AEPD (Spain) - EXP202209645
From GDPRhub
| AEPD - EXP202209645 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 4(1) GDPR Article 4(14) GDPR Article 9 GDPR Article 9(1) GDPR Article 9(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 07.08.2022 |
| Decided: | 01.10.2024 |
| Published: | 06.08.2025 |
| Fine: | 250,000 EUR |
| Parties: | LORO PARQUE SA |
| National Case Number/Name: | EXP202209645 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Spanish Spanish |
| Original Source: | AEPD (decision) (in ES) AEPD (dismissed internal appeal) (in ES) |
| Initial Contributor: | ap |
The DPA fined a company managing a zoo and water park €250,000 for unlawfully implementing a mandatory fingerprint identification system in its parks. Data subjects with promotional tickets allowing access to both parks with one ticket were required to provide their fingerprint data.
English Summary
Facts
Three data subjects filed a complaint to the DPA against LORO PARQUE SA (a zoo, the controller) between August and November 2022. The complaints concerned the mandatory biometric identification methods used to access the park. One of the tickets offered allowed data subjects to access the zoo and water park owned by the controller with one ticket. However, data subjects were obliged to use the controller’s fingerprint identification systems to verify that the same person was accessing both parks, regardless of age. This was carried out in addition to the tickets’ QR code scanning procedure.
The controller argued that the process was necessary to verify whether the ticket was used by the same person. In addition, the tickets were deactivated once the data subject had accessed both theme parks, limiting the storage period of data subjects’ biometric data. Finally, the controller argued that it did not process personal data, as it did not identify the data subject through the fingerprint data or store the image of the fingerprints. Rather, the system simply read the fingerprint and created a mathematical representation of the fingerprints’ characteristics (also referred to as a “biometric template”).
Holding
The DPA first noted that while biometric identification methods were not new, the fact that these processes can be automated with a high level of accuracy raises data protection concerns. According to the DPA, processing this data involves a certain risk, as it is data that a data subject cannot change. This poses a risk of loss of identity for the data subject if the data is misused.
The DPA then dismissed the controller’s argument that it is not processing personal data through its fingerprint systems. The biometric template falls under the definition of biometric data (Article 4(14) GDPR), as it acts as a unique identifier of the data subject. According to the DPA, it is irrelevant whether the data subject can be identified, or whether the fingerprint can be reconstructed from the template; the system still processes biometric data according to the GDPR. Furthermore, storing this data is necessary to verify whether the same data subject is accessing both theme parks. Finally, the DPA stated that the biometric template is personal data under Article 4(1) GDPR, since the data subject is identifiable using information from the ticket.
The DPA found a violation of Article 9 GDPR. Article 9(1) GDPR explicitly prohibits the processing of biometric data for the purpose of uniquely identifying a natural person. The DPA stated that exceptions under Article 9(2) GDPR did not apply. Specifically, the controller could not rely on contract or on consent of the data subjects; the DPA stated that including the processing in the contract does not make the processing necessary for the performance of the contract. In addition, the fact that acquiring the ticket is voluntary did not mean the data subject consented to having their biometric data processed. The controller failed to demonstrate that it had processed the biometric data lawfully, in accordance with the principle of accountability (Article 5(2) GDPR).
Finally, the DPA noted that the controller did not carry out a Data Protection Impact Assessment (DPIA) and did not consider the risks involved in processing biometric data. Furthermore, data subjects were not provided information on the use of the system, and did not have the reasonable expectation of their data being processed in that manner.
The DPA fined the controller €250,000. The DPA considered it a serious violation, as it involved processing sensitive personal data, including those of minors. In addition, the DPA prohibited the controller from using biometric identification systems to access its theme parks, as it was disproportionate compared to alternative access methods.
Comment
The controller filed an internal appeal on 30 October 2024 (within a month of the decision by the DPA). The DPA dismissed the appeal on 30 July 2025 on the grounds that the controller had not presented new facts or legal arguments.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/79
File No.: EXP202209645
SANCTIONING PROCEDURE RESOLUTION
Contents
BACKGROUND.......................................................................................................2
FIRST: Entry of complaints and documentation provided.................................2
SECOND: Transfer of the complaint to the respondent.................................................3
THIRD: Admission for processing................................................................................3
FOURTH: Complainant's letter 3........................................................................3
FIFTH: Information access procedure by the Subdirectorate General of Data Inspection (SGID)....................................................................................3
SIXTH: Preliminary investigation procedures.................................................................4
SEVENTH: Documentation incorporation procedure..................................................5
EIGHTH: Initiation agreement of 2/10/2023..................................................................7
NINTH: Arguments of 10/17/2023 regarding the initiation agreement.......................................7
TENTH: Commencement of the taking of evidence...........................................................................12
ELEVENTH: Arguments of the respondent in his response to the taking of evidence.................................................................................28
TWELFTH: Submission of the proposed resolution........................................28
THIRTEENTH: Arguments regarding the proposed resolution......................................28
PROVEN FACTS......................................................................................................33
LEGAL GROUNDS......................................................................................................42
I. Jurisdiction......................................................................................................42
II. Biometric data...............................................................................................42
III. Biometric data as personal data: Connection with Article 4.1 of the GDPR....................................................................................................51
IV. Prohibition of data processing Biometrics..................................................................56
V Person responsible for the violation...........................................................................59
VI Response to the allegations...........................................................................62
VII Classification of the violation........................................................................69
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 2/79
VIII Determination of the sanction........................................................................70
IX Adoption of other corrective measures....................................................75
RESOLVES:.................................................................................................................76
From the procedure instructed by the Spanish Data Protection Agency and based
on the following
BACKGROUND
FIRST: Entry of complaints and documentation provided
On August 7 and September 13, 2022, a complaint was received from Claimant 1, and on September 16, 2022,
from Claimant 2, as identified in the GENERAL ANNEX for the respondent.
The claims are directed against LORO PARQUE, S.A. with Tax Identification Number (NIF) A38009023 (hereinafter, the respondent). The grounds for the claim are as follows:
Complainant 1 states that they purchased a joint ticket to SIAM PARK and LORO PARQUE in Tenerife, and that "all visitors are required to provide their fingerprints using a reader" to verify that the person entering both parks is the same person, without informing them of the
data processing that will be carried out when the ticket is purchased.
Provides:
- Two photographs, showing an information board (image of an entrance booth to SIAM PARK, according to the image accompanying the complaint). The informational text appears in several languages: "This system is for the exclusive use of visitors who have the following tickets—including, among others, the "TWIN TICKET" (TT), "ULTIMATE TENERIFE," and "VUELVE"—with the following added below:
"This system does not store the image of your fingerprint; it simply reads it."
Next to it, in the same color, is an information panel: "Place your right index finger here, and follow the operator's instructions."
Complainant 2 also provides a copy of the complaint form dated 08/18/2022 against the respondent. He states that he purchased the TT tickets "along with the boat ticket." On 08/18/2022,
when he accessed LORO PARK, "having a ticket and ID, DNI," "I am forced to enter my fingerprint on an electronic device to enter, and when I request entry without entering my fingerprint, they deny me access and tell me to request a ticket refund," without offering any alternative to the system. At the bottom of the tickets provided, it states:
"The second TWIN TICKET voucher (LORO+SIAM) must be used within 15 days
after visiting the first park. After this period, they will be invalidated and will not be refunded."
It indicates that, when purchasing the ticket (boat supplement voucher), this access method is not provided.
It provides a copy of the "TWIN TICKET" supplement vouchers on the body of the boat tickets, which include the names and surnames and NIF/NIE of two adults and two infants, with reference to the boarding/journey date: Gran Canaria/Tenerife. Locator
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 3/79
ticket, the same for all four, ticket number with a sequential number and a final number from 1 to 4 on each ticket, stating that they were purchased from the shipping company as they are offered to everyone who purchases a ticket to Tenerife.
SECOND: Transfer of the claim to the respondent.
In accordance with Article 65.4 of Organic Law 3/2018, of 5/12, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), on
September 16, 2022, the respondent was forwarded this claim so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements set forth in the data protection regulations. data.
The transfer, which was carried out in accordance with the regulations established in Law 39/2015, of 1/10,
of the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), was recorded on 09/23/2022, as stated in the acknowledgment of receipt in the file.
Response dated 10/10/2022:
1. They do not have a DPO or security officer, because they are not legally required to do so, so they cannot respond by providing reports on them.
2. Regarding the lack of information on the fingerprint processing collected from visitors who purchase the "TWIN TICKET" ticket, "as an internal verification system
that the person attending both parks is the same," they are informed that the processing has been recorded "in the fingerprint file" since 05/21/2010.
"Any other Information can be obtained from the AEPD's own files."
Attached is a letter from the Director of the AEPD dated May 21, 2010, notifying you that the "Fingerprints" file has been registered.
THIRD: Admission for processing.
On October 14, 2022, in accordance with Article 65 of the LOPDGDD (Spanish Organic Law on Data Protection), the claim submitted by claimant 1 was admitted for processing, and on October 28, 2022, for claimant 2.
FOURTH: Letter from claimant 3.
On November 3, 2022, a claim was received from claimant 3, who is identified in the GENERAL ANNEX, indicating that the collection of fingerprints is not reported anywhere before passing through controls, nor is it considered necessary for park visitors. On November 24, 2022, the claim was admitted. process your claim.
FIFTH: Information access procedure by the Subdirectorate General for Data Inspection (SGID).
According to the SGID's verification, the respondent appears in "Monitoriza business" as of
03/14/2023, which is a limited company, with a turnover of (...) euros, 41 employees, and activity
in amusement and theme parks.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 4/79
SIXTH: Preliminary investigation actions
On 08/18/2023, within the framework of actions AI/00256/2023, AI/00257/2023, and
AI/00258/2023, carried out by the Subdirectorate General for Data Inspection in order
to clarify the facts and in use of Pursuant to the powers conferred by Article 58.1 of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27/04/2016,
on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter GDPR), and Article 67 of
the LOPDGDD, the respondent is requested to provide the following information regarding the access control system for users of its facilities using fingerprints.
1. Copy of the Record of Personal Data Processing Activities, as referred to in
Article 30 of the GDPR. Specifically, all information related to biometric processing for access using the TT system is requested.
2. Purpose of processing said data.
3. Copy of the data protection impact assessment (hereinafter DPIA). If it was deemed inappropriate to conduct a DPIA, supporting documentation is requested. In this case, please provide supporting documentation for the risk analysis carried out, including all documentation prepared, justifying the results obtained and the measures adopted.
4. Detailed explanation of how the system that controls access to the park
using fingerprints works. Reason for why it is necessary to use it.
5.- Confirmation of the data subject to such processing (for example, specifying whether it is used for access to the general public or for access to persons with a TWIN TICKET; specifying whether it is for adults, children, or both; etc.).
On August 29, 2023, the respondent indicated, regarding points 1 to 3, that it does not need to keep a RAT,
since Article 30.5 of the GDPR applies to it, nor does it, consequently, have the documentation
required in point 3.
The aforementioned Article 30.5 of the GDPR states that:
"The obligations set out in paragraphs 1 and 2 shall not apply to any company or
organization that employs fewer than 250 people, unless the processing it carries out
may entail a risk to the rights and freedoms of data subjects, is not
occasional, or includes special categories of personal data indicated in Article 9,
paragraph 1, or personal data relating to criminal convictions and offenses referred to
in Article 10."
Regarding points 4 and 5, it states:
“LORO PARQUE, S.A. has a special offer for users of its parks LORO PARQUE and SIAM PARK, called TWIN TICKET, so that users of either park can visit the other at a discounted price. As the tickets are not personal, an access control system is used with ten fingerprint matching points, which is requested from those who voluntarily wish to benefit from the commercial offer. This is the reason why fingerprints are taken, which in no case allow them to be associated with any individual, and therefore do not constitute personal data subject to processing as established, for example, in Articles 1.1, 2.1, and 4.1 of Regulation (EU) No 1999/2007. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). This is solely a mechanism that allows LORO PARQUE, S.A. to verify that the person who used the ticket to LORO PARQUE (regardless of age, address, nationality, sex, race, religion, etc.) is the person who used the ticket to SIAM PARK (or vice versa), benefiting from the price reduction offered. The storage of the ten fingerprint points is done solely and exclusively to verify that the person who enters one of the parks and subsequently accesses the other using the TWIN TICKET offer is the same person. The stored data, therefore, does not allow relate them
to any specific or determinable person, having no commercial or other usefulness other than that stated."
SEVENTH: Documentation Incorporation Procedure
On 08/31/2023, the following documentation obtained from the website https://www.loroparque.com was incorporated by the Inspection staff:
-Annex 1: LEGAL NOTICE.
Screen printout, dated 08/17/2023, at the electronic address https://www.
loroparque.com/legal-notice/
It has a "data protection policy" section, which states that: "In order to contract the various services offered by LORO PARQUE SA, as well as to receive the park's newsletters, the user and/or consumer must register the requested data as a customer." "The person who registers expressly authorizes LORO PARQUE to include the personal data contained in the form fields in an automated file, as they are necessary for the proper provision of its services."
It has a section m called "payment method," which states that credit or debit cards are accepted.
In section n, "shipping," it states that tickets are sent through the user area on the platform and/or email, as it is a virtual product in PDF format.
Another section: "Data Protection Regulations" provides information in the section "Purposes of data processing: will depend on the reason the user has contacted us." One of these is to "manage purchases and requests made by the user through our websites."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 6/79
Loro Parque informs you that "the user's personal data will be stored by LORO PARQUE for the legally permitted period based on the reason the data was provided to us."
In the LEGAL BASIS section, it states that "The personal data provided by the user is ultimately intended to enable Loro Parque to provide the services offered and accepted by you."
An email address is provided where the user can exercise their rights.
-Annex 2: TERMS AND CONDITIONS OF SALE AND SERVICES.
Screenshot of https://www.loroparque.com/terminos-y-condiciones/, as of 08/17/2023.
It includes a DATA PROTECTION POLICY clause in its letter f, which provides information in the same sense and content regarding the registration of user or consumer data
and for the same purpose as in the LEGAL NOTICE.
It states compliance with regulations not in force at that date, Organic Law 15/1999 and Royal Decree 1720/2007, which implements it.
It also reproduces the literal text appearing in the LEGAL NOTICE regarding the registration of data as a client
on the form and its inclusion in an automated file.
It also includes an email address where the user can exercise their rights.
-Annex 3: PRIVACY POLICY.
Screenshot of https://www.loroparque.com/privacidad/ as of 08/17/2023. It reproduces the same content as indicated in the LEGAL NOTICE.
A printout of ANNEX 4, dated 08/30/2023, of a page from the park's official online ticket sales site is provided.
https://tickets.loroparque.com/reservarEntradas.aspx?opc=20&m=INDIVIDUALTWIN&Ig=es-ES/
The first line states: "Buy your TWIN TICKETS in just a few minutes and
live an unforgettable experience." The tabs open to select the ticket.
The first line indicates that you must select the day and type of ticket you wish to purchase; the second indicates that you must select the time of your visit.
In step 3, under the "Enter your contact information" tab, "Include the contact information of the data subject who will be making the purchase." This includes the following boxes:
Name/email/country/postal code/phone number/invoice request box.
"Basic information on data protection":
Data controller: Loro Parque
Purpose: Administrative management: ticket issuance and access control to the venues.
Accounting and tax management. Statistical management, commercial advertising and marketing
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 7/79
Legitimation for the execution of a contract" and a section with additional information to click on the link.
It ends with: "I have read and accept the Privacy and Purchasing Policy."
4. Select the payment method
EIGHTH: Initiation agreement of 2/10/2023
On 2/10/2023, the Director of the AEPD agreed:
"FIRST: INITIATE SANCTIONING PROCEDURE against LORO PARQUE, S.A., with NIF A38009023, for the alleged violation of Article 9 of the GDPR, classified in Article 83.5.a) of the GDPR, and classified as very serious for the sole purpose of the statute of limitations for the violation. in Article 72.1.e) of the LOPDGDD.
“For the purposes set forth in Article 64.2 b) of the LPCAP, the applicable sanction
would be an administrative fine, with a penalty of €250,000 for a violation of Article 9
of the GDPR.”
NINTH: Allegations of 10/17/2023 regarding the initiation agreement.
Regarding the initiation agreement, allegations were received from the respondent on 10/17/2023, in which he states:
1-“All the tickets sold to access his parks are not personal.” "The
tickets generate a QR code, and the software sensors on which customers place their fingers in a system provided by an external company directly generate a mathematical representation, which is the only thing LORO PARQUE ultimately obtains. This allows it to verify, with a high level of certainty, that the person who enters one of the parks is the same person who subsequently enters the other. This means we cannot identify the person who purchased the tickets by the reverse procedure, and therefore reach the customer's fingerprint and, therefore, their identification."
The defendant states that it only creates a mathematical representation of the fingerprint, which is the only thing stored; no image of the fingerprint is stored. This representation does not allow any natural person to be identified, and it is not possible to use reverse engineering to create the image of the actual fingerprint from the stored data.
