A.
Full text
The Spanish DPA has imposed a fine of EUR 10,043,002 on Aena, S.M.E., S.A. The controller conducted a pilot project involving multiple airports, including the use of facial recognition systems. However, the controller failed to carry out a data protection impact assessment prior to doing so.
Industry: Transportation and Energy
How it connects
References
Related across sources
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines Jul 7, 2021 Controllers Processors IP Address
Guidelines 05/2022 use of facial recognition technology in the area of law enforcement Guidelines May 17, 2023 Biometric Data Supervision Identification
Guidelines 3/2019 processing of personal data through video devices Guidelines Jan 30, 2020 Personal Data Processing Material scope (GDPR)
Opinion 6/2019 draft list of the competent supervisory authority of Spain regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary m eeting, 12 - 13 March 2019 - Item 2.3.1 Opinion 6 /201 9 on the draft list of the competent supervisory authority of Spain regarding the processing… Opinion Mar 12, 2019 DPIA Supervision Supervisory Authorities
Opinion 01/2019 draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary Meeting, 22 - 23 January 2019 Opinion 01 /201 9 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the… Opinion Jan 23, 2019 DPIA Supervision Supervisory Authorities
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design