Supermarket chain faces GDPR probe over facial recognition system

Spanish data regulator launches inquiry just four days after AI system's rollout

Spanish supermarket chain Mercadona is under investigation by the country’s data protection regulator over the use of a new facial recognition system in 40 of its stores.

The company introduced the AI-powered facial recognition system on 2 July in the cities of Zaragoza and Mallorca, as well as its home city of Valencia.

As reported by The Local es, the “early detection system”, as the company is calling it, is intended to detect people who have restraining orders issued against them preventing them from entering Mercadona shops or contacting members of staff, or who have been convicted of offences such as shoplifting.

When it rolled out the system, the company explained that no information on other customers will be stored and that footage is deleted after 0.3 seconds, or “in the blink of an eye."

It’s clear the supermarket believes these measures are enough to comply with GDPR, which came into force across the European Union in 2018. Biometric data, however, is regarded as a “special category” of personal data and is considered to be particularly sensitive, which affords it extra protections under the regulation.

In light of this, the Spanish Data Protection Agency (AEPD) launched an official investigation into the use of this technology last week, following reports in the media about it.

"Mercadona has provided the agency with some initial information about the facial recognition initiative in its establishments, and the AEPD has expressed reservations about its compliance with data protection regulations," a spokesperson told IT Pro."

"We are in the preliminary stages of the investigation, so are unable to give any further information about it," they added.

Mercadona, however, told Spanish newspaper El País on 6 July that it had “no record of a file being opened by the agency”, but that it had contacted the AEPD itself, sending “all the information about the project” to the regulator and acting with “total transparency”.

Related Resource

The IT Pro Podcast: Happy birthday GDPR

As GDPR turns two, we look back on its impact and how it’s changed data protection - if at all

Listen now

“We will continue to provide any information that is requested from us,” the company added.

The use of facial recognition software is increasingly controversial and is known to throw up false positives, particularly when the subject is female or has darker skin. In response to both this and potential privacy violations, some local authorities, notably in the US, have prohibited the use of facial recognition software.

Some technology companies have followed suit, with IBM announcing it has stopped working on commercial facial recognition AI altogether, while Amazon has put development on pause.

IT Pro has contacted both AEPD and Mercadona for comment but hadn’t received a response at the time of publication

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021