Spain’s airport operator Aena says it will take Spain’s Data Protection Agency (AEPD) to court after the regulator levied a €10,043,002 penalty for allegedly deploying facial-recognition boarding gates without a compliant Data-Protection Impact Assessment (DPIA). The fine, published on 18 January 2026, also orders Aena to suspend biometric processing until gaps are addressed.
Aena insists that passengers’ facial templates are encrypted, stored on-device and erased after boarding, arguing that its DPIA followed EU guidelines. It claims the AEPD focused on formalistic shortcomings rather than any concrete privacy breach—no data leak has been reported since trials began in 2023 at Madrid-Barajas, Barcelona-El Prat, Palma de Mallorca and Menorca.
![Aena to Appeal €10 Million Data-Protection Fine Over Airport Biometric Boarding]()
The legal tussle has immediate operational implications. Barajas currently uses facial recognition for 32 daily Iberia and Air Europa departures; those e-gates will revert to manual document checks, potentially adding five to seven minutes per passenger during the morning rush. Airlines are warning premium-cabin customers to arrive earlier, while ground-handling contractors scramble to redeploy staff.
From a mobility-policy standpoint, the case underscores the compliance minefield around biometric solutions that many companies hope will streamline post-EES passenger flows. Travel managers should track the appeal, review suppliers’ DPIAs and ensure traveller consent forms meet GDPR standards. Privacy-law experts say the verdict—if upheld—could set a precedent across Europe, forcing other airport operators to pause or re-audit similar projects.
Aena has 30 days to lodge its appeal at Spain’s Audiencia Nacional. Observers expect a protracted legal fight that could extend into 2027, overlapping with the full ETIAS roll-out.
Aena insists that passengers’ facial templates are encrypted, stored on-device and erased after boarding, arguing that its DPIA followed EU guidelines. It claims the AEPD focused on formalistic shortcomings rather than any concrete privacy breach—no data leak has been reported since trials began in 2023 at Madrid-Barajas, Barcelona-El Prat, Palma de Mallorca and Menorca.
The legal tussle has immediate operational implications. Barajas currently uses facial recognition for 32 daily Iberia and Air Europa departures; those e-gates will revert to manual document checks, potentially adding five to seven minutes per passenger during the morning rush. Airlines are warning premium-cabin customers to arrive earlier, while ground-handling contractors scramble to redeploy staff.
From a mobility-policy standpoint, the case underscores the compliance minefield around biometric solutions that many companies hope will streamline post-EES passenger flows. Travel managers should track the appeal, review suppliers’ DPIAs and ensure traveller consent forms meet GDPR standards. Privacy-law experts say the verdict—if upheld—could set a precedent across Europe, forcing other airport operators to pause or re-audit similar projects.
Aena has 30 days to lodge its appeal at Spain’s Audiencia Nacional. Observers expect a protracted legal fight that could extend into 2027, overlapping with the full ETIAS roll-out.
Source: Spain in English