It adds that it should be noted that the mathematical representation will only be retained
as long as the card or ticket in question is valid, and will be destroyed immediately
when it ceases to be valid.
The respondent states that "the TT (double visit) ticket is not two tickets, but rather a commercial discount for the person who purchases both tickets. Therefore, to link
the two tickets to the same person, fingerprint identification is used, which at
no time is required or can identify the bearer."
"The request for an identification document is only made for the purpose of determining
resident status or not, due to the price difference offered."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 8/79
“It has commissioned external professionals to develop the program and components that allow it to prove that the person who benefits from a price reduction for visiting both parks is always the same user, without any of the customer's personal data being stored throughout the entire process.
The defendant reiterates that to verify whether it is the same person who accesses the second park using the system, offering TT, it uses a “mathematical representation of the fingerprint, which is not used to identify the customer because it does not provide any personal data,” and “its verification system does not store any personal data, but rather a mathematical representation that can only be used within the validity period of the commercial offer, fifteen days,” indicating that this should not cause concern to the customer because “their identity cannot be verified once the mathematical representation of the fingerprint has been generated,” without any can perform a "reverse engineering process that allows, based on the mathematical representation of the fingerprint, to determine that it belongs to a specific or determinable natural person, or at least, it would not be possible without a highly complex system to identify the person—the person cannot reasonably be identified."
"We have never used any personal data, as defined in Article 4.1 of the GDPR, for the purposes of the TWIN TICKET, to verify users of the TWIN TICKET commercial offer."
It reiterates that the mathematical representation of the fingerprint used does not serve to identify the client, nor does it identify individuals, because it does not provide any personal data about the client. None of the personal data defined in Article 4.1 of the GDPR is being used, "limited to verifying that one mathematical representation is identical to another." It cites Recital 26 of the GDPR, emphasizing that data protection principles should not be applied to anonymous information or to data rendered anonymous so that the data subject is not identifiable or ceases to be so. It concludes that sanctioning for this constitutes a violation of the principles of legality and criminality.
It provides DOCUMENT 1, a rectangular photo image of "TWIN TICKET", on one side only, which states: "Conditions", and contains:
-On the front of the printed paper provided, with letters on the right side "TWIN TICKET", with the image and name of the two parks, LORO PARQUE and SIAM PARK, you can read on the left side an informative note: "CONDITIONS:
"The TT may only be used by one person, who is the sole beneficiary of the visit to LORO PARQUE and SIAM PARK. Under no circumstances may visits to both parks be made by different people.
Once you have visited the first park, you have 6 months to visit the second.
When you enter the first park, you will be given this envelope containing a ticket. It is
essential that this ticket be kept and presented when visiting the
second park."
Below the TT, a photo of another printed piece of paper is attached, literally: "TWIN TICKET ADULT 1-2," which the respondent refers to in his allegations as a "small card on which the generated QR code is stored." It contains, as can be seen:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 9/79
- a serial number, for the visit to - LORO PARQUE, on a prearranged date and time
- a QR code underneath,
- non-refundable. Valid for 15 days
- non-transferable ticket
"After defining personal data, the AEPD understands that the mathematical representation of a fingerprint is personal data, which it considers not to be true in this case, because the mathematical representation does not allow for a path to be drawn reverse engineering is not possible, as the aforementioned representation says nothing about the customer, "just as the ticket holder is never identified by name, it is the same as the holder of a movie ticket."
The respondent states that, based on the fact that its systems do not allow
identification through fingerprints, "The identification is never stored, nor is it related to the entry." Since the agreement indicates that these systems allow the identification of a person, such a sanction would not be applicable to them, in error. It clarifies that this is deduced from the fact that the requirements of the definition indicated in the initial agreement are not met, especially in its legal basis II regarding the definition of biometric systems, since the use it makes of them does not allow people to be identified through fingerprints.
It considers that, since personal data is not processed, the premise that defines processing in Article 4.2 of the GDPR is not met. It considers that this conduct cannot be punishable.
2- The respondent provides in DOCUMENT 4 a copy of the manufacturer's manual for the fingerprint reader device (sensitive content) and in DOCUMENT 5, its "unofficial" translation of the pages. 11 and 12, since, according to the respondent, XELIOS is the manufacturer.
The Manual "explains the process of extracting minutiae from fingerprint images, and how biometric comparisons do not use the image itself during their execution."
Access DOCUMENT 4, which refers to the software products "***DEVICE.1
(...) of ***COMPANY.1 (software manual) in English version, Nov 2018, which describes the functionalities of fingerprint registration and use. Images of different sensors can be seen in the manual. Some aspects of the manual stand out, such as:
“3.1 “On Fingerprints,” which specifies the skin of the fingers and their fingerprint composition, different models of endings or bifurcations (called ridges) “ending,” and “bifurcation,” with unique characteristics known as minutiae. “These minutiae are unique characteristics that form the basis of any
system that uses fingerprints for identification or authentication purposes.”
3.2 How does it work?
3.2.1. Image acquisition “made with (...)”
3.2.2. Image processing and feature detection
It is a three-step process:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 10/79
1-The software analyzes the image in (...). The image (...) and obtains the (…) possible
facilitating the detection of bifurcations, terminations, and other minutiae characteristics.
2-The software uses the (…) to determine the (…) of the fingerprint image, creating
(…) for the ridges and valleys.
3-The system produces a list of minutiae—a biometric template—resulting from the analysis
of (…)
The biometric template is a mathematical representation of the original fingerprint
based on ridge model analysis. The maximum template size is (…) and is
used during the matching process to compare it against the previously
stored template.
3.2.3 Matching During the verification process, the system does not
compare fingerprint images; it compares the minutiae that were detected when the fingerprint image was
encoded.
In the translated pages provided, DOCUMENT 5, there is an explanation that indicates "the
system produces a series of Minor details. The biometric template is a mathematical representation of the original fingerprint. The work is not done on the fingerprint itself, but on a mathematical representation of it.
During the system verification process, it does not compare fingerprint images.
It compares the minor details detected during the encoding of the fingerprint image.
Minor details are not compared, but rather fingerprints.
3-Provides the requested DOCUMENT 2, report dated 10/10/2023, from the entity
***COMPANY.3” “Ticketing Solutions” entitled “Data Protection Security Measures Report - Access Validation Control System with Biometrics - Fingerprint -, client LORO PARQUE,” without detailing the role entrusted to that entity in the processing.
Said DOCUMENT 2 is accessed, and for the purposes of the claim, it can be verified that:
1. "The fingerprint sensors ***DEVICE.1 are capable of internally encrypting the fingerprint they capture at the time of capture, such that the software that launches the fingerprint capture request directly receives the encoded data.
The process to follow at the code level, using ***DEVICE.2, would be:
-Create an instance of the management object
-Enable encryption of minutiae/images captured on ***DEVICE.1.
-Store the encryption key (...) in the sensor's internal memory.
The key is permanently stored in the sensor, so this step only needs to be performed once.
-Capture minutiae/image of a fingerprint using the device ***DEVICE.1.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 11/79
-Obtain minutiae (and/or image) of the captured fingerprint. This data will be encrypted in the key (...) contained in the sensor.
-Close the connection with the device after use.
In section “4.2 Security and Anonymization,” it states that fingerprint encryption
ensures that a person's biometric information is robustly protected since it is
converted into an unreadable form without the corresponding decryption. "Furthermore, converting the fingerprint into an encrypted key contributes to data anonymization by
effectively separating biometric information from any other identifiable information."
"By not storing the fingerprint in its original form, the possibility of correlating it
with other personal data is reduced, reducing the risk of identifying the individual from the fingerprint, thus strengthening their privacy."
It adds that this approach "promotes anonymization by minimizing the risk of identifying individuals through their fingerprint, which complies with the principles of privacy and data protection."
In section 5, it states that the system uses fingerprints for authentication purposes;
"retention is limited to the time necessary to identify the visitor." "The fingerprint data will be retained only while the card or ticket in question is valid, and will be destroyed immediately when it is no longer valid, thus protecting the privacy and security of users."
The respondent states its opinion on the aforementioned report in the cited document:
1. Regarding section 4: "Specific security measures," it is inferred that the respondent
has never obtained fingerprints or fingerprint points, but rather, through the
fingerprint sensors ***DEVICE.1, the fingerprint captured is internally encrypted at the
same time as the capture, such that the software that launches the fingerprint capture request directly receives the encoded data." "LORO PARQUE directly receives encoded data; it does not receive a fingerprint or fingerprint points.
Therefore, when the respondent receives encoded data, it does not receive any personal data
as defined in Article 4.1 of the GDPR."
2. “Individuals' biometric information is robustly protected, as it is rendered unreadable without corresponding decryption, and the conversion of the fingerprint into an encrypted key contributes to data anonymization by effectively separating biometric information from any other identifiable information.”
2. The respondent considers that “by not directly storing the fingerprint in its original form, the possibility of correlating it with other personal data is reduced, data to which, as we have said, the information company does not have access, which reduces the risk of identifying the individual from the fingerprint.”
The respondent indicates that the report "certifies that the digitized data obtained will be kept only while the card or ticket in question is valid, and will be immediately destroyed when it ceases to be valid, thus protecting the privacy and security of users.
3. The respondent states that it "does not share any personal data with the software company ***EMPRESA.2, "manufacturer of the devices that obtain the mathematical representation of the fingerprint that would allow it, in the unlikely event of wanting to do so, to identify the owner of the details," considering that "the person cannot be reasonably identifiable, even with the help of third parties."
It points out that ***EMPRESA.2 "would need to be able to access our databases in order to link the encrypted data to a specific person." It clarifies that the company
guarantees that "it does not work with fingerprints, but rather with mathematical representations thereof," and that "in the verification process, the system does not compare fingerprint images, but rather clouds of minutiae that, when compared with each other,
process a score. If it exceeds the determined threshold, it is assumed that the two templates come from the same finger. However, it never allows us to identify the person to whom the finger in question belonged. Therefore, under no circumstances can these templates be considered as
personal data for the purposes of the GDPR."
4. It requests annulment based on Article 47.1.e) of the LPACAP, alleging that acts related to the processing of personal data in which the user is not identified, for which the user is not responsible, causing defenselessness. It adds that there is no culpability in its conduct, citing Article 28 of Law 40/2015, of 1/10, on the Legal Regime of the Public Sector (LRJSP).
The defendant also alleges "annulment by applying Article 48.1 of the LPACAP in relation to Article 29.3 of the LRJSP" for violating the principle of proportionality in the amount of the sanction, considering it arbitrary, and that it only takes into account its billing, without
containing the gradation as indicated in the aforementioned article.
TENTH: Start of Evidence Collection
On July 3, 2024, a period for the collection of evidence was opened, and the evidence was collected on
July 12, 2024.
In order to ensure its delivery, the document was reiterated on July 8, 2024, and is recorded on July 10, 2024.
It stipulated:
1. The claim filed by the three claimants (refer to the GENERAL ANNEX of the initiation agreement) and its documentation, the
documents obtained and generated during the claim admission phase, and the report on the preliminary investigation procedures that are part of procedure AI/00256/2023 are hereby reproduced for evidentiary purposes.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 13/79
2. Likewise, the allegations to the agreement to initiate the referenced sanctioning procedure, submitted by LORO PARQUE, S.A., and the accompanying documentation, are hereby reproduced for evidentiary purposes.
3. Google searches today for ***EMPRESA.2, and the website
***WEB.1 appears, informing that it is a manufacturer and creator of biometric systems,
based on the technology of the world leader in the field of Biometrics, ***EMPRESA.1, which,
with more than 35 years of experience in the market and currently implemented in more than 80
countries, has the largest databases in the world. "We develop our own systems,
based on fingerprints, which are currently applied in areas as varied as
Banking, Healthcare, Sports, etc."
A Google search was also performed on the same day for ***EMPRESA.1,
indicating the website idemia.com, a multinational software developer
related to cryptography and biometric systems, based in France.
4-Google is accessed today and the website loroparque.com is searched for,
https://www.loroparque.com/terminos-y-condiciones/, and the procedure is entered into the "terms and conditions of purchase and services", appearing in section f.- DATA PROTECTION POLICY, within section II "General conditions of sale and services".
"The user and/or consumer, in order to contract the different services offered by LORO
PARQUE, S.A., as well as to receive newsletters from the Park, must register the requested data as a client. They declare that all information provided upon registration is true, complete, and accurate and that, in accordance with Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights, as well as Regulation (EU) 2016/679 of the European Parliament and of the
Council As of April 27, 2016, the person registering EXPRESSLY AUTHORIZES
loroparque.com to include the personal data contained in the form fields in an automated file, as they are necessary for the proper provision of its services. It is indicated that the data controller is the commercial entity
LORO PARQUE, S.A., whose data was provided at the beginning of these GENERAL CONDITIONS OF SALE, for the purposes of exercising the rights of access, rectification,
deletion, limitation, cancellation, and objection provided for by law and EU Regulation.
"For the information of our customers, we inform you that the tickets
called TWIN TICKET, SECOND VISITS, IN PARK, and ANNUAL CARDS are bearer tickets, and do not identify the holder or owner. Therefore, to link the tickets to the purchaser, a verification system has been established by obtaining details, which form a mathematical representation that is not a fingerprint of the purchaser. This representation cannot be used to identify any individual. Its sole purpose is to verify that the person who benefited from a promotional offer is the person using the purchased product. It is also impossible to subsequently link the mathematical representation to the user who purchased our commercial product."
5. THE COMPLAINT IS REQUESTED
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 14/79
A- Regarding the inclusion of the underlined information, please provide information on the date it was included, providing proof of inclusion, and explain or clarify, if applicable, the difference you believe exists in your allegations when referring to "mathematical representation" vs. "biometric template."
Answer received on 08/01/2024. Regarding this, the only statement is that "it is a mathematical representation obtained after creating a biometric template. The information stored is not biometric data, but is generated in an encrypted manner, with no possibility of reversing the procedure. A mathematical representation is generated. Its appearance is that of a combination of numbers and letters generated in an encrypted manner."
B- Explain what the underlined tickets refer to? What do they entitle?
How can they be purchased? Who is responsible for it? How should they be paid for and by whom? And what data must be recorded? Provide a printout of the screens. Indicate what the recorded data is used for.
You responded that tickets can be purchased through various sales channels: the website, in-person box office, and there are also marketing agreements with agencies and tour operators.
The respondent explains that at the website level, the process is as follows:
- Access the website in the ticket section, selecting TT (of the other
tickets or ticket types, SECOND VISITS, IN PARK, ANNUAL CARDS, also for the bearer, nothing is shown). "The ticket type is chosen based on the age of the person
who will be entering and the date they wish to visit Loro Parque and Siam Park.
Then, purchase information is requested: NAME, EMAIL, PHONE NUMBER,
and POSTAL CODE. The customer must indicate that they have read and accept the Privacy Policies and whether or not they wish to receive advertising and/or an invoice. Payment is then made through a
secure payment gateway with a bank, and the tickets are sent by email
to the indicated email address.
The images shown on the website are provided, indicating that the adult tickets are for ages 11 and over, and that children from 3 to 11 are free for children from 0 to 3.
It states that "Since this Twin Ticket grants the ticket holder access to both parks, this is to validate that the same person is entering." to both parks and uses the same entrance, which is why the first time you enter, a fingerprint is captured, which, after encryption, converts it into a mathematical representation.
C- Explain and confirm whether the underlined tickets or admissions are not personal,
even if the purchaser's information was requested upon purchase.
Explain why it is necessary and proportional to establish the mechanism for using a
biometric fingerprint collection system to "link the tickets to the purchaser"?
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 15/79
Indicate whether there is no other suitable alternative system that does not require fingerprint registration and
subsequent verification upon visiting the second park. It is noted that this expression "linking the tickets to the purchaser" had not previously been used by the
respondent.
Respondent responds that no tickets are personal. The purchaser of the tickets can be one person,
and those who enter the park can be different.
"The mechanism for capturing details and generating In an encrypted form, a mathematical representation
comes from the need to be able to link the same person who has a TWIN TICKET to the person who accesses both parks with this purchased right. It's not that the ticket is exchanged between people."
He responds that "no alternative method has been defined" and that: "indeed, the tickets are not linked by the purchaser. The ticket and the capture of details link the person who uses access to one park, with that same ticket and person, to access the second park, in order to use and obtain the Twin Ticket promotion."
D-Explain the assumption that there is only one purchaser who provides the purchase details,
and it is the person who will access the ticket with the TWIN TICKET (TT). If, according to the
information in clause f, DATA PROTECTION POLICY:
Do you consider that the ticket is being linked to the purchaser, as the information states,
through the fingerprint? How are these links created in terms of their information systems and use of the fingerprint?
He answered that "it is linked to the access, not the purchase process. It is obvious that, if the
purchaser and the person accessing are the same, there is a relationship. The purchase and access processes are two distinct processes.
