News

⚽ Context:

• 📅 April 2022:
  Club Atlético Osasuna introduced a biometric facial recognition system for stadium access to make the process more fast and secure.

💡 The Solution Implemented:

Veridas developed an innovative platform offering:

• ✅ Simplified and fast access through facial recognition.
• ✅ No need for physical passes or mobile phones to enter.
• ✅ Quick registration process:
• Scan the QR code from the membership pass.
• Scan the ID card.
• Take a selfie.
• 🚪 Instant access: Once registered, members can enter the stadium by simply showing their face, with recognition taking only milliseconds.

Advertised Benefits:

• 🕒 Access experience 5x faster (40 people per minute).
• 🔒 Fraud and ticket forgery prevention, as access is tied to individual identity.
• 📱 Fully compatible with transferring memberships.

⚖️ Violations Identified by the AEPD:

1️⃣ Proportionality and Necessity (Article 5 of the GDPR):

• The use of biometric data was deemed excessive and unnecessary.
• 🚪 Alternatives such as access cards, badges, or QR codes were sufficient to manage access.

2️⃣ Insufficient Legal Basis (Articles 6 and 9 of the GDPR):

• 📜 Consent alone was not sufficient to justify the processing of sensitive biometric data.

3️⃣ Lack of Information (Articles 13 and 14 of the GDPR):

• ❌ Subscribers were not provided with clear and detailed information on the use of their biometric data.

💸 Sanctions:

• 🗓️ May 2023:
• Fine: €200,000.
• 🛑 Suspension of the facial recognition system.
• 🌐 Public sanction.

🔑 Key Points:

• Proportionality and Alternatives:
  The use of facial recognition must be strictly necessary for a legitimate and legal purpose. The AEPD recommended less intrusive solutions, such as cards or QR codes, which comply with the principles of proportionality and data minimization.