# Spain's AEPD fines Mercadona €2,520,000 over its store-entrance facial-recognition system

> In procedimiento sancionador PS/00120/2021, terminated by voluntary payment, Spain's data-protection authority fined the grocery chain Mercadona €2,520,000 for its unlawful algorithmic facial-recognition system and prohibited all such processing.

- Verification status: pending
- Case type: deployment
- Provider: Agencia Española de Protección de Datos (AEPD)
- Client: Mercadona, S.A., Grocery retail / facial-recognition biometric AI (named)
- Sector: retail / ES / ops
- Canonical URL: https://theinternetninja.com/stories/spain-aepd-fines-mercadona-2520000-facial-recognition-biometric-ai-gdpr-sanction-2021/
- Source: The Internet Ninja (theinternetninja.com), independent verified-proof platform

## Outcomes

| Metric | Before | After |
| --- | --- | --- |
| €2,520,000 total AEPD fine (20% voluntary-payment reduction of the €3,150,000 originally proposed across seven GDPR infringements) |  |  |
| All facial-recognition data processing in Mercadona's establishments prohibited |  |  |
| System ran from 1 July 2020 in at least forty stores; switched off 6 May 2021 under the AEPD's precautionary measure |  |  |

## Verification method

Regulator-origin: AEPD resolution PS/00120/2021 (primary, saved to sources/, SHA1 3c42d238…) corroborated by two independent newsrooms (Hunton privacy blog; Data Privacy Manager/Legit.eu; PONT Data&Privacy). Figures quoted verbatim from the resolution.

## Full case file

**Verification status: PENDING — checker-graduated at confidence 1.000; awaiting the owner's human sign-off. Not `verified` (green is human-only).**

## The problem
Mercadona, S.A. (NIF A46103834) deployed a facial-recognition system at the
entrances of its supermarkets. The AEPD resolution records that from **1 July 2020**
("desde el 1 de julio de 2020") the system read the biometric features of everyone
walking in and, matching them "con base en algoritmos," checked them against a
database of people carrying criminal convictions or restraining orders arising from
store incidents ([source](https://www.aepd.es/documento/ps-00120-2021.pdf)). Because the
system scanned *every* entrant, it captured the biometric data of ordinary customers —
including children — and of Mercadona's own employees, with no valid legal basis under
Article 9 of the GDPR ([source](https://www.hunton.com/privacy-and-information-security-law/spanish-dpa-fines-supermarket-chain-2520000-eur-for-unlawful-use-of-facial-recognition-system)).

## What was built
An algorithmic facial-recognition (biometric) system. The primary resolution describes
the matching on "características biométricas de ambos y, posteriormente, con base en
algoritmos" ([source](https://www.aepd.es/documento/ps-00120-2021.pdf)); the independent
press describes "a facial recognition system in 48 of its shops"
([source](https://www.hunton.com/privacy-and-information-security-law/spanish-dpa-fines-supermarket-chain-2520000-eur-for-unlawful-use-of-facial-recognition-system)).
The store count is shown, not merged: the AEPD resolution states the system ran in "al
menos cuarenta" (at least forty) stores, while the independent newsrooms report 48
([source](https://www.aepd.es/documento/ps-00120-2021.pdf))([source](https://legit.eu/resources/blog/e25-million-gdpr-fine-to-spanish-supermarket-chain-mercadona/)).
Mercadona switched the system off on **6 May 2021** under a precautionary measure,
"apagando los sistemas implantados de reconocimiento facial"
([source](https://www.aepd.es/documento/ps-00120-2021.pdf)).

## The outcome
In **procedimiento sancionador PS/00120/2021** — a *"RESOLUCIÓN DE TERMINACIÓN DEL
PROCEDIMIENTO POR PAGO"* voluntario — the AEPD found seven GDPR infringements
(arts. 6 and 9, 5.1.c, 12 and 13, 25.1, and 35) and proposed fines totalling
€3,150,000; on Mercadona's voluntary payment the total was reduced 20%, so "la sanción
quedaría establecida en 2.520.000 €" — "(dos millones quinientos veinte mil euros)"
([source](https://www.aepd.es/documento/ps-00120-2021.pdf)). The resolution also ordered the
authority to "Prohibir todo el tratamiento de datos personales relativo al
reconocimiento" facial in Mercadona's establishments
([source](https://www.aepd.es/documento/ps-00120-2021.pdf)). Two independent newsrooms carry
the headline figure firsthand: the AEPD "imposed a €2,520,000 fine on Spanish
supermarket chain Mercadona, S.A. for unlawful use of a facial recognition system"
([source](https://www.hunton.com/privacy-and-information-security-law/spanish-dpa-fines-supermarket-chain-2520000-eur-for-unlawful-use-of-facial-recognition-system)),
and the AEPD "issued a €2,520,000 fine to Mercadona, S.A."
([source](https://legit.eu/resources/blog/e25-million-gdpr-fine-to-spanish-supermarket-chain-mercadona/)).

