METRO BILBAO, S.A. – Dismissed (Spain, 2021)

The Spanish DPA (AEPD) launched an investigation on the company that manages the underground service of Bilbao, one of the main Spanish cities. In the context of the covid-19 pandemic, the company was using thermal cameras to verify if the users of the underground had a higher temperature than a threshold (37.3ºC), in order to identify potential infected people. People were randomly picked to pass through the range of the cameras, that would show their temperature. What was shown was only a temperature map; images were not processed in any way, nor there was any kind of facial recognition system. Data were neither registered, stored or processed in any way. The only consequence deriving from the temperature map would be that the employees in charge would carry out a second test, with a clinic thermometer, to verify whether the temperature was above the threshold. Then, if still shown to be above the threshold, they would receive a recommendation on how to act (i.e. not use the metro and contact a doctor). The Spanish DPA, in line with the allegations of the controller, concluded that the GDPR was not applicable to this case, as it did not fall under its material scope. The temperature measurement was done without identification, without recording and without registering data of the persons, as their identification is not required either by official document or verbally. At no time was any personal data stored or recorded, neither image data, nor temperature data, nor name and surname, nor any other data relating to an identified or identifiable natural person. No information was stored, which could imply the impossibility of identifying a person by collecting only indirect identifiers, such as the aforementioned heat map or temperature; and no direct identifiers, such as an image or similar, nor the results of the temperature measurements were stored nor were the results transferred to another kind of non-automated or automated support. At all times, the anonymi