Spain’s data protection watchdog has slapped the nation’s airport operator, Aena, with a €10 million fine and ordered it to shut down biometric boarding gates across the country after finding that the company did not complete a data protection impact assessment before installing the gates.
Aena started a pilot program to look at the feasibility of using biometric gates in 2022 and quickly expanded the initiative to eight major airports across Spain, including Madrid Barajas and Barcelona El Prat Airport.
Within months of starting the pilot project, however, some travelers started to express concerns to the Spanish data protection regulator, AEPD, and an investigation into Aena’s use of passenger biometrics was quickly opened.
On Wednesday, the AEPD finally published a lengthy report detailing the findings of its investigation. The report did not make for welcome reading by Aena.
The AEPD handed down a €10 million fine on Aena for breaching Article 35 of Europe’s General Data Protection Regulation (GDPR), which requires organizations to conduct a data protection impact assessment when processing data via new ‘high risk’ technologies.
Aena slammed the decision, saying it “respectfully disagrees” with the sanction and insists that it completed an impact assessment before deploying the biometric boarding gates.
In fact, Aena claims that the biometric boarding systems were only open to passengers who had voluntarily opted into the pilot and had chosen to register their details after providing their informed consent.
Aena intends to appeal the sanction, but, for the time being at least, will keep all biometric projects at Spanish airports suspended. The airport operator said it would be working to resume biometric boarding as “soon as possible,” but could not provide an estimate of when this might be.
The aviation industry and many governments have embraced biometric technologies for their ability to speed up airport processes that human employees are prone to making mistakes with.
Take the boarding gate, for example. Passengers just have to look at a camera, and within milliseconds, the system can cross-match the biometrics of the passenger against their passport or ID card and the passenger manifest. The gate then opens with no further input from the passenger or airline staff.
In contrast, the traditional method requires a human employee to look at the passenger’s passport and assess whether the person standing in front of them as the photo in the passport, then cross-reference the name in the passport against the name on the boarding pass.
It’s not only a slow and resource-intensive process, but it’s also liable to mistakes.
While some countries remain sceptical about the use of biometrics and the impact on data privacy, other governments are embracing the technology and going full throttle to deploy it as widely as possible.
In Dubai, more than 200 biometric cameras have already been installed across DXB airport – not only at the boarding gate but at check-in, immigration, and even to access premium lounges.
And while data protection regulations are slightly different in Dubai than in Europe, passengers must still voluntarily give their consent and sign up to use biometric services.
Even American travelers, who have traditionally been wary of biometric technologies, are quickly warming up to the convenience it provides.
Nearly 80% of American air travelers now support the use of biometrics at TSA security checkpoints, with nine in 10 saying they would support biometrics if it reduced the amount of time it took to get through the checkpoint.
Biometrics used in the UK. My US passport is accepted and gate opens.