Supermarket chain faces GDPR probe over facial recognition system

Spanish supermarket chain Mercadona is under investigation by the country’s data protection regulator over the use of a new facial recognition system in 40 of its stores.

The company introduced the AI-powered facial recognition system on 2 July in the cities of Zaragoza and Mallorca, as well as its home city of Valencia.

As reported by The Local es, the “early detection system”, as the company is calling it, is intended to detect people who have restraining orders issued against them preventing them from entering Mercadona shops or contacting members of staff, or who have been convicted of offences such as shoplifting.

When it rolled out the system, the company explained that no information on other customers will be stored and that footage is deleted after 0.3 seconds, or “in the blink of an eye."

It’s clear the supermarket believes these measures are enough to comply with GDPR, which came into force across the European Union in 2018. Biometric data, however, is regarded as a “special category” of personal data and is considered to be particularly sensitive, which affords it extra protections under the regulation.

In light of this, the Spanish Data Protection Agency (AEPD) launched an official investigation into the use of this technology last week, following reports in the media about it.

"Mercadona has provided the agency with some initial information about the facial recognition initiative in its establishments, and the AEPD has expressed reservations about its compliance with data protection regulations," a spokesperson told IT Pro."

"We are in the preliminary stages of the investigation, so are unable to give any further information about it," they added.

Mercadona, however, told Spanish newspaper El País on 6 July that it had “no record of a file being opened by the agency”, but that it had contacted the AEPD itself, sending “all the information about the project” to the regulator and acting with “total transparency”.

“We will continue to provide any information that is requested from us,” the company added.

The use of facial recognition software is increasingly controversial and is known to throw up false positives, particularly when the subject is female or has darker skin. In response to both this and potential privacy violations, some local authorities, notably in the US, have prohibited the use of facial recognition software.

Some technology companies have followed suit, with IBM announcing it has stopped working on commercial facial recognition AI altogether, while Amazon has put development on pause.

IT Pro has contacted both AEPD and Mercadona for comment but hadn’t received a response at the time of publication