Spain's AEPD fines Mercadona €2,520,000 over its store-entrance facial-recognition system

Verification status: PENDING — checker-graduated at confidence 1.000; awaiting the owner’s human sign-off. Not verified (green is human-only).

The problem

Mercadona, S.A. (NIF A46103834) deployed a facial-recognition system at the entrances of its supermarkets. The AEPD resolution records that from 1 July 2020 (“desde el 1 de julio de 2020”) the system read the biometric features of everyone walking in and, matching them “con base en algoritmos,” checked them against a database of people carrying criminal convictions or restraining orders arising from store incidents (source). Because the system scanned every entrant, it captured the biometric data of ordinary customers — including children — and of Mercadona’s own employees, with no valid legal basis under Article 9 of the GDPR (source).

What was built

An algorithmic facial-recognition (biometric) system. The primary resolution describes the matching on “características biométricas de ambos y, posteriormente, con base en algoritmos” (source); the independent press describes “a facial recognition system in 48 of its shops” (source). The store count is shown, not merged: the AEPD resolution states the system ran in “al menos cuarenta” (at least forty) stores, while the independent newsrooms report 48 (source)(source). Mercadona switched the system off on 6 May 2021 under a precautionary measure, “apagando los sistemas implantados de reconocimiento facial” (source).

The outcome

In procedimiento sancionador PS/00120/2021 — a “RESOLUCIÓN DE TERMINACIÓN DEL PROCEDIMIENTO POR PAGO” voluntario — the AEPD found seven GDPR infringements (arts. 6 and 9, 5.1.c, 12 and 13, 25.1, and 35) and proposed fines totalling €3,150,000; on Mercadona’s voluntary payment the total was reduced 20%, so “la sanción quedaría establecida en 2.520.000 €” — “(dos millones quinientos veinte mil euros)” (source). The resolution also ordered the authority to “Prohibir todo el tratamiento de datos personales relativo al reconocimiento” facial in Mercadona’s establishments (source). Two independent newsrooms carry the headline figure firsthand: the AEPD “imposed a €2,520,000 fine on Spanish supermarket chain Mercadona, S.A. for unlawful use of a facial recognition system” (source), and the AEPD “issued a €2,520,000 fine to Mercadona, S.A.” (source).

The €3,150,000 pre-reduction figure is not printed as a single literal in the resolution: it is the sum of the per-article fines set out in the RESUELVE section (arts. 6+9 €2,000,000 + art. 5.1.c €500,000 + arts. 12,13 €100,000 + art. 25.1 €500,000 + art. 35 €50,000 = €3,150,000), and €2,520,000 = 0.8 × €3,150,000 (source).

Weakest load-bearing source: the “48 stores” count and the “children and employees” scope come from Tier-2 press (Hunton; Legit.eu), not from the primary resolution, which says only “al menos cuarenta” and does not itemise who was captured in those exact words. The two counts are shown side by side rather than reconciled. Every monetary figure and the prohibition, by contrast, are quoted verbatim from the Tier-1 AEPD resolution.

How this was verified

Method: regulator-origin adjudication. The primary is the official AEPD resolution PS/00120/2021, saved to sources/aepd-ps-00120-2021-resolution.pdf (SHA1 3c42d2380fb076aa3548a59420a839e295a4b1e0, 113 pages), with every monetary and disposition quote confirmed verbatim against the extracted text. The two independent newsrooms (Hunton, Legit.eu / Data Privacy Manager) were re-fetched and carry the €2,520,000 figure and the facial-recognition characterisation firsthand; neither relays the other, and the AEPD resolution is the origin and is never counted as corroboration. Verified 2026-08-17. Open pre-green items: (a) a Wayback byte-tie of the AEPD PDF once archive.org returns (it was globally down, 502/503, at verification time); (b) human confirmation on the AEPD record that the voluntary-payment disposition is firme (art. 85 LPACAP implies waiver of appeal). Green is never set from the war-room.

Note: this is the €2,520,000 facial-recognition sanction (PS/00120/2021). It is distinct from the separate €170,000 Mercadona access-rights fine the Audiencia Nacional reduced on 2024-10-29 — a different procedure.

Related case files

• Spain’s AEPD fines Yoti €950,000 over facial-age-estimation biometric AI — the same regulator, the same Article 9 biometric question, one procedure later.
• Spain’s AEPD orders Worldcoin to halt biometric iris scanning — the AEPD’s precautionary-halt power against biometric processing, applied to iris rather than face.
• The ICO orders Serco Leisure to stop unlawful facial-recognition and fingerprint attendance monitoring — a neighbouring regulator reaching the same conclusion on facial recognition without a valid legal basis.

Sources

1. Agencia Española de Protección de Datos (AEPD) · Resolución de terminación del procedimiento por pago voluntario, PS/00120/2021 · July 2021 · https://www.aepd.es/documento/ps-00120-2021.pdf — Tier 1 (primary regulator resolution; saved to sources/, SHA1 3c42d2380fb076aa3548a59420a839e295a4b1e0).
2. Hunton Andrews Kurth (Privacy & Information Security Law Blog) · Spanish DPA Fines Supermarket Chain €2,520,000 for Unlawful Use of Facial Recognition System · 30 July 2021 · https://www.hunton.com/privacy-and-information-security-law/spanish-dpa-fines-supermarket-chain-2520000-eur-for-unlawful-use-of-facial-recognition-system — Tier 2 (independent reputable secondary).
3. Legit.eu / Data Privacy Manager · €2.5 Million GDPR Fine to Spanish Supermarket Chain Mercadona · August 2021 · https://legit.eu/resources/blog/e25-million-gdpr-fine-to-spanish-supermarket-chain-mercadona/ — Tier 2 (independent secondary).
4. PONT Data&Privacy (privacy-web.nl) · Spaanse toezichthouder legt supermarkt Mercadona boete van €2,5 miljoen op · 10 August 2021 · https://privacy-web.nl/en/nieuws/spaanse-toezichthouder-legt-supermarkt-mercadona-boete-van-25-miljoen-euro-op-voor-onrechtmatig-gebruik-van-gezichtsherkenning/ — Tier 2 (independent secondary; Dutch-language).