However, the mathematical representation resulting from requesting details during access
cannot be related to any of the purchaser's data. The purchase process requests name
and email address: A.A.A. With email address ***EMAIL1 and phone number ***TELEPHONE.1, A.A.A. accesses Loro Parque with her Twin Ticket, the details are captured, and the mathematical representation is generated. (...)……
Two months later, A.A.A. with email address ***EMAIL1 and phone number ***TELEPHONE.1 purchases
another Twin Ticket, and upon using it, the details are captured and a mathematical representation is generated. (...)….
What relationship can be established? Only that when she goes to access the second park, the mathematical representation is 95% similar to the first and grants her access, but it is no longer valid.
E- Please provide information on whether a person can purchase tickets for others without actually visiting the parks? In that case, would the fingerprint data of the purchaser who is not going to the park be collected? Which person(s) would they be taken from, and what
title would they have to have? How do they link the purchaser to the fingerprint data in that case?
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 16/79
The answer is, "They are two different processes: purchase and access. The purchase can be made by one person and the ticket can be given to another for access. A person who
makes a purchase never has their ticket details captured, because in the purchase process, only the right to entry is acquired. It is during the access process that the details are captured, and that person's access to both parks is validated with their
Twin Ticket."
G- If the "ULTIMATE TENERIFE TICKET" and "VUELVE" tickets are still available,
for which, according to claim 1, fingerprint registration was required for access,
what do they include and what information must be provided?
The answer is, "These tickets are not for sale. However, fingerprint registration is never requested; 10 minutiae are captured, encrypted, and stored as a
mathematical representation. Even if they are purchased at the box office, no information is requested from the
purchaser, therefore, it is impossible to establish a relationship."
H-Please confirm whether, in 2022, the information that access with the TT offer included fingerprint registration and the reason for this was included in the general terms and conditions of sale and provision of services, or in the Legal Notice.
No answer.
6. The respondent is requested to provide a copy of the contract(s) signed with the external company
that manages the biometric recognition system with fingerprint reading that it has implemented to control access to the two parks with the TT, in force on the date
of the events. Indicate the role played by the entity ***COMPANY.3.
The respondent responds that it provides a copy of the contract in DOCUMENT 2 signed with ***COMPANY.3,
referred to in the contract as ***COMPANY.3, and its annexes, documents "3 and 4."
The following aspects of the contract are worth highlighting:
- "CONTRACT FOR THE PROVISION, ADVICE, AND INSTALLATION OF A SYSTEM FOR THE SALES AND RESERVATION OF TICKET, ACCESS AND ACTIVITY CONTROL OF THE PARKS THAT ARE PART OF LORO PARQUE, AS WELL AS THE MAINTENANCE OF SAID SYSTEM" dated July 13, 2020.
The purpose of the contract, in the first clause, indicates that its purpose is the
implementation of an advisory system in the parks under the control of Loro Parque, as well as the comprehensive installation of the software works and licenses included in the document "Solution for the sale and reservation of tickets, access and activity control, and its maintenance."
In the copy of the contract, document 2, the first clause states that "***COMPANY.3 has the necessary and sufficient human and technical resources for the proper provision of the supplies covered by this contract."
In the third clause, "Scope and Supply of Contracted Services," it is stated that
"it will include consulting on the installation of the ticket sales and reservation system,
access control, and activities of the parks that comprise the LORO PARQUE entity, as well
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 17/79
as well as the maintenance of said system, including everything necessary for the
functioning of the contract."
In the fourth clause, "Delivery Period," regarding the entry into force of the contract, it is specified
that it will be carried out in phases.
In clause six, "Obligations of ***COMPANY.3," it states that "***COMPANY.3 will provide the necessary resources to carry out the most appropriate provision of the supplies covered by this contract. ***COMPANY.3 undertakes to ensure that the personnel it hires are aware of and accept in writing their exclusive dependence on this Company, with absolute exemption from liability, even in a subsidiary capacity, for LORO PARQUE."
"***COMPANY.3's activities must be carried out with due diligence, taking into account, where appropriate, the user public and the workers or employees of LORO
PARQUE OR ITS GROUP OF COMPANIES."
This contract does not address whether or not the contractor has access to personal data.
Describes PHASE I of the system implementation:
"Object: software installation and commissioning of PHASE 1" (duration from the signing of the contract until 08/01/2020) contained in ANNEX I of the contract, provided as
DOCUMENT 3, titled in Manual format, a "Scope proposal: Phase 1" "Presentation of the solution ***COMPANY.3" which includes "sales, reservation, and access control service," containing detailed specifications for said solution and
referring to customer reservations of tickets, payment, invoicing, and issues related to the platform whose software manages, highlighting:
In section 2.1 "Ticket Offices. Ticket Office Sales Application: (...)" the functionalities indicated include, among others, "Locator: Reservation Exchange and Online Sales Reprint"
Option 2.1.1.7 is also available. Visitor data request: nominate entries, to
have control over who visits.
In the additional features section, it is indicated that, upon completion of the sale, additional features can be performed:
"individual ticket printing based on the type of sale
with a QR code that allows access control to the spaces."
"2.1.1.17. Locator. All online sales or reservation operations carried out
from the administration or checkout generate a locator that can be consulted and
managed in this menu option."
In point 3.1.2, it is indicated that "it will be possible to check whether a locator, ticket, or delivery note has been
accessed through a specific access point to a specific center."
"2.2. Access Control (...).
The system's access control will be able to validate the different barcode and QR code formats issued by the different sales platforms.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 18/79
With peripherals With appropriate reading systems incorporated into access devices, the ***EMPRESA.3 System supports the incorporation of card and RFID wristband reading systems, as well as validation of biometric parameters, such as fingerprints and facial recognition.
When nominating visitors for each ticket, voucher, promotion, etc. issued at the time of sale or reservation, the visitor's identity can be verified at the access point by reading the OCR code from the
ID document or passport.
The information obtained at the time of access is stored in the database with all the information structured so that it can be linked to all information related to the corresponding sale, reservation, subscriber, etc. This provides complete traceability of operations.
All codes will follow the same coding scheme, which includes different data to perform the configured validations and security digits to verify that the code belongs to the system.
The The validations that an access control performs depend on the type of control associated with the ticket entry type. Thus, by configuring two different types of control, it would be possible to ensure that
a visit's "VIP Invitation" entry type does not control the access time,
while a "General" entry would control access time and would not allow entry until the session was
close to its start.
The types of control can be configured with different validations, such as for the
day reserved, within the configured time range, days of the week that access is allowed according to the entry type, defining the number of times a given entry can pass access control, defining a date range between which access for that entry is
valid, or without access: if, for some reason, it was necessary to prevent the inappropriate use of a product in the system's catalog, the validation "No
access" could be associated, which directly prevents the entry from being accepted at the access control.
“The different devices that can be used for access control with which the system is capable of working share a common database for validating entries,
where you can configure what should be taken into account when granting or denying entry: time, a single or multiple accesses, validity during a date range, etc.
Outside of this common database, each type of access control represents a submodule of the system, as they have their own specific characteristics:
Turnstiles. The mechanical control of turnstiles is carried out with specific electronics that
communicate with the core of the access control system to determine whether or not access should be granted.
Lectern with reader unit. Barcode readers are connected to a computer and
display on screen whether a ticket is valid or invalid. If it is invalid, a beep is emitted and the reason for not granting access is highlighted: date, incorrect barcode, time, ticket already used, etc.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 19/79
PDAs. PDAs offer the access control officer greater mobility.
They require a wireless network connection.
The proposed on-site access control minimizes service time when reading tickets, significantly improving the visitor experience.
“2.3. Second-visit sales – inpark.
The ***EMPRESA.3 System is multi-capacity and multi-venue, allowing the sale and issuance of different products (tickets, passes, promotions, season tickets) with the possibility of multiple accesses to one or more of the Group's parks according to the characteristics defined at the time of defining the product.
As detailed in the previous section on Access Control, accesses after the first visit can be verified using a biometric system (fingerprint or facial recognition) or identification by ID or passport.
“2.4.2. Checkout
(…)
“7. Purchase confirmation or denial window.
In the case of confirmation, the customer is automatically sent an email with their purchase details, including a QR code that they will use to directly access the purchased visit or activity.
The purchase documents, although customized according to images and creative work specified by the client, are similar to those shown below:
The document appears on the screen with a QR code on the right side and a tracking number, date of visit, number of tickets and price, cardholder information, email, postal code, province and country, date of visit, and data protection information on the left.
It also contains the various utilities that can be obtained with the platform, including lists of reports, sales, tickets, etc.
It describes PHASE 2 and 3:
"Object: software installation and commissioning of phase 2 and 3" (duration from the completion, installation, and commissioning of phase 1 until 09/30/2020, phase 2, and
from this until 12/31/2020, phase 3, contained in ANNEX II, which is provided as
DOCUMENT 4.
The name of the installed equipment, software models, and hardware used are requested, specifically for the digital recognition operation for access with the TT.
The respondent states that: "The equipment is of the brand ***COMPANY.1, model ***DEVICE.1, supplied by the company ***COMPANY.2."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 20/79
The respondent states that the client who wishes to benefit from the TT economic offer,
"the image is acquired with (...)." The respondent is asked to provide information about who carries out this procedure, where the image is stored, and whether it is transferred to any other location(s).
The respondent responded that: "The capture of the details made by the camera (...) and its automatic encryption on said device generates a mathematical representation that is stored on Loro's computer equipment." Parque SA, secured and used exclusively for the ticket sales and access validation system. This is the only physical location where this data is stored in the technological infrastructure of Loro Parque SA, both in its production environment and in backup copies."
7. Please also inform us if this system and the contract are also used for access with other tickets other than the TT, specifically those underlined in point 4.
The answer was: "Yes, that's right, they are used for all types of tickets sold."
8. Please inform us which database you are referring to when you explain that ***COMPANY.2 "would have to be able to access our databases to be able to link the encrypted data to a specific person." Contents of this database: what data is it formed with?
The origin and time at which this database is stored, its purposes, subjects it encompasses, and
product of what relationship, content, and origin of these data. Data, purpose, retention period.
They responded: "Microsoft SQL database that performs the work of (...) the entire ticketing solution." It contains all the data necessary for ticket sales and
subsequently providing access to the parks. It begins to be entered from the moment of purchase, when tickets are generated. These tickets must then be validated at the park's physical access control, and the QR codes are checked to ensure that these tickets exist or not, and access is validated or not. The purpose is to ensure that the ticket sales and access system works and has information against which to validate it."
9. Regarding the statement that the ticket generates a QR code, please provide information:
- What ticket data is used to generate the QR code? When? And what data does the QR code contain? Is it from the ticket itself or is there more?
- What is its purpose?
- Does it have to be carried for both the first and second access with TT?
- Is the QR code read along with the fingerprint?
- Do other non-personally identifiable tickets also generate this QR code?
He responded: "They are ticket data, generated with the transaction number, ticket number, purchase tracking number, etc.... Never with data provided by the buyer.
What is its purpose? To allow and validate access to purchased tickets. - Should it be carried both for the first and second access with a TT? Yes, but it can be carried
in physical, paper, or digital format, on a mobile device. If the QR code is read along with the fingerprint,
Of course, the QR code is read, it is detected that it is a TT ticket, and in that case, a reading of the
details is requested, whether it is the first or second access. If an attempt is made to read a third
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 21/79
time, it indicates that the ticket is used and no reading of the details is requested. If the rest of the
non-personal tickets also generate this information, QR: All tickets generate QR codes, and Twin Tickets are not personal tickets. Access to both parks is associated
with an individual, but any information about this person who enters the park is unknown.
10. Device, space, or location where the biometric templates resulting from
the first fingerprint registration of TT users are stored. Is any data or element added to these stored templates?
Who has access to these templates, and
Who manages this storage? What software model is used? How secure is this system where the templates are stored?
He responded: "They are not added to any data; they are stored in a dedicated table in the
Database. No one accesses these templates, only the system. The storage is
managed by Loro Parque SA, (...) to provide maximum physical security.
Physical and logical security, as well as perimeter security technologies, are in place to protect this
system."
11. Brief technical explanatory summary of the practical operation of the
implementation of the system that managed fingerprint collection in 2022, which
is used as a means of access control to the second park in the TT, with particular reference
to the sensor, template storage system, and its interconnection. Also, regarding the system used to create the biometric templates, general characteristics of the algorithm used for this function, whether said algorithm is used to generate
the same template in different biometric systems, and at what stage or time(s) the algorithm is applied,
and for what purposes.
The response was: "The system is the same in 2022 as it was in 2024. Same process, same
capture of details, same (...)."
The remaining issues are not addressed.
12. Answer the question: whether only one fingerprint or more fingers are collected for each user, and the reason for the second or subsequent collections.
You answered: "The capture of details is only done from one finger."
13. Explain how the system works when, for example, the user visits the
second park with the TT, when they insert their finger into the reader. What other element does it compare this entry with? Where is it stored? The date until which it is kept, and whether
after the deadline it is blocked or destroyed (providing proof of this). And what would happen if the fingerprint is used after the fifteen-day validity period of the TT or the validity period of the ticket has elapsed? Indicate who is responsible for this storage, its blocking, and its
destruction, if applicable (providing proof of this).
He responded: "First, the QR code is read to determine if the ticket is a Twin Ticket. The mathematical representation is compared with the one taken during the first reading, and if there is a match percentage greater than 95%, access is granted. When the tickets are read twice, you are no longer allowed to use them, so the third reading does not launch the minutiae capture process.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 22/79
Tickets are no longer valid; if they are unused, they can be used. The blocking is done automatically by the system using the readings of the Twin Ticket. The first reading allows you to enter the first minutiae and generates mathematical representation A. The second reading allows you to enter the second minutiae and generates mathematical representation B.
It compares both mathematical representations and determines if A and B match. It seems that 95% of the cases allow access.
The third reading gives an error, says "an entry already used," and doesn't ask for details.
No further comparisons are made."
14. Information: If the biometric template is stored in the reading sensor,
what information is stored in said sensor? Purpose of this? And is any information transferred at that time to the claimant's databases? Purpose.
He responded: "Nothing is stored in the sensor. It performs the entire process of capturing details, encryption, and generating the mathematical representation, which is sent to the database."
15. The reason/purpose of the system is that when a person accessing the park with the TT passes their finger over the sensor, the fingerprint code collected by the software (contracted company) is transferred to the respondent's systems (as stated in their allegations). If this code, which is in the respondent's systems, is used later, explaining
what it is for, how long it is stored, and why that period.
The respondent responded that: "The capture of minutiae generates (...). This mathematical representation
waits for the second capture of minutiae to be performed, to generate a second mathematical representation
(...) and to compare the two.
Until this second capture of minutiae is performed, to generate a second mathematical representation in an encrypted manner
, that first representation waits for
the second."
16. Furthermore, please confirm what you stated in your response to the complaint regarding the use of fingerprint registration to verify that the person entering the second park is the same as the person who entered the first (despite the non-personally identifiable entrances). No personal data is processed, and that this consideration was taken without any report or opinion analyzing the operation of the biometric system with the biometric system equipment that supports it. Please indicate whether this point has changed. Likewise, please report whether you considered, with respect to the complaints (year 22), taking into account the examination of the necessity and proportionality of processing for the purpose of controlling access to parks with non-personally identifiable TT entrances or similar, using fingerprints. In particular, please detail the analysis carried out on the alternatives to the aforementioned use of fingerprint registration for access. He responded that: "The fingerprint is not registered or read; a small capture is made, a mathematical representation is generated in an encrypted manner, and when the second capture and mathematical representation are made, the mathematical representations are compared.
Therefore, this is why it is said that the same person accesses both parks."
17. To contract the services, it is indicated in the LEGAL NOTICE on their website, data protection, that the data must be registered as a client. A copy of the form is requested with the
data collected in 2022 when purchasing TT tickets, and if there is a difference with the
data collected now, and the name of the Registry of Processing Activities (RAT) of which this data is included.
In your response, provide a screenshot, indicating that it is the 2022 data form.
"It's the one currently available at SIAM PARK."
The form has the following fields: "(include the contact information of the cardholder who will be making the purchase)", Name, Email, Country, Telephone, Postal Code, and the option to check the box "request invoice"). The footer contains "basic" information about the processing and LORO PARQUE SA's responsibility, including: "administrative management, ticket issuance, and access control to the venues. Accounting and tax management." "Legitimation: for the execution of a contract," and offers additional information in a link.
The footer contains boxes to check if you have read and accept the privacy and purchasing policies, and another to consent to the sending of commercial information.
It adds that this is the same data being requested now. Regarding the RAT, it did not specify its name.
18. Copy of the (RAT) related to the data collected from CUSTOMERS for the
purchase of park access tickets. Indicate whether it includes those of customers who
purchase the TWIN TICKET ticket option, and the remaining non-personally identifiable tickets underlined above, valid in 2022. According to the information The information provided by the respondent on its website includes customer data that is incorporated into files, and is processed on them. Processing is considered to be routine rather than occasional.
It is understood that the circumstances of Article 30.5 of the GDPR are met.
