Spain’s long-running experiment with biometric boarding hit a wall on 25 November when the Agencia Española de Protección de Datos (AEPD) announced a €10 million penalty against airport operator Aena and ordered the immediate suspension of its facial-recognition programme at eight major airports, including Madrid-Barajas and Barcelona-El Prat.
According to the AEPD, Aena failed to carry out an adequate Data-Protection Impact Assessment before enrolling almost 40,000 travellers in the voluntary scheme between 2023 and 2024. Investigators said the assessment neither proved that collecting travellers’ biometric templates was strictly necessary nor explored less intrusive alternatives such as digital tokens based on travellers’ own devices. Under the EU’s General Data Protection Regulation, biometric data used for “unique identification” is deemed “high risk,” triggering strict legal tests and mitigation measures.
![Spanish Data Watchdog Slaps €10 Million Fine on Aena, Halts Facial-Recognition Boarding at Eight Airports]()
The ruling lands just as Spain rushes to deploy the EU Entry/Exit System (EES) nationwide before the April 2026 deadline. Industry insiders warn that switching off the facial-recognition gates could lengthen queues during the winter holidays and undo much of the progress airlines such as Iberia, Vueling and Air Europa have made to speed up boarding for frequent flyers.
Aena said it would appeal, insisting that passenger enrolment was voluntary, data were encrypted and no breaches have occurred. The company argues the programme is essential to cope with record traffic—285 million passengers forecast for 2026—and that suspending the technology now puts Spain at a competitive disadvantage against airports in France, the Netherlands and the Gulf that already use biometrics end-to-end.
For employers managing assignee travel and global mobility teams routing talent through Spain, the take-away is clear: build extra dwell time into itineraries this holiday season, inform travellers that biometric lanes may be closed, and watch for a court-ordered stay that could reinstate the system—possibly at short notice.
According to the AEPD, Aena failed to carry out an adequate Data-Protection Impact Assessment before enrolling almost 40,000 travellers in the voluntary scheme between 2023 and 2024. Investigators said the assessment neither proved that collecting travellers’ biometric templates was strictly necessary nor explored less intrusive alternatives such as digital tokens based on travellers’ own devices. Under the EU’s General Data Protection Regulation, biometric data used for “unique identification” is deemed “high risk,” triggering strict legal tests and mitigation measures.
The ruling lands just as Spain rushes to deploy the EU Entry/Exit System (EES) nationwide before the April 2026 deadline. Industry insiders warn that switching off the facial-recognition gates could lengthen queues during the winter holidays and undo much of the progress airlines such as Iberia, Vueling and Air Europa have made to speed up boarding for frequent flyers.
Aena said it would appeal, insisting that passenger enrolment was voluntary, data were encrypted and no breaches have occurred. The company argues the programme is essential to cope with record traffic—285 million passengers forecast for 2026—and that suspending the technology now puts Spain at a competitive disadvantage against airports in France, the Netherlands and the Gulf that already use biometrics end-to-end.
For employers managing assignee travel and global mobility teams routing talent through Spain, the take-away is clear: build extra dwell time into itineraries this holiday season, inform travellers that biometric lanes may be closed, and watch for a court-ordered stay that could reinstate the system—possibly at short notice.