The €3,150,000 pre-reduction figure is not printed as a single literal in the
resolution: it is the sum of the per-article fines set out in the RESUELVE section
(arts. 6+9 €2,000,000 + art. 5.1.c €500,000 + arts. 12,13 €100,000 + art. 25.1
€500,000 + art. 35 €50,000 = €3,150,000), and €2,520,000 = 0.8 × €3,150,000
([source](https://www.aepd.es/documento/ps-00120-2021.pdf)).

**Weakest load-bearing source:** the "48 stores" count and the "children and employees"
scope come from Tier-2 press (Hunton; Legit.eu), not from the primary resolution, which
says only "al menos cuarenta" and does not itemise who was captured in those exact
words. The two counts are shown side by side rather than reconciled. Every monetary
figure and the prohibition, by contrast, are quoted verbatim from the Tier-1 AEPD
resolution.

## How this was verified
Method: regulator-origin adjudication. The primary is the official AEPD resolution
PS/00120/2021, saved to `sources/aepd-ps-00120-2021-resolution.pdf` (SHA1
`3c42d2380fb076aa3548a59420a839e295a4b1e0`, 113 pages), with every monetary and
disposition quote confirmed verbatim against the extracted text. The two independent
newsrooms (Hunton, Legit.eu / Data Privacy Manager) were re-fetched and carry the
€2,520,000 figure and the facial-recognition characterisation firsthand; neither relays
the other, and the AEPD resolution is the origin and is never counted as corroboration.
Verified 2026-08-17. Open pre-green items: (a) a Wayback byte-tie of the AEPD PDF once
archive.org returns (it was globally down, 502/503, at verification time); (b) human
confirmation on the AEPD record that the voluntary-payment disposition is firme (art. 85
LPACAP implies waiver of appeal). Green is never set from the war-room.

> **Note:** this is the €2,520,000 facial-recognition sanction (PS/00120/2021). It is
> distinct from the separate €170,000 Mercadona access-rights fine the Audiencia
> Nacional reduced on 2024-10-29 — a different procedure.

## Related case files
- [Spain's AEPD fines Yoti €950,000 over facial-age-estimation biometric AI](/stories/spain-aepd-fines-yoti-950000-facial-age-estimation-biometric-ai-gdpr-sanction-2026/) — the same regulator, the same Article 9 biometric question, one procedure later.
- [Spain's AEPD orders Worldcoin to halt biometric iris scanning](/stories/spain-aepd-orders-worldcoin-tools-for-humanity-to-halt-biometric-iris-scanning-a/) — the AEPD's precautionary-halt power against biometric processing, applied to iris rather than face.
- [The ICO orders Serco Leisure to stop unlawful facial-recognition and fingerprint attendance monitoring](/stories/ico-orders-serco-leisure-to-halt-unlawful-facial-recognition-and-fingerprint-att/) — a neighbouring regulator reaching the same conclusion on facial recognition without a valid legal basis.

## Sources
1. **Agencia Española de Protección de Datos (AEPD)** · *Resolución de terminación del procedimiento por pago voluntario, PS/00120/2021* · July 2021 · https://www.aepd.es/documento/ps-00120-2021.pdf — **Tier 1** (primary regulator resolution; saved to `sources/`, SHA1 `3c42d2380fb076aa3548a59420a839e295a4b1e0`).
2. **Hunton Andrews Kurth (Privacy & Information Security Law Blog)** · *Spanish DPA Fines Supermarket Chain €2,520,000 for Unlawful Use of Facial Recognition System* · 30 July 2021 · https://www.hunton.com/privacy-and-information-security-law/spanish-dpa-fines-supermarket-chain-2520000-eur-for-unlawful-use-of-facial-recognition-system — **Tier 2** (independent reputable secondary).
3. **Legit.eu / Data Privacy Manager** · *€2.5 Million GDPR Fine to Spanish Supermarket Chain Mercadona* · August 2021 · https://legit.eu/resources/blog/e25-million-gdpr-fine-to-spanish-supermarket-chain-mercadona/ — **Tier 2** (independent secondary).
4. **PONT Data&Privacy (privacy-web.nl)** · *Spaanse toezichthouder legt supermarkt Mercadona boete van €2,5 miljoen op* · 10 August 2021 · https://privacy-web.nl/en/nieuws/spaanse-toezichthouder-legt-supermarkt-mercadona-boete-van-25-miljoen-euro-op-voor-onrechtmatig-gebruik-van-gezichtsherkenning/ — **Tier 2** (independent secondary; Dutch-language).