It responded: "Purchase and access are two different processes." The RAT does not provide information on the processing of customer data when purchasing tickets through its websites,
despite reporting that such data will be processed automatically.
19. Regarding REPORT, DOCUMENT TWO, which they submitted in their submissions,
they stated that "The report requested by LORO PARQUE, S.A. concludes, proving that
the digitized data obtained will be kept only while the card or ticket in question is valid, and will be destroyed immediately when it is no longer valid,
thus protecting the privacy and security of users." To this end, they are requested to
report the reference used in their systems to establish that the ticket or card is valid, where that data is stored, who is responsible for it, and what
process is followed to disable access if the ticket is not valid. Who internally establishes the modules to deactivate and prevent access. Also, regarding the digitized data obtained, what data does it refer to and where is it located? Understanding that
there is a relationship with the ticket, please detail what this consists of.
He responded: "The ticket is disabled once it has been read the specified number of times.
In the case of a Twin Ticket, it has two readings, one per park. Therefore, once it has been read twice, it is deactivated, inoperable, and cannot be used again.
The system validates how many times a ticket has been read, and in the case of a Twin Ticket, if it has been read twice and is read a third time, it will issue a used ticket, and access control personnel should not allow the customer to enter with a used ticket."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 24/79
20. Number of customers/users registered on your website when they purchased the TT ticket
in 2022. Please provide the number of people who accessed both parks in 2022 with
the TT. If you don't have data from that year, you can provide it for another year, preferably providing a printout of the medium on which those numbers are displayed or appear.
The applicant responds: "There is no separate accounting from the rest of the tickets."
21. A printed copy of the back of the TWIN TICKET to verify its content, which is the same. The one submitted as DOCUMENT 1 in your allegations does not include the other side.
The applicant responded by providing, on the left side, a rectangular image of the TT, with logos of the two
parks, and below it, the text reads "consult the conditions of use upon entering the parks," including the websites.
22. Please provide information: If you have a TWIN TICKET, does that entity also require printed paper tickets to be carried?
If the first visit with the TT or ANNUAL VISIT card is registered, the date or start date is recorded as the date of ticket purchase upon first entry? How do I mark the
first visit to the park with a TT ticket so that I cannot access it again?
The answer was: "You can carry the Twin Ticket with the associated QR code, either on paper
or on a digital device, such as a mobile phone or a photograph, as long as the QR code can be read properly. The TWIN TICKET is only invalidated when it has been read twice;
until then, it is valid. Once it has been read twice, the ticket is no longer valid.
In the case of an ANNUAL PASS, the ticket is valid for one year, with one entry allowed per
day. After this year, which begins from the date the card is issued, the entry and, consequently, the ANNUAL PASS are no longer valid."
23. FORM used in 2022 and 2023 to register on their website, in order to
purchase the TWIN TICKET offer, the web address where information on data protection was or is currently located.
The website responded that from "2022 until now" the web address is
https://tickets.siampark.net/sereservarEntradas.aspx?opc=21&m=INDIVIDUALTWIN&lg=es-
ES. They only provide a screenshot of the form that appears to fill in the contact information of the cardholder who will make the purchase and basic information on data protection.
Clicking on it takes you to the siampark ticket page, official ticket sales page,
https://tickets.siampark.net/ "buy your TWIN TICKETS in just a few minutes...",
which consists of FOUR STEPS.
1-Select the day and type of tickets you wish to purchase.
2-Select the time you wish to visit.
3-Enter your contact information.
4-Select the payment method.
After selecting the date, the separate ticket drop-down menu will appear: adult, child, or TWIN TICKET child free (ages 0-2), to add the number of tickets. In the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 25/79
information on the image of each ticket "i", clicking on it, you will see the following: "Double your experience: Loro Parque and Siam Park with a single ticket and save 10 euros.
You have six months to visit Siam Park from the date of your visit to Loro Parque."
When you select the day/continue, each park will display, first, Loro Parque, a "select the time you want to visit us" time slot that cannot be changed, and then the "Go to step 3" indicator. Clicking on this will display the "contact information of the cardholder who will make the purchase" form, with name, email, country, postal code, and telephone number as required information. Below is "basic information on data protection,"
highlighting "legitimacy by execution of a contract," and purpose: "administrative management.
Issuing tickets and controlling access to the venues." Additional and detailed information on data protection appears to click on "this link."
It ends with the two boxes to accept and check "I have read and accept the privacy and purchase policies," and to consent to the sending of commercial information.
If you click on the link with additional and detailed information, it takes you to another siampark page,
with information, which includes, within "General conditions of sale and services,"
the section: "f) Data protection policy:
"For the information of our customers, we inform you that the tickets called
TWIN TICKET, SECOND VISITS, IN PARK, ANNUAL CARDS, are bearer tickets, and do not identify the holder or owner. Therefore, to link the tickets With the purchaser, a verification system has been established by obtaining details that form a mathematical representation that is not a fingerprint of the purchaser. This representation does not serve to identify any individual, and has no other purpose than to verify that the person who benefited from a promotional offer is the person using the purchased product. It is also impossible to subsequently link the mathematical representation to the user who purchased our commercial product.
This is recorded in the access diligence dated 08/14/2024.
It also indicates that from "2023 until now"
Website address - https://www.loroparque.com/ticketsonline/es/paso0 Select the "TWIN TICKET" option
The result, if you access the TWIN TICKET ticket purchase option, is the same as if you accessed the Siampark ticket page regarding the types of tickets offered and how to complete the form.
In the privacy policy section, if clicked, it appears under the heading "privacy policy." It should be noted:
- The interested party (user) who provides "LORO PARQUE, S.A." with personal data through social networks or online platforms is informed that the data controller for the personal data they provide will be: "LORO
PARQUE, S.A."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 26/79
- As the data controller, "LORO PARQUE, S.A." will expressly request
the user's authorization to follow this privacy policy.
(…)
7”VIII- AT WHAT AGE CAN THE USER ACCESS OUR
PRODUCTS AND SERVICES?
As a general rule, and as established in Article 8 of the new General Data Protection Regulation, when Article 6, paragraph 1, letter a) applies in relation to the direct offer of information society services to children, the processing of a child's personal data will be considered lawful when the child is at least 16 years old. If the child is under 16 years old, such processing will only be considered lawful if consent was given or authorized by the holder of parental authority or guardianship over the child, and only to the extent that it was given or authorized.
24. Please indicate the period of time since fingerprint collection has been used for access with TT tickets and any other period that entails this type of access.
The respondent responded that “no.” We keep a record of the changes made to the
web pages."
25. In their comments regarding the initial agreement, they indicated that:
"The request for an identification document is only made for the purpose of determining
resident status or not, based on the price difference. "The identification is never stored, nor is it related to the entry." To this end, they are asked to indicate whether this is
applicable to all entries, including TTs, and what documents they use to verify the
identity of the person and whether their systems carry out any verification of said
check.
He responded that: "TWIN TICKETS can be purchased at authorized points of sale
(hotels, travel agencies, kiosks). These would be points of sale (only a QR code is sold). The customer then uses the TWIN TICKETS, using the verification system referred to in this procedure, to access the parks. This also applies to TWIN TICKETS and all tickets labeled "RESIDENT." The customer is asked to show their ID or registration certificate, and if they reside in the Canary Islands, they are entitled to the
resident discount. No system is used, only the physical and visual verification of this information on the documentation provided. The person's identity is not verified, but rather their
place of residence. If they reside in the Canary Islands, the established resident discount may be applied."
26. If available, please provide an analysis of the necessity and proportionality of the system for using biometric data/fingerprints that recommends the use of said system, how long it has been in use, and an analysis of the risks of processing personal data.
The court responded: "They are not applicable to the system described, because biometric data or fingerprints are not collected."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 27/79
27. Report on the different methods of acquiring TTs outside the defendant's website.
Where can they be acquired?
And whether the data requested by these third parties authorized for such sale is the same as that on the defendant's own website.
Claimant 2 provides a copy of the "TWIN TICKET" supplement vouchers on the
body of the boat tickets, which show the names and surnames,
tracking codes: the same for all four tickets, (...), ticket number: (the same number for all
four tickets, (...) to (...), sequentially followed), and NIF/NIE/resident card for two adults
and NIF for two infants, expiration date with reference to the boarding/journey date: Gran Canaria/Tenerife, and barcodes on each ticket, stating that they purchased them
from the FRED.OLSEN Express shipping company, "since they are offered to all those who purchase tickets to
Tenerife." The respondent is asked why these tickets include all the
data of the attendees and whether they were incorporated into that entity's customer file?
He responded: "In these cases, the client for Loro Parque is the Agency, not the end customer
with whom the Agency works. This is further proof that the purchasing processes are separate.
In this case, the buyer is the Agency, and in this case, the person accessing the process is the Agency's end customer.
Regarding the case described, the data you store (...) is your business.
As far as LORO PARQUE SA is concerned, the data stored is the data
you provide (...) and we send you the tickets you request to purchase, no more, no less.
Then, those tickets, which have a QR code, are validated at the access control, simply by
checking whether they are valid or not, regardless of the person who purchased them or whether they
arrived by boat, plane, or on foot. In the event that these tickets (...) have requested to purchase a Twin Ticket, your end customers will have received the QR codes, which will be read at the access control. It will be detected that it is a Twin Ticket, they will be asked to read the details, a mathematical representation will be generated in encrypted form, and then
on their second reading of said QR code, the same will be done, and if both representations match 95%, they will be allowed access with that Twin Ticket.
28. Explain what you mean in your arguments when you state, only regarding the underlined information:
"The tickets generate a QR code, and the sensors on which customers place their fingers, using a sophisticated software system provided by an external company
specialized in the field, directly generate a mathematical representation." (You are asked to indicate whether this representation is the biometric template,
and whether it refers to the first entry or access or the second visit or access with TT).
You responded that "It is not a biometric template, it is a mathematical representation. A Twin Ticket has two access points, and the capture of minutiae, the encrypted generation of a mathematical representation, is generated in readings 1 and 2, but in the second reading, a comparison is made between both mathematical representations, and if they have a similarity greater than 95%, access is granted."
29.- In ANNEX 4, which was extracted in previous actions, for the online ticket purchase, the information provided included purpose, ticket issuance, and access control to the venues. Although they indicate that the ticket is not personal, please clarify this information and provide a copy of this current form with the same boxes for entering the data and information that currently exists.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 28/79
The response was: "They are two different processes: Purchase, where one transaction is made. of
ticket purchases that have QR codes associated with them that grant access to the venues. Access, the procedure for reading the aforementioned QR codes. However, the
participants in both processes do not necessarily have to be the same people, therefore, there is no
relationship between the purchase data and the access data.
ELEVENTH: Allegations of the respondent in his written response to the taking of evidence.
The respondent, along with his response in evidence, makes the following allegations:
1. In the final section of the initiation agreement of 2/10/2023, it is stated that the duration of the procedure is 9 months from the date of the initiation agreement. Therefore, he considers that the file has expired as of 2/07/2024, as determined by Article 64.2, paragraph five, of the LOPDGDD, and with the effects of dismissal provided for in Article 25.1.b)
of the LPACAP.
2. Nullity of the procedure, due to violation of the principle of liability (Article 28.1 of the LRJSP), considering that it occurs due to the request for various documents and information in evidence, which would demonstrate that there was insufficient prior knowledge to impute any fault to this party. First, it alleges an unlawful act without sufficient evidence, and then opens a probative period without addressing the allegations made in the prior phase, in response to the
initiation agreement: "to provide documents, clarifications, and new statements that attempt to demonstrate the guilt of LORO PARQUE, S.A. This implies that the burden of proof of the alleged acts is being placed on the investigated administrator and not on the investigating administration."
"The defendant cannot be sanctioned as there is no evidence of an administrative offense in the management of the TWIN TICKET, either intentionally or negligently. The
respondent adopted all means at its disposal to ensure that it did not obtain personal data
from any of the customers who use said product."
TWELFTH: Sending of a proposed resolution.
On 6/09/2024, a proposed resolution was sent to the respondent, with the following:
"FIRST: That the Director of the Spanish Data Protection Agency sanction LORO PARQUE, S.A., with NIF A38009023, for a violation of Article 9 of the GDPR, classified in Article 83.5 a) of the GDPR, and classified as very serious for the sole purpose of
expiring said violation, in Article 72.1.e) of the LOPDGDD, with a fine of 250,000 euros,
SECOND: That the Director of the Spanish Data Protection Agency order LORO PARQUE, S.A., with Tax Identification Number (NIF) A38009023, pursuant to Article 58.2.f) of the GDPR, that within 30 days of the resolution terminating this procedure becoming enforceable, it must prove that it has complied with the measure set forth in the VI legal grounds, specifically the prohibition of data processing analyzed.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 29/79
THIRTEENTH: Objections to the proposed resolution.
On September 23, 2024, objections were received from the respondent, in which it states:
1- Reiterates that
-“the AEPD considers that the system used by LORO PARQUE, S.A. It allows people to be identified
through fingerprints, which is erroneous."
- "The AEPD considers that the mathematical representation of a fingerprint is personal data,
which cannot be considered true, because the mathematical representation does not allow for a reverse path to the client's fingerprint and, therefore, to their identification ("reverse engineering" is not possible). The mathematical representation of the fingerprint tells us
nothing about the client."
- "Since the AEPD has not proven the respondent's claim that it is not possible
to reverse the process used in such a way that, in the end, the owner of the details that formed the mathematical representation can be identified, it cannot be classified as erroneous."
-“At no time are customers' fingerprints recorded, nor, logically, are they stored. Furthermore, the system used is not reversible, making it impossible to reconstruct, through a reverse procedure, a complete fingerprint that would allow the owner to be identified. If this is the case, which it is, and the AEPD has not proven otherwise, the GDPR and the LOPDGDD cannot be applied to us.”
-“The mathematical representation of the fingerprint, which is the only thing LORO PARQUE, S.A. obtains, does not provide us with any personal data about any person, so it is impossible to obtain identifying data about the person.”
-“It should therefore be considered that if a mathematical representation of the fingerprint is used to verify that the person entering one park with the TWIN TICKET offer is the same person entering the second park, which cannot be used to identify the customer because it does not provide any personal data, none of the personal data protected by the GDPR, art.4.1”
- “The manufacturer of the devices that ultimately obtain the mathematical representation,
***EMPRESA.2, assures us that they do not work with fingerprints, but with mathematical representations of the original fingerprint, and that, during the verification process, the system does not compare fingerprint images, but rather "minutiae clouds" that, when compared with each other, generate a score. When the score
exceeds a certain threshold, it is assumed that the two templates come from the same finger,
but it never allows us to identify who the finger in question belonged to. Therefore, under
no circumstances can these templates be considered personal data for the purposes
of the GDPR, and they are excluded from the scope of the GDPR.”
- “According to ***EMPRESA.2, the process of extracting minutiae from fingerprint images is explained, and how biometric comparisons do not use the image itself during their execution.”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 30/79
2-LORO PARQUE, "seeking access control for its TWIN TICKET product,
requests external companies to provide it with a computer system that allows for its
correct management with full guarantees for the rights of those who access the
parks. LORO PARQUE, S.A., is merely a client of the companies that provide the
access control services. Indeed, as stated in the administrative file, ***COMPANY.3 provided us with the software and ***COMPANY.2, the
hardware necessary for this. We were assured, because that was our idea, that with their systems, there was no possibility of obtaining any personal data from clients regarding access control, and that the automated process would not provide us with the clients' digital fingerprint, but rather a mathematical representation, which prevented us from relating it to the details obtained and, therefore, to the original fingerprint. Furthermore, it was an irreversible procedure, meaning it did not allow us to identify our clients, taking the reverse path with the final result of the process. If there is no personal data, as we have already proven, LORO PARQUE, S.A. cannot be held responsible for any infringement, according to the AEPD (Spanish Data Protection Agency) by reference to the GDPR and the LOPDGDD (Spanish Data Protection Act).
"By not using their system to contain any personal data and attempting to apply data protection legislation, the principles of criminality and legality provided for in Law 40/2015 of 1/10 are being violated."
“The AEPD uses concepts that are not defined in data protection regulations, such as “biometric template,” thereby violating the principle of typicality and resorting to definitions contained in Opinions and Guidelines that are not expressly included in the sanctioning regulations.”
3- "The mathematical codes do not identify people, as we have proven with the technical reports provided. They only record the validity of the tickets and the QR codes associated with them. There are no mechanisms that allow data to be associated with a person, even if they are, in principle, beyond the reach of the person holding that data. Not even with the help of third parties can the people whose data is being processed be reasonably identified."
4- "LORO PARQUE, S.A., simply creates two QR codes, unrelated to any personal data that would identify their users, and using a complex software system provided by an external company that prevents a complete fingerprint from being determined using the inverse process, starting from the details of the prints (not the fingerprints)."
5- “LORO PAROUE, S.A., in any case, does not store personal data, does not store fingerprints, and does not provide any personal information, any personal data of the client, to the service providers, and, therefore, is not violating Article 9 of the GDPR, or, at least, is adopting the necessary technical precautions to do so.”
