Aena, S.M.E., S.A. – €10,043,002 Fine (Spain, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Aena, S.M.E., S.A. was fined over 10 million euros for not assessing the risks of using facial recognition technology at airports. This matters because it shows that companies must evaluate privacy risks before implementing new technologies.
What happened
Aena conducted a pilot project using facial recognition systems without performing a required data protection impact assessment.
Who was affected
Passengers and visitors at the airports involved in Aena's pilot project were affected.
What the authority found
The Spanish data protection authority found that Aena failed to carry out a necessary risk assessment, violating GDPR requirements.
Why this matters
This case highlights the importance of conducting risk assessments for new technologies. Companies should ensure they understand privacy implications before launching projects.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The Spanish DPA has imposed a fine of EUR 10,043,002 on Aena, S.M.E., S.A. The controller conducted a pilot project involving multiple airports, including the use of facial recognition systems. However, the controller failed to carry out a data protection impact assessment prior to doing so.
Related Enforcement Actions (0)
No other enforcement actions found for Aena, S.M.E., S.A. in ES
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
6 November 2025
Authority
Agencia Española de Protección de Datos
Fine Amount
€10,043,002
Enforcement Tracker ID
ETid-2962
About this data
Cite as: Cookie Fines. Aena, S.M.E., S.A. - Spain (2025). Retrieved from cookiefines.eu
Last updated: