{"id":5319,"date":"2021-08-04T11:18:33","date_gmt":"2021-08-04T11:18:33","guid":{"rendered":"https:\/\/veridas.com\/analisis-tecnico-y-juridico-de-la-resolucion-de-la-aepd-sobre-mercadona\/"},"modified":"2024-02-12T09:16:33","modified_gmt":"2024-02-12T09:16:33","slug":"technical-and-legal-analysis-of-the-resolution-of-the-aepd-on-mercadona","status":"publish","type":"post","link":"https:\/\/veridas.com\/en\/technical-and-legal-analysis-of-the-resolution-of-the-aepd-on-mercadona\/","title":{"rendered":"Technical and legal analysis of the resolution of the AEPD on Mercadona"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t

Context<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Not all biometric use cases are the same, nor do they have the same legal implications. This article explains the different regulations applicable to biometric identification<\/strong>, aimed at validating one individual among many (1:N), and identity verification, recognizing that someone is who they say they are (1:1). The AEPD authorizes both biometric identification and biometric verification, provided that the measures required by the RGPD are met.<\/strong><\/p>

We also explain that the sanction recently imposed on Mercadona by the AEPD responds to a completely different factual situation than the use cases proposed by Veridas and dasGate, so the legal reasoning of that sanction does not apply to them.<\/p>

We provide information and references to understand the European regulatory framework for the use of biometric technologies and how the use cases proposed by dasGate and Veridas are secure by design and scrupulously comply with all current regulations.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Introduction<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tBiometrics and digital identity verification are tools and technologies at our disposal to exercise our real identity on the Internet and physical spaces. Biometrics is the best tool available to people (the only inherent one) to exercise our real Identity and for Administrations and companies to carry out a secure, private and reliable Digital Transformation.<\/p> \n\nThe use of this type of technology, although recent, is not new, but is already included in authorizations such as the SEPBLAC (Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offenses in Spain), which since 2016 and 2017 contemplates the verification of non-presential identity; or the Ministerial Order ETD\/465\/2021 allowing digital verification of the identity of applicants for qualified electronic certificates; or the Resolution of May 25, 2021, of the Secretary of State for Social Security and Pensions for the completion of procedures through telephone and telematic channels using biometric identity verification systems, among others.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t

The Mercadona case<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Spanish Data Protection Agency (AEPD) has recently issued a sanction to Mercadona for the use of facial identification systems in the open field, without the user\u2019s consent, and we believe it is appropriate to try to clarify concepts and provide our opinion on the different uses and implications of using biometric technology.<\/p>

As has been known, Mercadona installed, in June 2020, as part of a pilot project, a facial recognition identification system in forty of its stores. According to what has been published, Mercadona\u2019s system was a biometric identification system (1:N)<\/strong> since it tried to recognize whether the person identified (1) was one of the persons who had a sentence or a restraining order in force against Mercadona or its workers (N).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Caso\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t
<\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

These people, without their consent<\/strong>, were recognized in a space open to the public<\/strong>, the entrance to the stores of that supermarket chain, remotely and identifying<\/strong> all those who passed through that space and not only those who approached a particular place for pre-established access.<\/p>

In July 2020, two complaints were registered at the AEPD, which, together with the facts and documents to which this organization had access, led to the initiation of an investigation by the AEPD, which has concluded with the resolution published, one year later, with a fine of 2.5 million euros to the supermarket chain.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

The resolution of the AEPD<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In its resolution<\/a>, the AEPD analyzes the allegations presented by Mercadona concerning the legitimacy, the judgment of proportionality (suitability, necessity, and proportionality in the strict sense), the impact assessment, the transparency of the information risks derived from the processing, etc.<\/p>

Firstly, the AEPD indicates that since it is a 1:N identification system, which uses biometric data aimed at univocally identifying a specific person from among several (one-to-many, or 1:N), we are dealing with a particular category of data processing subject to the guarantees outlined in Article 9 of the RGPD.<\/p>

Likewise, the AEPD argues in its resolution that the processing of personal data affected persons with final judgments and restraining orders and any Mercadona employee and customer. By imposing a system of detection of convicted persons, the same recognition method was automatically applied to the rest of the people.<\/p>

In addition, the AEPD considers the facial recognition system used by Mercadona to be a massive and remote facial recognition system (\u00abremote biometric identification\u00bb) as defined in the European Commission\u2019s White Paper on Artificial Intelligence<\/a>. This is so because biometric data qualified as sensitive data are used. It is produced remotely in a space accessible to the general public and is automatic and continuous processing.<\/p>

Based on this, the AEPD carries out an exhaustive study concluding that \u00abthe processing of data based on facial recognition for identification purposes implemented by Mercadona is prohibited by the provisions of Article 9.1, as there is no cause to lift the prohibition among those set out in Article 9.2 of the RGPD\u00bb, and that its use is not proportionate to the purpose pursued.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\"[DEMO<\/a><\/span>