6- “We have proven, unlike the AEPD, that the system contracted by LORO PARQUE, S.A. For access control to parks using TT-type tickets, they carry out two parallel procedures that do not overlap at any point: the sales process (which is not the subject of this procedure) and the access process (which the AEPD does not prove violates any provision of the legislation applicable to the matter).
"At no point in our systems are the purchasing processes crossed with the template verification. That is, the sales data is not "matched" with the generated template. They are two distinct processes. One is the sales process and the other is the access process, which, as can be seen (the AEPD did not do this), are not linked to each other.
Thus, a person, for example, can buy two tickets and give them to two different people so that access the parks, hence, the sales data has nothing to do with access. It may also be the case that a person purchases three tickets and only one is for them. In this case, the only sales data would refer to a person, which does not identify them, even if they enter their name and email address in the purchase process. This being the case shows that the purchase and access data do not
cross over, since there is no data on the other two people, other than the purchaser, who use the tickets. These are two different processes (Sale and Access) and the data is not linked, so that even if the online purchaser purchases a single TT ticket for themselves, they would not be fully identified.
7- "It only seeks to obtain an argument that allows them to sanction, without any evidence, a
company that, with the access system, does not use any biological data that would allow
the customer to be identified, nor to know anything else about them, since the data Saved, abstracted from
any other consideration, they do not identify individuals, but rather anonymous users of a
commercial product, at a discounted price and voluntarily acquired. Neither LORO PARQUE, S.A.,
nor the collaborating companies: ***COMPANY.3, and ***COMPANY.2, can, by themselves,
or through third parties involved, access personal data that would allow the identification of
any person, since mathematical representations cannot be reversed
until a fingerprint is obtained, which, as such, would allow the identification of its owner."
8- "Neither LORO PARQUE, S.A., nor its collaborating companies, obtain the client's fingerprint, which, being unique and distinct for each person, would allow the application of the legislation that regulates personal data and, among them, biometric data, to the process. However, as stated, at no time are the clients' fingerprints recorded, nor, logically, are they
stored, being, for 10 Furthermore, the system used is not reversible, not allowing, through a reverse procedure, the reconstruction of a complete digital fingerprint that would allow the identification of its owner. If this is the case, which it is, and the AEPD has not proven otherwise, the GDPR and the LOPDGDD cannot be applied to us.” According to the European Commission at
https://commission.europea.eu/law/law-topic/data-protection/reform/what-personaldata-es
(Provided as document number THREE), in response to the question WHAT IS PERSONAL DATA?
it provides the following answer: "Personal data is any
information relating to an identified or identifiable living natural person. The various pieces of information, which when collected can lead to the identification of a specific person, also constitute personal data."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 32/79
-“There is no evidence to determine that The system used by LORO PARQUE, S.A.,
stores the entire customer fingerprint; that the TT purchase data can be linked
to the database generated to verify the access of TT card users."
9-The respondent states that the AEPD makes statements lacking any evidence or
mere hypotheses, such as:
- On pages 50/67, which indicates that "it could be the case that other
entities that use a standard sample collection system like the respondent's, could have templates generated with the same algorithm, also associating the
template with the identity of the individuals, which would also be processing personal data, as it could be identifiable."
- "On pages 49/67: Given that the validity of this type of ticket is for a period,
which the respondent may establish in the offer itself, it is recognized as 15 days, 6 months, or
annually. The The respondent has the technical means with the contracted software that would allow the
identification and identifiability of the person who has accessed the first time and will access the second time, and even after the validity period of the entry has expired."
-"On pages 50/67: All of this, without losing sight of the fact that this is a very intrusive system for the fundamental rights and freedoms of natural persons, among other
circumstances due to its operation through artificial intelligence systems that
implement algorithms to design and read the biometric template, in relation to the
deficiency in the manufacturing standards of approved and certified systems of the
software in use, added to the extension and interoperability of use of these systems,"
the respondent considers that a qualification of the system is made that does not correspond
with its own, and no complaints have been received for security reasons."
-"On pages 51/67: It should be noted that any loss of the qualities of integrity,
confidentiality and availability with respect to the databases where the templates are stored would be clearly detrimental to any future application based on the information contained in such databases, and would also cause irreparable harm to the data subjects, including minors. For example, if the fingerprints of an authorized person were associated with the identity of an unauthorized person, the latter could access the services provided by the owner of the fingerprints without having the right to do so. The result would be identity theft, which would make the person's fingerprints unreliable for future applications and, consequently, restrict their freedom.
10- Reiterates the claim that, since the initiation agreement signed on 2/10/2023 states that the
procedure has a duration of nine months, the file must be closed due to expiration because no resolution has been issued within that period, in accordance with Article 25.1.b) of the LPACAP.
11- Nullity of the sanctioning procedure, "because it was issued in complete and absolute disregard of the legally established procedure, in accordance with Article 47.2 of
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 33/79
the LPACAP," "for not summoning to the file all those whom the AEPD has considered responsible for the violations referred to in its proposed resolution of the sanctioning procedure." When reproducing Article 70 of the LOPDGDD, the data processors are cited, "lacking the joint liability of ***COMPANY.3"
12- "The arguments maintained by the AEPD to impose the total prohibition established in the SECOND point of the resolution proposal are challenged for the same reasons set forth throughout its allegations."
13- "We have proven that we have adopted all means at our disposal to ensure that we do not have any personal data of our TT clients in access control to the parks, so we consider that we cannot speak of a "serious lack of diligence."
The aggravating circumstance of Article 83.2.b) of the GDPR is considered lacking in evidence; on the contrary, it has been proven that the defendant "outsourced an access control system to its parks with TT entrances that complies with the GDPR and the LOPDGDD."
14-It considers that the claim that data from minors is collected does not take into account, as proven, that the system contracted by LORO PARQUE to control access to the parks using TT-type tickets involves two parallel procedures that do not overlap at any point: the sales process and the access process. It also states that with its TT-type access system, it is impossible to determine the age of the ticket user.
"The AEPD's constant statements that the system provided by companies external to LORO PARQUE, S.A. affects minors are abusive and unjustified, when we have already proven to the Agency that personal data that has been anonymized, so that the person is not identifiable or is no longer identifiable, will no longer be considered personal data. For the data to be considered truly anonymous, the anonymization must be irreversible."
15-It adds that "LORO PARQUE, since September 18 of this year, has
replaced the access control system for TWIN TICKET, referred to in this procedure." "enabled a new access control system to the parks to replace the system referred to in this sanctioning procedure." "This is a new access control system that has required a significant, lengthy, and costly technical modification, which could not be implemented overnight."
PROVEN FACTS
FIRST: The defendant, as stated on the "Monitoriza business" website, has as its corporate purpose: Activities of amusement parks and theme parks, incorporated on
May 30, 1972, with a share capital of (...) euros, with sales of (...) euros in 2021, the last fiscal year filed.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 34/79
SECOND: The three claimants, on August 7 and September 13, 2022, filed a claim against the First, on 09/16/2022, the second, and on 11/3/2022, the third, that when purchasing tickets for joint access to
LORO PARQUE (zoo park) and SIAM PARK (water activities park) in Tenerife, with the offer called TWIN TICKET, TT, managed by the respondent, the fingerprint must be provided for access, even for minors, without being informed
when the ticket is purchased.
THIRD: In prior proceedings, as of 08/17/2023, on the respondent's website https://www.
loroparque.com/aviso-legal/, there was a "data protection policy" section, which
informed: "The user and/or consumer, in order to contract the different services offered by
LORO PARQUE SA, as well as to receive newsletters from the park,
must register the requested data as a client." The user hereby expressly authorizes LORO PARQUE to include in an automated file the personal data contained in the form fields as necessary for the proper provision of its services, in order to manage the purchases and requests made by the user through the websites, and so that LORO PARQUE can provide the services offered and accepted by you. Likewise, you are informed that tickets are sent through the user area on the platform and/or by email, as they are a virtual product in PDF format.
Similar information is contained on the aforementioned date at https://www.loroparque.com/terminos-y-condiciones/, https://www.loroparque.com/privacidad/
There is no information regarding the use of biometric techniques for access to LORO PARQUE and SIAM PARK parks with the TT ticket.
On 8/07/2024, accessing The testing period for the website
https://www.loroparque.com/terminos-y-condiciones/ contains a warning that, as of the date of the
complaint, was not proven to exist, along the following lines:
"TWIN TICKET tickets, among others, are bearer tickets, and do not identify the holder or owner thereof. Therefore, to link the tickets to the purchaser, a verification system has been established by obtaining detailed information..., with no other purpose than to verify that the person who benefited from a promotional offer is the person who used the purchased product, and without making it possible to subsequently link the mathematical representation with the user who purchased our commercial product.
The respondent does not prove, by not responding to the tests since the date it included this "verification by obtaining detailed information."
FOURTH: The respondent reported that the special offer for users of its parks: (one of them for residents of the Islands or with a price reduction) LORO PARQUE and SIAM PARK,
called TWIN TICKET (TT), consists of allowing the user of either park (regardless of age) to visit the other at a discounted price as a
NON-PUBLIC, bearer-identified ticket, the same as the tickets called "SECOND VISITS, IN-PARK, and ANNUAL CARDS," as acknowledged in evidence and as stated on
07/08/2024 in the screenshot of the loroparque.com website,
https://www.loroparque.com/terminos-y-condiciones/, in section f.- DATA PROTECTION POLICY, within section II "General conditions of sale and services.
For the access system, with these tickets, which include TT, technology control is
used. Biometric fingerprint-based, so that the same person who accesses the first park also accesses the second."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 35/79
In its submissions to the initial agreement, the defendant submitted the "conditions" of the TT in a form stating that it may only be used by one person, and that under no circumstances may visits to both parks be made by different people. It sets the period for visiting the second park at SIX MONTHS from the date of the visit to the first, but a different period can be set, possibly up to fifteen days.
During the testing period, the respondent reported that TT tickets can also be purchased not only online on its website, but also in person at the ticket office, kiosks, hotels, or through third-party channels such as tour operators or agencies with which agreements have been signed.
FIFTH: When accessing one of the respondent's OFFICIAL websites for the online purchase of TT tickets, it was verified on August 30, 2023, in preliminary investigations,
that at the address https://tickets.loroparque.com/reservarEntradas.aspx?
opc=20&m=INDIVIDUALTWIN&Ig=es-ES/, FOUR steps must be completed. Step 1 begins with the selection of the number of tickets: adults (over 11 years old), children (3 to 11 years old), free (0 to 2 years old). In step 2, you choose the day and time you would like to visit each park. In step 3, you enter the contact information of the person purchasing the tickets. A form appears: NAME, EMAIL, PHONE NUMBER, COUNTRY, POSTAL CODE, with basic information about data processing, the responsibility of LORO PARQUE, and the purpose: administrative management, ticket issuance, and access control to the parks. Accounting and tax management. Legal basis: through the execution of a contract, with additional information in a link, a box to request an invoice, and ending with two boxes to check: one for "I have read and accept the privacy and purchasing policies," and another for consent to receive commercial information. Finally, in step 4, you select the payment method, which is made through a secure payment gateway with a bank, and the tickets are sent to the indicated email address in PDF format.
However, as of the date of the alleged events, the defendant acknowledges, and also during the evidentiary period, that the web address where TT tickets were purchased in 2022 (and still exists) was https://tickets.siampark.net/sereservarEntradas.aspx?
opc=21&m=INDIVIDUALTWIN&lg=es-ES, using the same purchasing procedure.
The defendant adds that TT tickets, from "2023 to the present," could also be purchased at the web address https://www.loroparque.com/ticketsonline/es/paso0. Select the TWIN TICKET option.
In either case, the data and information to be entered to purchase tickets are similar.
The respondent does not provide a copy of the Record of Processing Activities for this data
which are completed (forms) at the THREE websites cited for the purchase of tickets by the purchasers, including those from the TT, and which the respondent itself informs them
that they are part of a file, as stated in point 17 of the evidence collection.
SIXTH: The respondent stated in its allegations to the initiation agreement that, upon entering the
first park, each user is given an envelope containing a "ticket/cardboard," and from the copy
of which it is evident that it is different from the online TT ticket purchased on the website, taking into account
that the format of the online ticket purchased on the respondent's TT website is
in PDF format, and is sent to the email address provided during the registration and ticket purchase process.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 36/79
The ticket card provided, although it does not identify its origin, could be from a ticket purchased at the box office, not ONLINE. In this case, the respondent reported that "no information is requested from the purchaser."
The ticket card provided must be kept and must also be presented upon the second visit.
The ticket contains:
- a serial number,
- LORO PARQUE, date and time of entry,
- a QR code underneath,
- the information that the ticket is non-refundable, valid for 15 days, and non-transferable.
The respondent also reported that all tickets, including the TT,
generate a QR code. This same point is confirmed in the Manual provided by the
complaint document 3 in testing, regarding contracted ticket and access management software.
When the ticket is purchased online, "in the case of confirmation, an email is automatically sent to the customer with the purchase details, including a QR code that they will use to directly access the purchased visit or activity."
According to the complaint, all tickets purchased online, including TT tickets, as well as the aforementioned ticket/card, must be entered into the physical access sensors of the park software enabled for this purpose, using the QR code reading. If it detects that it is a TT ticket, it then requests the fingerprint, including the index finger, whether it is the first or second access, on the fingerprint reader sensor/terminal.
Both the ticket reservation and sales software system and fingerprinting are
managed by the respondent's contractor, ***COMPANY.3 ("with the appropriate reading peripherals incorporated into the access devices, the ***COMPANY.3 System
supports the incorporation of RFID card and wristband reading systems, as well as the validation of biometric parameters, such as fingerprints and facial recognition
", contained in section 2.2 of the Manual, document 3, point 6 of evidence). Furthermore, the respondent
acknowledged that it has no alternative system established for access to biometric registration
for access, requiring that entry be paid for, even for minors from the age of 3.
The QR code is different for each ticket and is generated with the transaction number, ticket number, and purchase tracking number.
Aside from other information that the aforementioned QR code may contain, the defendant indicates
about it that:
- It is generated with the transaction number, ticket number, purchase tracking number,
it can be carried on paper, or on mobile, digital, or photographic media,
- It is never generated with data supplied by the buyer, and,
- Its purpose is to allow and validate access to purchased tickets, detecting that it is a TT
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 37/79
Furthermore, in accordance with the Ticket Sales Management and Access Control Manual of the
software contract with ***EMPRESA.3, all online sales or reservation transactions
generate a tracking number, and with their ticket software systems, they can check whether a
tracker or ticket has been accessed through a specific access point to a specific center (section 2.1.1.7 Request for Visitor data: nominate tickets, to have control over who visits).
According to the respondent's evidence, the entire ticketing solution derived from the sale of tickets for park access is stored in a Microsoft SQL database, containing all the data necessary for the sale and access to the parks, including the ticket purchase data.
If the person who purchases the TT tickets online is the one who enters the park, a normal occurrence that does not require proof, it is proven that they have registered their personal data in the respondent's systems by obtaining a PDF ticket that is sent to their email. The ticket sales system associates a QR code and a tracking number with their ticket. Furthermore, the ticket purchased usually has the first visit pre-arranged and scheduled for a specific day and time, or for both parks (the ticket's validity can be scheduled for a second visit, for example, 15 days or 6 months, or for a year for an annual pass, depending on the offer). The claimant's sales and access management system, contracted with ***EMPRESA.3, has generated these codes assigned to the purchaser's ticket, and the same system stores the QR codes by reading them and then taking their fingerprints.
For the purchaser's access to the parks, the purchaser can then be perfectly identified, as the tickets can be linked, as the claimant has access to their personal data, information, and mechanisms that make it possible to link the fingerprints with their name, phone number, country, postal code, email address, and, if billing is requested, with additional information, allowing them to identify who they are.
The ticket is disabled (no longer valid) once it has been read the specified number of times.
In the case of a Twin Ticket, it has two readings, one per park. Therefore,
once it has been read twice, it is deactivated, inoperable, and cannot be used again. The third reading does not initiate the collection process.
The system validates how many times a ticket has been read, and in the case of a TT, if it has been read twice and is read a third time, it will declare a used ticket, and access control personnel should not allow the customer to enter with a used ticket.
SEVENTH: The respondent has signed a contract with ***COMPANY.3 for the provision of consulting, installation, and maintenance of a ticket sales and reservation system,
access control, and park activities, which includes a software license, dated
07/13/2020, for the operation of the platform.
In the annex to the ticket sales and access management contract between the respondent and ***COMPANY.3, document 3 of point 6, regarding testing, the characteristics of this platform, managed by ***COMPANY.3, are set out in a reference manual. Among other things, it indicates:
The various devices that can be used for access control and with which the ticket reservation and access system is capable of working share a common database for ticket validation, where you can configure what should be taken into account when
allowing or denying entry: schedule, single or multiple access points, validity during a range of dates, etc.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 38/79
As access control options, the contract with ***COMPANY.3 mentions, among others, turnstiles, a lectern with a reading unit, a PDA, and the option to verify access after the first visit using a biometric system (fingerprint or facial recognition) (with the appropriate reading peripherals incorporated into the access devices) (or identification by DNI or passport using an OCR system).
