LORO PARQUE SA – €250,000 Fine (Spain, 2024)

Three data subjects filed a complaint to the DPA against LORO PARQUE SA (a zoo, the controller) between August and November 2022. The complaints concerned the mandatory biometric identification methods used to access the park. One of the tickets offered allowed data subjects to access the zoo and water park owned by the controller with one ticket. However, data subjects were obliged to use the controller’s fingerprint identification systems to verify that the same person was accessing both parks, regardless of age. This was carried out in addition to the tickets’ QR code scanning procedure. The controller argued that the process was necessary to verify whether the ticket was used by the same person. In addition, the tickets were deactivated once the data subject had accessed both theme parks, limiting the storage period of data subjects’ biometric data. Finally, the controller argued that it did not process personal data, as it did not identify the data subject through the fingerprint data or store the image of the fingerprints. Rather, the system simply read the fingerprint and created a mathematical representation of the fingerprints’ characteristics (also referred to as a “biometric template”). The DPA first noted that while biometric identification methods were not new, the fact that these processes can be automated with a high level of accuracy raises data protection concerns. According to the DPA, processing this data involves a certain risk, as it is data that a data subject cannot change. This poses a risk of loss of identity for the data subject if the data is misused. The DPA then dismissed the controller’s argument that it is not processing personal data through its fingerprint systems. The biometric template falls under the definition of biometric data (Article 4(14) GDPR), as it acts as a unique identifier of the data subject. According to the DPA, it is irrelevant whether the data subject can be identified, or whether the fingerprint can be reconstructed from the template; the system still processes biometric data according to the GDPR. Furthermore, storing this data is necessary to verify whether the same data subject is accessing both theme parks. Finally, the DPA stated that the biometric template is personal data under Article 4(1) GDPR, since the data subject is identifiable using information from the ticket. The DPA found a violation of Article 9 GDPR. Article 9(1) GDPR explicitly prohibits the processing of biometric data for the purpose of uniquely identifying a natural person. The DPA stated that exceptions under Article 9(2) GDPR did not apply. Specifically, the controller could not rely on contract or on consent of the data subjects; the DPA stated that including the processing in the contract does not make the processing necessary for the performance of the contract. In addition, the fact that acquiring the ticket is voluntary did not mean the data subject consented to having their biometric data processed. The controller failed to demonstrate that it had processed the biometric data lawfully, in accordance with the principle of accountability (Article 5(2) GDPR). Finally, the DPA noted that the controller did not carry out a Data Protection Impact Assessment (DPIA) and did not consider the risks involved in processing biometric data. Furthermore, data subjects were not provided information on the use of the system, and did not have the reasonable expectation of their data being processed in that manner. The DPA fined the controller €250,000. The DPA considered it a serious violation, as it involved processing sensitive personal data, including those of minors. In addition, the DPA prohibited the controller from using biometric identification systems to access its theme parks, as it was disproportionate compared to alternative access methods.