# Aena, S.M.E., S.A.: Non-compliance with general data processing principles

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2025-11-06
- Original: https://www.enforcementtracker.com/ETid-2962
- Canonical: https://overview.legal/posts/49077
- Topics: DPIA, Privacy Impact Assessment, IP Address, Processing Agreement, Controllers, Biometric Data, Processing, Supervisory Authorities, Biometric Data, Data Controller

## Summary

The Spanish DPA has imposed a fine of EUR 10,043,002 on Aena, S.M.E., S.A. The controller conducted a pilot project involving multiple airports, including the use of facial recognition systems. However, the controller failed to carry out a data protection impact assessment prior to doing so.

## Full text

The Spanish DPA has imposed a fine of EUR 10,043,002 on Aena, S.M.E., S.A. The controller conducted a pilot project involving multiple airports, including the use of facial recognition systems. However, the controller failed to carry out a data protection impact assessment prior to doing so.

GDPR Articles: Art. 35 GDPR
Industry: Transportation and Energy

---
Generated by overview.legal · https://overview.legal/posts/49077 · 2026-08-22