Furthermore, for first-time access, users can use the appropriate reading peripherals installed in the access devices where they are installed to validate access not only with the aforementioned biometric data, but also with RFID cards and wristbands.
Section 2.3 of Document 3 states that the "system is multi-capacity and multi-venue, allowing the sale and issuance of different products (tickets, vouchers, promotions, season tickets) with the possibility of multiple accesses to one or more of the Group's Parks, depending on the characteristics defined at the time of defining the product. As detailed in the previous section on Access Control, accesses after the first visit can be verified using a biometric system (fingerprint or facial recognition) or identification using an ID or passport."
"The information obtained at the time of access is stored in the database with all the information structured in such a way that it can be linked to all information related to the corresponding sale, reservation, subscriber, etc. This way, full traceability of operations is achieved. (2.2. Access control (...), document 3, provided in testing, entitled "Ticket sales and reservation solution, access control, and activities. Proposed scope phase 1", point 6. Section 3 "Reporting applications
(...)" of the aforementioned document 3 indicates that the system has tools that allow for complete tracking of the activities and events created in the system from their registration until their completion, including a breakdown of the traceability of the operations performed on each of the tickets and venues involved from their reservation until they entered the center.
Similarly, the manual states in section 2.1.1.7 "Request for visitor data: nominate tickets" that "in some cases, the products purchased must be nominated
to have control over who makes the visit," and the data can be saved. Section 2.1.1.9 Additional Features indicates that at the end of the sale, "visitor data can be captured so that the sale is associated with a visitor, even if they are not registered."
In the billing window, data capture 2.1.1.10, the registered customer's NIF and address must be completed, or the invoice can be changed to a visitor other than the registered customer.
According to ***EMPRESA.3, the encryption key for the captured details is stored
in the sensor's internal memory. The same entity claims that the encrypted fingerprint can be read by the device manufacturer, who would make it readable. The encoded data of the template of each user who accesses the parks is stored in the respondent's systems.
The respondent stated that it captures the details (ten fingerprint matching points) with a camera (...) and its automatic encryption on said device generates a mathematical representation that is stored on LORO
PARQUE SA's computer equipment, (...) and whose use is (...). In the only physical location where this data is stored in the technological infrastructure of Loro Parque SA, both in its (...).
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 39/79
During the validity period of the TT, each ticket carries a tracking number and a QR code, including those not purchased online. During this period of validity, the ticket containing the QR code must be kept, which must be presented at each entry to the
device, along with the fingerprint.
The ticket and access sales system contracted with the company ***COMPANY.3
incorporates a fingerprint biometric parameter validation system branded
***COMPANY.1, model ***DEVICE.1, supplied by the company ***COMPANY.2."
Document 3 submitted by the respondent, regarding phase 1 of the implementation of the ticket and access reservation system, annexed to the contract (installation and commissioning),
contains a wide variety of functionalities, indicating that all tickets
generate a tracking number that can be tracked and verified whether the holder has entered and
where.
Furthermore, the system validates the reading of barcodes and QR codes issued by the different
sales platforms. Section 2.2 "Access control" indicates that:
"In the case of nominating visitors on each of the tickets, vouchers,
promotions, etc. issued at the time of sale or reservation, the visitor's identity can be verified at
the access point by reading the OCR code on the
ID document or passport.
The information obtained at the time of access is stored in the database with all the
information structured in such a way that it can be linked to all information related
to the corresponding sale, reservation, subscriber, etc. This provides complete
traceability of the operations.
All codes will follow the same coding scheme, which includes different data
to perform the configured validations and security digits to verify
that the code belongs to the system.
The validations that an access control performs depend on the type of control associated with the
ticket entry type. Thus, by configuring two different types of control, it could be
so that the "VIP Invitation" entry type for a visit would not control the access time,
while a "General" entry would and would not be able to access until the session was
close to its start.
The control types can be configured, for example, so that the ticket is granted access on a day for which it was reserved, within a time range, a range of valid access dates, or without access, which would be configured to prevent improper use of a product.
According to the respondent's recognition in evidence, it indicated that all types of non-personally identifiable tickets, including TT tickets, are managed through the system contracted with the company ***COMPANY.3.
EIGHTH: It is confirmed that, for the purposes of data protection regulations, the respondent is considered the data controller for the data collected for the sale of tickets to the parks through the use of the TT offer, particularly with the online sale of such tickets on its websites. This establishes the personal data that must be provided in the data registration form for ticket purchases that it incorporates into its systems as the data controller, as well as for the system.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 40/79
selected for the collection of biometric fingerprint samples for access to its parks, specifically LORO PARQUE and SIAM PARK, mechanisms implemented through the contracted external company, ***EMPRESA.3, acting on behalf of the respondent.
The entity that manages the biometric recognition system with fingerprint reading for the parks dependent on Loro Parque is the external company ***EMPRESA.3, under a contract dated July 13, 2020, which is included in the broader (supplies) "ticket sales and reservation service, access control," and
includes an advisory system, as well as the comprehensive installation of the software works and licenses, and commissioning, included in the document "ticket sales and reservation solution - access and activity control." and its maintenance." These services would include booking tickets for clients, payment, invoicing, and issues related to the platform whose software it manages. Of particular note is the first clause, which states that "***COMPANY.3 has the necessary and sufficient human and technical resources for the proper provision of the supplies covered by this contract, depending on the personnel hired by ***COMPANY.3, and it is stipulated that "***COMPANY.3's activities must be carried out with due diligence, taking into account, where appropriate, the user public and the workers or employees of LORO PARQUE
OR ITS GROUP OF COMPANIES."
Thus, it is established that this company is the one that performs, on behalf of the respondent, not only the fingerprint capture that is converted into a mathematical representation or biometric template,
encrypted in its systems, which is proven to be personal biometric data,
but also the management of the entries and accesses that they grant and contain,
through its online platform. Therefore, it can be considered that it performs data processing functions on behalf of the data controller, the respondent.
NINTH: The fingerprint reader (one index finger) used by the defendant was purchased from ***COMPANY.2, a company that manufactures and creates biometric systems based on the ***DEVICE.1 software (...) technology of ***COMPANY.1. Its Manual explains that it is a sensor that, upon capturing a fingerprint, can encrypt it at the same time, capturing the minutiae (image) of a fingerprint using the ***DEVICE.1 device. The Manual describes how fingerprint registration works, following a step-by-step process based first on image acquisition (3.2.1 manual, doc 4), and then image processing, which culminates in the production of a "list of minutiae (points on the fingerprint) - a biometric template - which is a mathematical representation of the original fingerprint." "The template is used during the matching process to compare it against previously stored templates." (3.2.2 of the manual, image processing and detection characteristics), either in a database or on a card (3.2.3. matching).
The respondent added that:
- its biometric system is based on a "mechanism that, through ten fingerprint matching points" that are "stored," "verifies, regardless of age, that the person who used the LORO PARQUE ticket is the same person who used the SIAM PARK ticket (or vice versa)."
The "retention is limited to the time necessary to identify the visitor." "The fingerprint data will be kept only while the card or ticket in question is valid, and will be destroyed immediately when it is no longer valid, thus protecting the privacy and security of users." The details of the fingerprint in the form of a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 41/79
mathematical representation (biometric template) are stored encrypted in a database belonging to the respondent.
The respondent stated that, despite the encryption of the biometric template, the decryption key is held by the device manufacturer.
TENTH: Regarding tickets purchased through an Agency, such as in the case of
complainant 2, through the ship, (...), the respondent states that in these cases its client is said Agency, not the end customer for whom the Agency purchases the tickets. The tickets for Claimant 2 and her family members contained four tickets, their first and last names, tracking numbers: the same for all four tickets, (...), ticket number: (the same number
for all four tickets, (...) to (...), consecutively), and NIF/NIE/resident card numbers for two adults and NIF numbers for two infants, and barcodes on each ticket. The Respondent states that she does not collect the first and last names of those who will use the tickets; this is a matter for the Agency, but that the data provided by the Agency is stored in her systems. In this specific case, from the Respondent's account, it is certainly unknown whether the Agency assigned the ticket names and identification and the remaining data to the users after purchasing the tickets from the Respondent, or how the Agency proceeded when requesting these tickets.
ELEVENTH: When the respondent was asked to provide the number of customers registered on its website
who provided their information for the purchase of TTs in 2022, as well as the number of people who
accessed the two parks in 2022 with the TT, despite having the aforementioned ticketing software that would facilitate the response and carry out said count, it responded that: "There is no separate accounting
regarding the rest of the tickets."
TWELFTH: Regarding whether the respondent considered any professional or technical report or opinion that analyzed the use of the biometric system to verify that the
second access to the parks with the TT was made by the same person as the first access, or whether it had analyzed alternatives to the system in this regard, and their impact on data protection, the respondent indicated that it was not necessary because no personal data is processed.
THIRTEENTH: When a copy of the Data Protection Impact Assessment referred to in Article 35 of the GDPR was requested in the preliminary investigation for the processing of biometric fingerprint data for park access control using the TT, or the report stating that it should not be performed, the respondent acknowledged that it was not provided because it did not have one, based on the fact that it considers that it does not process personal data of this type. A copy of the risk analysis document for said processing was also not provided. When the RAT was requested for the same type of processing, it did not provide it, stating that the circumstances of Article 30.5 of the GDPR for its exception were met. It is also proven that the defendant uses the aforementioned fingerprint system for minors over the age of 3, with TT tickets being free for minors under that age, according to the information provided at the time of online purchase on the defendant's website. Therefore, there would be no reason to require this type of data for access in order to verify that it is the same person, given its free nature.
LEGAL BASIS
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 42/79
I. Jurisdiction
In accordance with the powers granted to each supervisory authority by Article 58.2 of the GDPR and as established in Articles 47, 48.1, 64.2, and 68.1 of the LOPDGDD, the Director of the Spanish Data Protection Agency is competent to initiate and resolve this procedure.
Likewise, Article 63.2 of the LOPDGDD establishes that: "The procedures processed
by the Spanish Data Protection Agency shall be governed by the provisions of
Regulation (EU) 2016/679, by this Organic Law, by the regulatory
provisions issued in its development and, insofar as they do not contradict them,
subsidiarily, by the general rules on administrative procedures."
II Biometric Data
The starting point is Article 1 of the GDPR, which establishes as its object
"1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of such data.
2. This Regulation protects the fundamental rights and freedoms of natural persons,
and, in particular, their right to the protection of personal data."
The material scope of the GDPR extends its protection, as established in its
Article 2.1, “to the wholly or partially automated processing of personal data, as well as to the non-automated processing of personal data contained in or intended to be included in a filing system.”
It is essential to understand that this involves determining how to apply the
provisions to certain situations in which individual rights are at stake due to the processing of their personal data.
The GDPR establishes, in Article 4, the definitions for the purposes of the GDPR:
“1) personal data means any information relating to an identified or identifiable natural person
("data subject"); an identifiable natural person shall be any person whose identity
can be determined, directly or indirectly, in particular by reference to an identifier such
as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person.”
2) "processing" means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means,
such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction;"
(…)
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 43/79
"5) "pseudonymization" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
6) "file" means any structured set of personal data accessible according to specified criteria, whether centralized, decentralized, or distributed functionally or geographically;
7) "controller" or "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing; where Union or Member State law determines the purposes and means of processing, the controller or the specific criteria for its nomination may be laid down by Union or Member State law;
8) "processor" or "processor" means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
(…)
“14) Biometric data: personal data obtained from specific technical processing, relating to the physical, physiological, or behavioral characteristics of a natural person, that allow or confirm the unique identification of that person, such as facial images or fingerprints;”
The definition of biometric data refers to “personal data obtained from specific technical processing,” “technical processing,” without specifying, except to note that the purpose of such processing must be to “allow or confirm the unique identification of that person.”
To be considered biometric data within the meaning of the GDPR, the processing of raw data, such as the physical, physiological, or behavioral characteristics of a natural person, must involve a measurement of those characteristics. Therefore, the following must not be overlooked in the concept:
- The nature of the data: data relating to the physical, physiological, or behavioral characteristics of a natural person,
- The means and methods of processing: data “obtained from specific technical processing,” which differentiates, for example, from images of a person contained in a video surveillance system, which cannot be considered biometric data if they have not been technically processed in a specific way for the purpose contribute to the unique identification
of that person. Recital 51 of the GDPR also refers to the non-consideration
of photographs as special category of data processing,
unless a specific technical processing method is applied that "allows for the unique identification or authentication of a natural person."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 44/79
-The purpose of the processing: the data must be used for the purpose of uniquely identifying a natural person.
The collection of biometric samples, the so-called biometric data-fingerprint images,
are subject to an automated technical processing process that extracts a digital representation (biometric template) of the biometric data,
digitizes them, stores them, processes them, and deletes them after use for the purpose of access control.
Biometric technologies are related to Physical body parts or behavioral traits of human beings, and the recognition of individuals based on one or both of these parts or traits. Today, biometrics are being used to recognize individuals in a wide variety of contexts, such as physical and computer access control, law enforcement, voting, border crossings, social benefit programs, or driver's licenses, among others.
Biometric systems are automatic methods based on applications of biometric technologies that allow for the unique identification or recognition of a person based on one or more intrinsic physical or behavioral traits. Therefore, biometric data is directly linked to an individual.
Such methods have been used for a long time. However, the new element
that triggers data protection considerations is that a machine can now
automatically perform these functions, making it possible to identify or recognize
people with measurable accuracy. Biometric data makes human body
characteristics machine-readable and subject to subsequent
use.
Depending on the biometric technique used, the parameters considered are
different: fingerprint grooves, hand geometry, voice, facial image,
etc. From these parameters, a unique pattern or template is extracted for each person, which will be
stored and used for subsequent comparisons.
As Working Party 29 pointed out in Opinion 4/2007 (WP136) on the concept
of personal data, biometric data can be defined as:
“biological properties, physiological characteristics, personality traits, or tics, which
are, at the same time, attributable to a single person and measurable, even if the models
used in practice to technically measure them imply a certain degree of
probability.”
Biometric systems are closely linked to a person, since they can
use a specific unique property of an individual for identification. Each
individual has unique fingerprints that show specific characteristics that
can be measured to determine whether a fingerprint corresponds to a recorded sample. Biometric data have the distinction of being produced by the body itself and definitively characterize it. Biometric data has the unique characteristic
of being produced by the body itself and definitively characterizing it. They are not data
about that person, but rather refer to the same person. In principle, they cannot be modified by the individual's will, nor can the person be released from them. Furthermore,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 45/79
because biometric data is specific to a person and perpetual, the user
uses the same data in different systems.
Therefore, they are unique, permanent over time, and the person cannot be released from them.
They can never be changed, not even with age, creating liability issues in
the event of compromise, loss, or intrusion into the system, posing a specific and
significant risk to individuals. This means that if biometric data is lost,
stolen, or misused, it cannot be changed or modified. There is a clearly visible risk of loss of identity and legal personality (Article 6 of the
Universal Declaration of Human Rights).
Although the GDPR does not define technological terms, ISO/IEC 2382/37:2012, "Information technology - Vocabulary - Part 37: Biometrics," replaced by 2382-37:2022, establishes a systematic description of concepts in the field of biometrics.
Meanwhile, ISO/IEC TR 24741:2018, "Information technology - Biometrics - Overview and application," can serve as a general guide on the operation of these systems and should be familiar to professionals involved in this field in one way or another, such as suppliers or platforms that use these systems.
The term "biometric characteristic" is defined as "a biological and behavioral characteristic of an individual from which distinctive and repeatable biometric characteristics can be extracted for the purposes of biometric recognition." In this case, it refers to the data extracted from the fingerprint. The process begins with fingerprint registration, hence the informational note on the boards whose photograph was provided in the
claim, which stated: "This system does not store the image of your fingerprint; it simply reads it." "Place your right index finger here and follow the operator's instructions."
The term "biometric sample" refers to the capture of a sample of the individual
extracted from that biometric characteristic (the fingerprint). The result, after a technical process,
will logically not end with the same fingerprint, as the person repeatedly claimed in the allegations,
which insists on clarifying that it does not process personal data because it cannot
identify people through fingerprints, it does not store them, but rather the result
would be a biometric template of that fingerprint.
Thus, we can and often refer to sample collection, sample capture and registration, similarity
of the compared samples, vulnerability due to acceptance of false biometric samples,
the sample presented to the sensor, the technical characteristics of the collected sample,
encryption of the storage of obtained samples, or storing a portion of the sample or multiple references instead of the entire sample, as an example of "the
storage of minutiae of fingerprints instead of the complete fingerprint."
Biometric sample capture is usually obtained with the collaboration of the individual, or is mandatory for certain affected parties, such as when collected by the police during their investigations or when third-country nationals cross Schengen borders.
