SpainRetail and e-commerce2021Mercadona
Facial recognition pilot in supermarkets
Spanish regulator fined Mercadona EUR 2.5 million over a facial recognition pilot in 48 supermarkets, and the chain paid to close the procedure
Problem
Mercadona wanted to keep out people with restraining orders against staff or customers. It tested a camera system in some of its stores to spot them at the door.
Approach
The pilot ran for several months in 48 of the chain's 1,640 stores. A first technical filter flagged a match, a person checked it visually, and police were warned if it held up. Mercadona said faces of other people were deleted in 0.3 seconds and that it held more than 37 final court rulings authorising the use. Spain's data protection agency (AEPD) ruled that the system scanned every customer, including children, and staff, and that it met neither the necessity nor the data-minimisation tests under the GDPR. Mercadona paid the fine and closed the procedure.
Results
Takeaway
A security tool that scans every shopper counted as mass biometric processing in the regulator's view, whatever the narrow target. Court authorisations the company held did not change that outcome.
Categories
- Size
- Large enterprise
- Industry
- Retail and e-commerce
- Business function
- Production and quality
- Innovation type
- Process innovation
- AI technology
- Computer vision
- Adoption
- Vendor solution
- Goal
- Quality and risk
- Evidence
- Regulator, audit or court
Sources
Source summaries
Europa Press reported that Mercadona paid the 2.5 million euro penalty proposed by the data protection agency and ended the procedure. The pilot covered 48 of 1,640 stores. It also gives the company's account: a technical filter, a visual check, police alerts, deletion of other faces in 0.3 seconds and more than 37 court rulings in its favour.
Privacy-web reported the AEPD decision. The agency found that the biometric processing reached every customer entering the stores, including children, and employees. It held that no GDPR Article 9 exception applied, that necessity, proportionality and data minimisation were breached, and that the impact assessment ignored risks to staff.
Full details are in the original sources.
