Burgos Club de Fútbol, S.A.D. – €120,000 Fine (Spain, 2024)

On 4 November 2022, the Burgos Club de Fútbol, S.A.D. (the controller) implemented a biometric data collection system which required the approximately 700 members of the 'cheering stands' to provide their fingerprints in order to gain entry. The biometric processing was required by an agreement adopted by the State Commission against violence, racism, xenophobia and intolerance in sports (State Commission). The fingerprint system, which was distributed to football clubs by the Spanish Football League (La Liga), collected data subjects’ names, national identification card numbers, system identification numbers, and fingerprint patterns. It replaced the previous entry system, which allowed entry after verifying identification cards. The controller published a communication concerning the system and its basis on the State Commission's agreement on its website on November 4, 2022. The system was first used during a match on 8 December 2022. This was mandatory in order to enter the cheering stands. The system did not set a minimum age, permitting the collection of biometric data from any minors whose parents or guardians consented. On 4 and 7 November 2022, complaints were filed with the Spanish DPA (AEPD) arguing that the biometric control was excessive and failed to adequately inform data subjects as to processing. On 15 February 2023, the controller ceased the mandatory collection of biometric data and instead gave data subjects the option of entering with their ID cards or with fingerprints. On 19 February 2023, the controller notified members of the change in policy and implemented the change at a football game. On the same day, the controller received a copy of [https://www.aepd.es/documento/2022-0098.pdf Dictamen 98/22], initially circulated to La Liga, in which the AEPD declared that the State Commission's biometric processing obligations did not conform with the GDPR. The controller identified itself as the controller for the biometric data at issue. It stated that its purpose for processing was fulfilling the requirements established by the State Commission aiming towards violence prevention, and argued that this system was more efficacious and reliable than the use of ID cards. The controller did not provide its alleged protocol in case of security breaches and expressed that there is no specific measure being applied, but that it instead plans for future measures given that currently no new biometric data is being captured. The AEPD recommended sanction proceedings against the controller, finding likely violations of Article 5(1)(c), 8, 9, 13 and 35 GDPR. The AEPD found a likely violation of Article 35 GDPR. Article 35 GPDR requires that a data protection impact assessment take place prior to the processing of high-risk data, which biometric data is always considered to be pursuant to Article 35(4) GDPR. While the controller provided a data protection impact assessment dated 15 February 2023, the processing was initiated on 4 November 2022. The assessment thus took place months after the processing occurred, indicating that for over 3 months biometric data was being processed in violation of Article 35 GDPR. Second, the AEPD found that the controller lacked a legal basis to process the biometric data as it had not triggered an exception under Article 9(2) GDPR. Prior to 15 February 2023, the controller indicated that the processing was required to fulfill a legal obligation, establishing a legal basis for processing under Articles 6(1)(c), 9(2)(b) and 9(2)(g) GDPR. In light of the AEPD’s [https://www.aepd.es/documento/2022-0098.pdf opinion 98/22], the controller changed its legal basis after 15 February 2023 to consent pursuant to Articles 6(1)(a) and 9(2)(a) GDPR. The controller did not dispute that the processing of data prior to 15 February 2023 lacked a legal basis. Third, the AEPD found that the processing both prior to and after 15 February 2023 violated data minimisation principles. The classification as a special category of data requires special caution in addition to Article 5(1)(c) GDPR's obligations. Pursuant to Article 35(7) GDPR, the AEPD emphasised, the controllers must also analyse the suitability, necessity and proportionality of processing prior to processing special categories of data. When non-biometric options exist which serve the same purpose, it noted, it is not necessary to process special categories of data and doing so violates the GDPR. In this case, processing was neither necessary nor proportional because the security purposes could have been served by the previous ID-review system. The AEPD rejected the controller’s argument that that the biometric data system was more efficacious because it was more reliable, finding the claim unsupported. The AEPD also stated that the State Commission’s order to establish the fingerprinting system imposed an obligation was insufficient to justify a system as suitable, necessary or proportionate. These shortcomings constituted a violation of Article 5(1)(c) GDPR. In addition, the controller was found to be in violation of Article 8 GDPR both prior to and after 15 February 2023 because it permitted minors to use biometric data to enter the cheering stands without establishing a minimum age. Finally, the AEPD held that controller failed to comply with informational obligations under Article 13 GDPR in its processing prior to 15 February 2023. The controller's informational documents stated that it was necessary for data subjects to agree to biometric processing in order to gain entry to the cheering stands. Given that, as discussed previously, there was no legal basis for the processing of the data prior to 15 February 2023, the AEPD found that the inaccurate statement of legal obligation constituted a failure to adequately inform data subjects of the processing of their data and was thus a violation of Article 13 GDPR. Given these violations, the AEPD resolved to initiate sanction proceedings against the controller and recommended a sanction of €200,000. Pursuant to [https://www.boe.es/buscar/act.php?id=BOE-A-2015-10565 Law 39/2015], a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €120,000.