The registration phase plays a fundamental role as it is the only one in which the raw data, the extraction and protection algorithms (cryptography, random checks, etc.) appear simultaneously, along with the templates.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 46/79
In this case, the biometric characteristics collected upon initial access to the park are subjected to technical processing based on a finger image, which requires and includes
a process that is included in all biometric data processing: data capture or recording with storage, and the subsequent comparison or matching phase.
When registering a user on a biometric device, also called an enrollment or registration process, the system performs a set of measurements of some of the biological or behavioral characteristics of the person in question—fingerprint, hand shape, iris, etc.—using specific and varied sensors for each type of biometric sample. The biometric system extracts specific user traits from the biometric data to create a biometric template: the recorded biometric measurement of a person. What is stored is the template, in digital form, and not the biometric element itself. This is the phase of recording the biometric parameters.
The operation encompasses all the processes carried out in a biometric system to extract biometric data from a biometric source and link this data to an individual. The fingerprinting software records reference points (minutiae) and converts these measurements into a numerical code, which the claimant indicates are the ten points extracted from the fingerprint image. The minutiae are characteristic points on the ridges of the fingerprints that, taken together, could be used to configure a unique pattern for each individual.
This numerical code, or template, is what is stored for comparison when entering or exiting the space where the fingerprint recognition reader terminal is located, which records the entry of users, in this case to the parks of the company in question. The template has been
created with the personal characteristics of the captured parameters.
Once the template is created, it is saved to a suitable storage medium, and once enrollment is complete, the system can be used.
Biometric data can be processed and stored in different ways. Sometimes, the
biometric information captured from a person is stored and processed in its raw form, which
allows the source to be recognized without special knowledge; for example, a
photograph of a face, a photograph of a fingerprint, or a voice recording. Other times, the captured raw biometric information is processed so that only certain characteristics or features are extracted and saved as a biometric template.
A biometric template is a way of writing a human biometric characteristic,
such as a face or a fingerprint, in a way that makes it interpretable by a machine
efficiently and effectively for a specific purpose or purposes. The biometric template
is not intended to be interpreted by a person, like a photograph, but rather is intended to be processed in an automated process, that is, to be efficiently and effectively interpreted by a machine. Through available software technology, the patterns/templates created by biological samples are recognized.
The template is necessary because the biometric system, including the fingerprint system,
used by the claimant, works with the technique of sample comparison and threshold probabilities that are paired. The sample comparison is because the system makes decisions (access/non-access, in this case to the parks) based on comparison scores generated from comparison attempts between a registered template
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 47/79
(compared reference) and the sample it wishes to access at that time. Opinion
3/2012 on the evolution of biometric technologies of April 27, 2012, by Working Group 29, states:
“- Biometric matching: the process of comparing biometric data or templates
(captured during registration) with biometric data or templates collected
in a new sample for the purposes of identification, verification, and authentication or
categorization.”
All systems, including the one with the requested sample, create a biometric template (“template” or “mathematical encoding”): a numerical representation of a person's biometric characteristic. To obtain it, the biometric system extracts
specific characteristics (such as minutiae) and encodes them following an algorithm
to obtain the data sequence (template).
A biometric template is "a digital representation of the unique characteristics that have been extracted from a biometric sample and stored in a biometric database," a definition taken from the Guidelines of April 28, 2021, on facial recognition, issued by the Advisory Committee to the Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data, which would be identical despite being a representation of a finger in this case.
A biometric template is a stored representation of biometric data. But it is not the data itself, and this is the crucial distinction between biometric data and a biometric template. In this case, the template acts as a unique identifier for the individual. The fact that, from a biometric template, for example, a fingerprint, the original cannot be reconstructed is irrelevant, as it is a unique identifier that uniquely identifies the individual, at least within the context of automated processing.
The system's operating mechanism is that once the fingerprint is captured and the template is created, it is stored so that when attempting to access, in this case, the second park, by placing the finger, it is processed again, a template is obtained, and it is compared with the one stored.
Unlike an ID card, the biometric template is not assigned to a person; it is extracted directly from the observation of the individual's unique and unalterable characteristics, without the need to resort to documents, other devices, or third-party databases.
The claim refers to what is stored and captured from users in terms of fingerprints as a mathematical representation. Adding, for example, in the allegations that: "The
hardware solution creates a grayscale image, then creates a binarized image to determine the image skeleton, creating two skeletons for ridges and valleys. It produces a list of minutiae through the analysis of both skeletons and establishes a biometric template, which is a mathematical representation based on the ridge patterns.
It adds that the mathematical representation is encrypted.
The reference included in Article 4.14 of the GDPR as biometric data intended
to "allow" can be understood as identification, and the reference "confirm" as verification.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 48/79
For a better understanding, the concepts of authentication/verification and
identification are described. Opinion 3/2012 on the evolution of biometric technologies of April 27, 2012, Working Group 29 stated:
“-Biometric identification: The identification of an individual by a biometric system is
typically the process of comparing their biometric data (acquired at the time of identification) with a series of biometric templates stored in a database (i.e., a one-to-many matching process).
-Biometric verification/authentication: The verification of an individual by a biometric system is
typically the process of comparing their biometric data (acquired at the time of verification) with a single biometric template stored on a device (i.e., a one-to-one matching process).”
With slight nuances, the concepts are mentioned in the European Commission's "White Paper on Artificial Intelligence" of February 19, 2020, referring to facial images:
"With regard to facial recognition, 'identification' means that a person's facial image template is compared with many other templates stored in a database to determine whether their image is stored there. 'Authentication' (or 'verification'), on the other hand, typically refers to matching two specific templates. It allows for the comparison of two biometric templates that, in principle, are assumed to belong to the same person; thus, the two templates are compared to determine whether the person in the two images is the same. This procedure is
used, for example, at automated border control gates used at airports."
The European Data Protection Board (EDPB) Guidelines 5/2022 on the use of facial recognition in law enforcement (see Version 2.0, of April 26, 2023), in Section 10, states:
"Like any biometric process, facial recognition can serve two distinct functions:
• Authenticating a person to verify that the person is who they claim to be. In this case, the system compares a pre-recorded biometric template or sample (for example, stored on a smart card or biometric passport) with a single face, such as that of a person presenting themselves at a checkpoint, to verify whether it is the same person. Therefore, this function is based on comparing two templates. It is also called one-to-one verification.
• The identification of a person for the purpose of locating them among a group of individuals,
within a specific area, in an image or in a database. In this case, the
system must process each captured face to generate a biometric template and then
check if it matches a person known to the system. Therefore, this function is
based on comparing a template with a database of templates or samples
(reference base). It is also called "one-to-many" identification. For
example, it can relate a record of personal names (surnames, first names) to a
face, if the comparison is made with a database of photographs associated with
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 49/79
surnames and first names. It can also involve tracking a person through
a crowd, without necessarily establishing a link to the person's civil identity. “
The aforementioned Guidelines 05/2022, in section 12, state that the concept of biometric data covers both “authentication” and “identification.” Although they are distinct concepts, both procedures process data intended to uniquely identify a natural person. Therefore, both are included within the concept of “data processing” and, more specifically, are processing of special categories of personal data.
In both cases, whether verification-authentication or identification, the facial recognition techniques used are based on an estimated match between templates: the one being compared and the reference template(s). From this perspective, they are probabilistic techniques: the comparison deduces a greater or lesser probability that the person is indeed the person to be authenticated or identified. If this probability exceeds a certain threshold in the system, defined by the user or developer, the system will consider a match.
Data about an identified natural person is that That person is distinguished or isolated from a group
of people. Unique can refer to the fact that biometric data has such characteristics that it can unambiguously identify an individual. In this way, a unique identifier can be associated with other additional attributes or personal data.
It is stated, as already indicated, that the biometric template, for the purpose of
identification or authentication, is personal data per se and a unique identifier.
In this case, the biometric data is initially recorded in the form of a
template, effective and efficient enough to be machine-interpretable. For this purpose, said template is saved. This is the storage method that allows an individual to be identified and
actions to be executed automatically. This means that, on the second visit, the same person, upon entering the park, will be granted access if they place their fingerprint on the terminal using a template comparison procedure.
Therefore, the search on the second visit to the park It is performed on personal data that has already been obtained previously, and from this, it identifies from among all the templates the one that corresponds to or most closely resembles the fingerprint presented.
For a biometric template to be effective, the templates generated from two different individuals must be clearly distinguishable. In this case, the template acts as a unique identifier for the person.
In principle, it is not necessary to store the reference data in a database for authentication/verification purposes; it is sufficient to store the personal data in a decentralized manner. Conversely, identification can only be achieved by storing the reference data in a centralized database because, in order to determine the identity of the interested party, the system must compare its templates with the templates of all the people whose data are already stored centrally. This is the way the applicant maintains its database.
When biometric data, a fingerprint sample, is taken and registered for the first time in the system As claimed, the system does not store the actual fingerprint,
but a digital template is recorded. "The biometric template is a mathematical representation of the original fingerprint based on the analysis of ridge patterns," the
template "is used during the comparison process to compare it with previously stored templates" (manufacturer's manual (...)) which serves as a cropped representation of the biometric information. When a user enters the premises, their characteristics are compared with the templates, and the result is assigned a similarity score. If it is high enough, the user is allowed to enter.
That is to say, on the one hand, the fact that it is called a mathematical representation is not an obstacle, as practice
demonstrates, to using this representation obtained from the biometric sample,
recognizing the person in a way that uniquely identifies that person, since their
record is stored in a database belonging to the requested entity. The personal information
in the template associated with its information systems makes sense because it uniquely identifies a
unique and specific individual, and this fingerprint data is treated in a
defined and determined manner. It is established that obtaining the second access to the
park is not, in fact, necessary nor does it occur through the comparison of fingerprints, but rather through the comparison of templates, or mathematical representation (a term that is the automatic translation of the personal data of the user of the system who will access, captured, stored, and ready so that upon entering the second park, by placing the fingerprint on the sensor, it searches for the correspondence with the template,
a mathematical representation as the respondent calls it, previously stored).
Therefore, it must be recognized that the biometric system used by the respondent is a technique applied to biometric fingerprint registration that makes it possible, after first registering a person, and after a period of time following access to the first park, to obtain authorization for that same person to access the second park. To maintain that natural persons are not identifiable when the purpose of the processing is precisely to identify them would be inconsistent.
In this case, the defendant further states that the access system, with TWIN TICKET entry, does not store the fingerprint image. However, as explained, the truth is that
ten points of coincidence (minutiae) are collected, recorded, and stored for each
fingerprint of each visitor, including minors, contained in the biometric template, a mathematical, numerical representation, which the defendant attempts to exclude from the scope of application by not considering that what is contained in said mathematical representation is biometric personal data. However, as we have explained and justified,
the biometric template is personal data.
However, the resulting analysis shows that the defendant has
used a biometric system capable of verifying user access,
pre-established by the aforementioned system, which allows access to the
second park to be made by the same person who visited the first. Although the system is managed by an external contract with ***COMPANY.3, the content of the contract implies that, in terms of personal data, due to its functions and purposes, it would be a data processing order on behalf of its controller, the respondent.
Regarding the respondent's reiteration that it does not use the fingerprint, but rather a mathematical representation of the fingerprint, which "is not useful for identifying the client because it does not provide any personal data about the client, as it is not reversible. That is, it cannot create or reconstruct the pure image of the fingerprint backwards, nor can it create the original fingerprint itself, and therefore its identification," or also that "it is not possible to identify the owner of the details that formed the mathematical representation," it must be noted that
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 51/79
that even if it were not reversible, a system such as the one used by the respondent collects biometric data within the meaning of the definition set forth.
Regardless of whether it is positive that the mathematical representation of the biometric data generated from the biometric samples provided by the person is not technically reversible, This is stated in Opinion 3/2012 on the evolution of biometric technologies, dated April 27, 2012, of the Article 29 Working Group, which states:
"The generation of the template must be a one-way street, in which it is not possible
to regenerate the raw biometric data from the template." However, for reasons of security measures and to preserve privacy, it would be advisable for this to be the case.
However, this alone does not determine whether it is considered biometric data, as it is a
unique identifier that uniquely identifies the person, at least within the framework of automated processing.
Although it is not reversible, all its requirements would be met to be considered biometric data, and reality confirms that the system has been used to correlate that the second entry into the parks was made by the same person
as the first, this being the purpose of implementing the system because there is an
offer that affects only residents. According to the respondent, and serves these purposes,
it is used to uniquely identify a person. The technical processing carried out by the respondent and the data processor ***COMPANY.3 leads to the consideration that the template obtained with these means from physical characteristics confirms a unique identification.
Therefore, the respondent's statement that, by not directly storing the fingerprint in its original form, the possibility of correlating it with other personal data is reduced, or the risk of identifying the individual is reduced, lacks an understanding of how biometric systems work.
In conclusion, the biometric information collected, in this case the image of a fingerprint, is processed automatically through specific technical processing that obtains a biometric template, digitally representative of the fingerprint itself, so that, stored in the respondent's systems through the system contracted with its data processor, it remains ready for use for the purpose sought by the respondent. The user is required to identify the user. Biometric data is personal data, as several operations are performed on said biometric data: collection, storage, and comparison. The user must enter the same elements as the first one at the second park entrance: the ticket containing a QR code and the fingerprint, which uniquely identifies the user entering, constituting a biometric data processing process, creating a system capable of identifying the person, a biometric personal data, regardless of whether the process is non-reversible, this being a security issue.
III Biometric data as personal data: Connection with Article 4.1 of the GDPR
It is proven that a biometric template or mathematical representation has been used,
based on the fingerprint being taken, recorded, and stored, in order to verify
that the same person is accessing both parks, who has been using the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 52/79
claimed and continues for this purpose, it is analyzed how, in addition, there are reasonable means
to identify the data subject or make them identifiable.
Conversely, when biometric data, such as a template, are stored in such a way that the data controller or any other person cannot use any reasonable means to identify the data subject or make them identifiable, such data will not be classified as personal data.
Thus, whether the biometric data contain information concerning an identified or identifiable natural person, they would fall within the scope of the GDPR, applying its principles and the rights of data subjects.
The identifiability of the individual also depends on the availability of other data that
(jointly or separately) allow the identification of the individual in question.
Consequently, the natural person is "identifiable" when, although not yet identified, it is possible to do so. (which is the meaning of the suffix "ble").
Thus, this second alternative is, in practice, the sufficient condition for considering
that the information falls within the scope of the identified or identifiable natural person.
Recital 26 states that: "The principles of data protection should apply to all information relating to an identified or identifiable natural person. Pseudonymized personal data, which could be attributed to a natural person by the use of additional information, should be considered information about an identifiable natural person. In order to determine whether a natural person is identifiable, all means, such as individualization, which the controller or any other person can reasonably use to identify, directly or indirectly, the natural person should be taken into account. To determine whether there is a reasonable likelihood that means will be used to identify a natural person, all objective factors must be taken into account, such as the costs and time required for identification, taking into account both the technology available at the time of processing and technological developments.
This means that the mere hypothetical possibility of identifying an individual is not sufficient to consider the person as "identifiable." If, taking into account "the totality of the means that can reasonably be used by the controller or any other person," such a possibility does not exist or is negligible, the person should not be considered "identifiable" and the information should not be classified as "personal data." The criterion of "the totality of the means that can reasonably be used by the controller or any other person" must take into account all the factors involved.
First, there is the possibility of "direct identification" through "one or more specific elements characteristic of their physical identity," which is explicitly mentioned in the definition of personal data. A person can be identified directly by their first and last name or indirectly by a telephone number, a car registration number, a social security number, a passport number, or by a combination of significant criteria (age, employment, address, etc.) that makes their identification possible by narrowing the group to which they belong.
When we talk about "indirectly" identified or identifiable, we are generally referring to the phenomenon of "unique combinations," whether small or large. In
cases where, at first glance, the available identifiers do not allow a specific person to be identified, that person may still be "identifiable" because this information,
combined with other data (whether or not the controller is aware of them) will distinguish that person from others. This is where the definition in
Article 4.1 refers to "one or more factors specific to that person's physical, physiological,
mental, economic, cultural, or social identity." A combination of details belonging to
different categories (age, regional origin, etc.) may be sufficiently conclusive in
some circumstances, especially if additional information of a certain type is available.
Secondarily, the doctrine established by the CJEU ruling of
19/10/2016 (Case C-582/14) regarding the "identifiable" person, for the purposes of the data protection regime,
understands that if there are mechanisms that allow data to be associated
with a person, even if they are in principle beyond the reach of the person who possesses that data, the person will be deemed to be identifiable, provided that, even with the help of other
people, they can reasonably identify the person whose data is being processed. This
ruling considers dynamic IP addresses, which constitute series of numbers, as
personal data.
This would involve whether, based on the collection of data such as fingerprints
taken for access with TT tickets and used as a means of access to both parks, it is possible, in relation to the content of the ticket purchased online by an identified person, plus the data from the reading of the ticket on the day of the ticket reservation, to establish the possibility of identifying the person accessing the park using such biometric data during the period or times when the TT tickets are valid. What must be analyzed is not identification through the reversibility of the captured biometric template, but rather its association with the elements contained in the data processing method associated with the accesses, in the ticket.
To determine whether a person is identifiable, the set of means that can reasonably be used by the data controller or by
any other person to identify that person must be considered.
The aforementioned ruling of 10/19/2016 indicates that its wording suggests that, for data to be
qualified as "personal data," "within the meaning of Article 2(a) of that Directive, it is not necessary that all information allowing the identification of the data subject must be held by a single person" (paragraph 43).
Relevant to the matter, the concept of personal data, under the GDPR, would include so-called "pseudonymized data." The GDPR defines pseudonymization in Article 4.5 as "the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures designed to ensure that the personal data are not attributed to an identified or identifiable natural person."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 54/79
As stated in the conclusions of Advocate General Manuel Campos on 12/05/2016 (in Case C-582/14, on dynamic IPs), "[...] the determining factor, under Directive 95/46, is the (reasonable) possibility of the existence of an "accessible" third party who
possesses the necessary means to facilitate the identification of a person, not the
possibility of resorting to that third party materializes." Or, to put it another way, the simple
real possibility of using lawful means to obtain additional data that would allow the holder of the information in question to be identified, allows us to understand that we are dealing
with information referring to an "identifiable" natural person.
This, in addition to the fact that identifiability does not have to be determined solely by the data controller, but can also be determined by a third party, as determined, among others, in the CJEU ruling of 10/19/2016 regarding the "identifiable" person for the purposes of the data protection regime. This ruling states that if there are mechanisms that allow data to be associated with a person, even if they are, in principle, beyond the reach of the data holder, the person will be deemed identifiable provided that, even with the help of other persons, the person whose data is being processed can reasonably be identified, or by the Supreme Court, Administrative Litigation Chamber, Third Section, ruling 1062/2019 of 07/02/2019. Nor is the controller's identity decisive.
In this case, these park attendees may also include
the same purchasers of the ticket(s) purchased or reserved online on the websites of the defendant, who provided their information for, as indicated in the data collection information, "ticket issuance and access control to the venues." It should not be forgotten that tickets purchased online are sent to the email address provided by the purchaser - in printable PDF format - which they can present at the entrances on their mobile phone or printed. These tickets contain elements generated and assigned by the ticket sales system itself, such as the page number, the QR code, the date and time of entry, always set for the visit to the first park, and the date and time they wish to visit the second park. Thus, if the purchaser who provided their information online accesses their ticket through the established points and meets the conditions also established by the defendant, including scanning the QR code and the ticket locator, along with their fingerprint, there are clear indications by which they can be identified or made identifiable. Considering that their information is not only in the defendant's customer/purchaser file, but also in elements that are part of an advanced ticket sales and access control technology system that has a variety of functionalities that are sufficient to make said identification effective, and along with the fingerprint that is entered next to the ticket, a fingerprint that is also managed by said ticket-access control system, and that allows, as indicated, the purchaser to be identified because their information is available. Upon second access to the other park, the QR code must be scanned again, followed by the fingerprint, which will generate A template is created, and the internal reader compares it with the one already stored, identifying the same person upon access.
It should not be forgotten that the respondent has software contracted with
***COMPANY.3, responsible for processing the complaint, which, among other elements,
indicates in its Manual:
- "The information obtained at the time of access is stored in the database with all the information structured in such a way that it can be linked to all the information related
to the corresponding sale, reservation, subscription, etc. In this way, full traceability of the operations is obtained."
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 55/79
Point 2.3 of Document 3 states that the "system is multi-capacity and multi-venue, allowing the sale and issuance of different products (tickets, passes, promotions, subscriptions) with the possibility of multiple accesses to one or more of the Group's Parks according to the characteristics defined at the time of defining the product. As As
detailed in the previous section on Access Control, access after the first visit can be verified using a biometric system (fingerprint or facial recognition) or identification using an ID or passport.
"The information obtained at the time of access is stored in the database with all the information structured so that it can be linked to all information related to the corresponding sale, reservation, subscription, etc. This provides complete
traceability of operations."
The defendant also acknowledged that it has a "Microsoft SQL database that acts as the backend for the entire ticketing solution," "consisting of all the data
necessary for ticket sales and subsequent access to the parks.
It begins to be populated from the moment of purchase, when tickets for entry are generated. These tickets must then be validated at the park's physical access control, and the QR codes are checked to ensure that these tickets exist or not, and access is validated or not. The purpose is to ensure that the ticket sales and access system works and has information
against which to validate them."
In this way, if the online purchaser purchases a single TT ticket to access the parks, they are perfectly identified.
On the other hand, if the purchaser purchases multiple tickets online, the second or subsequent ticket, as it also includes a tracking number and QR code and is purchased by the same person, will always at least be known that the users of the same ticket, even if it is not personal, have, by indirect reference, a person identified as the purchaser. It is foreseeable that the purchaser can be identified and, as they know who these tickets they purchased are for, can identify, or in some cases must identify, if required, for example, if necessary, these people by scanning the QR code of the ticket to which the fingerprint is taken. This is also included in the defendant's systems. Therefore, these people can also be indirectly identified by third parties.
Therefore, given the respondent's statement that its system "does not compare fingerprints" but rather compares the minutiae detected during the encoding of the image extracted from the fingerprint, a form of mathematical representation, it must be concluded that, regardless of its name, the comparison of the records obtained from the fingerprint image, processed with technical means, with the mathematical representation or template stored in the respondent's systems, with the defined purpose of detecting that a person who re-enters the park this time is uniquely identified upon re-entry, has implemented this system that uses physical characteristics to identify specific individuals who re-enter, allowing for the biometric identification of the person and eventual access through the authorized use of their biometric characteristics.
Furthermore, not only is such use verified, but such biometric data also uniquely identifies and
can identify the ticket purchasers who access
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 56/79
themselves, and the person for whom they purchase the ticket, even if it is not personal.
This is so given the implementation of the respondent's system and because the definition of the
concept of "personal data" is so broad that it does not only cover data
collected and stored by the data controller, but also includes all
information resulting from the processing of personal data that relates to an
identified or identifiable person (see, in this regard, the judgment of 4/5/2023,
Österreichische Datenschutzbehörde and CRIF, C-487/21, EU:C:2023:369, paragraph 26).
Thus, in the case of tickets purchased through the respondent's website, the process
established by the respondent for access with these TT tickets, so that the second person who enters is the same as the first, falls within the process established by it, which involves:
1. Each ticket generates a QR code assigned by the ticket management software,
managed on behalf of the respondent by a data processor: ***COMPANY. 3. The ticket's QR code is presented at the entrance to be read by a turnstile.
2. The fingerprint is taken using specific fingerprint software incorporated into the ticket management software.
3. The specific fingerprint software processes the biometric sample, the fingerprint, and
obtains a biometric template.
4. The template is stored in the ticket management software, which is
managed on behalf of the respondent.
5 This enables the user's first access to the first park.
6 In the second park, the user shows the QR code again.
7 The fingerprint of the user seeking to access the second park is taken again.
8 From that user, the fingerprint is technically processed, and the biometric template is obtained.
9 The biometric templates are compared.
10 If there is a match, the same user who accessed the first park is granted access to the park.
In conclusion, the biometric personal data from the fingerprints of the ticket purchasers who access the parks themselves, in addition to constituting biometric personal data, are automatically processed by the fingerprint recognition systems implemented by the respondent, including its data processor who acts through it, constituting a system that allows the purchaser to be identified.
Similarly, the persons for whom the purchaser purchases the tickets, even if they are not personal, may be identifiable using the system imposed by the defendant, as explained. In both cases, these constitute special category data processing, as they are intended to uniquely identify a person.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 57/79
IV Prohibition of processing biometric data
Recital 51 of the GDPR states: "Personal data deserve special protection,
which, by their nature, are particularly sensitive in relation to fundamental rights and
freedoms, since the context of their processing could entail significant
risks for fundamental rights and freedoms... The processing of photographs should not systematically be considered special categories of personal data, as they are only included in the definition of biometric data when The fact that they are processed using specific technical means allows for the unique identification or authentication of a natural person. Such personal data should not be processed unless their processing is permitted in specific situations covered by this Regulation, given that Member States may lay down specific data protection provisions in order to adapt the application of the rules of this Regulation to compliance with a legal obligation or to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular with regard to the conditions for the lawfulness of processing. Exceptions to the general prohibition on the processing of such special categories of personal data should be explicitly provided for, inter alia, where the data subject gives explicit consent or in the case of specific needs, in particular where the processing is carried out in the context of legitimate activities by certain associations or foundations. whose purpose is to enable the exercise of fundamental freedoms.”
Biometric data is data whose use may pose significant risks to fundamental rights and freedoms, and therefore its use is initially prohibited by Article 9.1 of the GDPR.
Article 9.1 of the GDPR states:
“The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the
processing of genetic data, biometric data intended to uniquely identify a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, shall be prohibited.”
Paragraph 2 establishes the exceptions that must be met for this to be carried out. In the area of the provision of services, with several conditions in its articles, these would be:
“2. Paragraph 1 shall not apply when one of the following circumstances occurs:
a) the data subject has given explicit consent to the processing of said personal data for one or more of the specified purposes, except where Union or Member State law provides that the prohibition referred to in paragraph 1 cannot be lifted by the data subject;
[…]”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 58/79
“4. Member States may maintain or introduce additional conditions, including limitations, with respect to the processing of genetic data, biometric data, or data relating to health.”
Thus, firstly, to enable the processing of biometric data, one of the specific conditions for enabling this type of processing, as established by the regime of Article 9.2, letters a) to j), must be met, and at least one of the conditions reflected as legitimate grounds supporting one of the legal grounds of Article 6.1 of the GDPR must be met, which states:
“1. Processing will only be lawful if at least one of the following conditions is met:
a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is a party or for the implementation, at the request of the data subject, of pre-contractual measures;
c) processing is necessary for compliance with a legal obligation applicable to the controller;
d) processing is necessary to protect the vital interests of the data subject or of another natural person;
e) processing it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The provisions of letter f) of the first paragraph shall not apply to processing carried out by public authorities in the exercise of their functions.
In the present case, the respondent considers itself exonerated from the application of the GDPR,
because it understands that it does not process personal data, a circumstance that has been considered
refuted by the opposing party in legal grounds II.
Technically, the biometric template against which the sample is compared is the product
of a measurement that uniquely and solely identifies the individual. This is what, for example,
differentiates the images viewed from a video camera, which cannot be considered
biometric data under the definition of Article 9, if they are not specifically processed with a
technical means to contribute to the identification of a person.
The biometric data of each user, acquired at the time of capture and
recorded, are subjected to the technical procedure that converts the image and format
into a biometric sample, and the algorithm into a biometric template. These data are stored so that, with the samples entered when placing the finger on the access points, the user is identified, using the saved
model, from among all the templates. person, without a doubt its owner, would be a
unique identification of that person.
The use of the fingerprint is not only capable of accurately validating identity, but also has
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 59/79
unique information about natural persons.
In the present case, of course, it cannot be said that information linked to
personal data of a person identified in each access log is not being processed, even if the data
is stored on the device encrypted/encrypted. Each time a user uses the system,
it allows or confirms their unique identification through the processing carried out by the defendant with the device acquired, which, among all the templates stored in its systems, is capable of verifying its owner, processing personal data based
on the processing of the fingerprint, uniquely identifying that person.
It is estimated that the defendant processes the data from access to its parks with the TWIN TICKET ticket, using a fingerprint capable of uniquely identifying the purchaser, without meeting the requirements of Article 9 of the GDPR, thereby violating said article.
No less important, it is worth mentioning that before the use of biometric data, because it constitutes an intrusion into the rights of its holders, the use of biometrics also raises the issue of the proportionality of each category of data in light of the purposes for which said data is processed. In this case, leisure activities provided by the respondent, based on a relationship arising from the acquisition of the TT ticket and compliance with the conditions imposed by the respondent, which includes taking a fingerprint to verify (the identity of a person known to be identified/identifiable, whose biometric features have been stored in a database of the respondent, reflecting their unique physical characteristics) that the same person is accessing both parks. This would link to The legitimate basis for processing this data, which involves
the processing of biometric sample data, which meets the requirement that it is "necessary for the performance of a contract to which the data subject is a party or for the application, at the request of the data subject, of pre-contractual measures," so that the same person can access both parks, as contained in Article 6.1.b) of the GDPR.
Biometric data may only be used in an appropriate, relevant, and non-excessive manner, which
requires a strict assessment of the necessity and proportionality of the use of the processed data. To this end, it must be examined whether it arises from the development of the contractual relationship
derived from the acquisition of TT tickets to access the two parks.
That is, from the outset, the voluntary nature of providing the data from the fingerprint sample for access must be denied, or that its voluntary nature is inferred from the purchase of the tickets, even if they carry the offer, especially in the year 2022, which did not contain any information prior to access. This follows the complaint's statement in previous investigations that "an access control system is used
using ten fingerprint matching points, which are requested from those who voluntarily wish to benefit from the commercial offer."
This provision must be interpreted strictly and does not cover situations in which processing is not actually necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the data controller. Furthermore, the fact that the processing of some data is covered by a contract does not automatically mean that the processing is necessary for its performance. Nor does the fact that they are mentioned in the data collection information clauses per se make them necessary for the performance of the contract. There is a relationship between the assessment of necessity and proportionality and the principle of purpose limitation.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 60/79
The necessity of processing predefines the basis for legitimizing processing and must be taken into account as part of the processing process.
Thus, in conclusion, it is considered that the defendant has violated Article 9 of the GDPR,
partly contributing to this is the confluence of accumulated deficiencies regarding
proactive responsibility, and the principle established in Article 5.2 of the GDPR, which
places the responsibility of the data controller to comply with the principles of Article 5.1 of the GDPR, and to be able to demonstrate it. In this regard, it is observed that the respondent lacked, and lacks evidence regarding the risks to the rights and freedoms of
data subjects with respect to the processing of personal data that it continues to carry out, and the
basis that comprises the contents that require an adequate and mandatory preparation and
passing of a Data Processing Impact Assessment on the access system with biometric fingerprint registration.
V. Responsible for the infringement
Regarding liability for the conduct analyzed, the GDPR and the LOPDGDD, in their
Article 70, considers data controllers and the data controllers responsible for the infringements. Data processors
Both concepts are defined in Article 4 of the GDPR:
“7) ‘controller’ or ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing; where Union or Member State law determines the purposes and means of processing, the controller or the specific criteria for its nomination may be laid down by Union or Member State law;
8) "processor" or "processor": the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;
The concepts of controller and processor are developed in the European Data Protection Board's Guidelines 07/2020 on the concepts of "controller" and "processor" in the GDPR.
https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-
concepts-controller-and-processor-gdpr_en
In any case, for relevant purposes, it should be noted that the controller is the natural or legal person, public or private, who determines the purposes and means of processing. This is a functional concept that requires examining, in each specific case, who determines the purposes and means in relation to certain operations. of
processing.
With regard to our topic of interest, we will examine three elements of the definition of
controller.
We will therefore point out, regarding the concept of "determine," that Guidelines 7/2020 establish that,
“20. The second component of the concept of "controller" refers
to its influence on the processing by virtue of the exercise of decision-making power. The controller
is the person who decides certain essential aspects of the processing of the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 61/79
data. Responsibility for processing may be established in the regulations or inferred
from an analysis of the facts or circumstances of the case. It is necessary to focus on
the specific processing activities in question and understand who determines them.
To do this, the following questions must first be examined: "Why does the processing take place?" and "Who decided that the processing should be carried out for a specific purpose?"
…
27. In practice, certain processing activities may be considered linked
by their nature to the function or activities of an entity, which ultimately
also entails responsibilities from a data protection perspective. This
may be based on more general legal provisions or established legal practice
in different areas (civil law, commercial law, labor law, etc.).
…
28. In many cases, examining the contractual clauses between the different parties involved can help determine which party or parties act as data controllers. Even if the contract does not stipulate who is the data controller, it may contain sufficient elements to infer who has the power to decide the purposes and means of processing.
…
29. If a party decides in practice how and why personal data are processed, that party will be the data controller, even if the contract stipulates that it is the data processor.
…
30. Following the fact-based approach, the word "determines" means that the entity that actually exercises decisive influence over the purposes and means of processing is the controller. Typically, the data processing contract establishes who is the determining party (the data controller) and who is the party following the instructions (the data processor).
Regarding “purposes and means,” Guidelines 7/2020 establish that,
“35. Determining the purposes and means is equivalent to deciding, respectively, the
why and the how of the processing: in a specific processing operation, the controller is the party that determines why the processing takes place (i.e., “for what purpose” or “for what purpose”) and how this purpose will be achieved (i.e., what means will be used to achieve it). A natural or legal person who influences the processing of personal data in this way is therefore involved in determining the purposes and means of such processing in accordance with the definition provided in Article 4(7) of the GDPR.
…
38. When one entity clearly determines the purposes and means, entrusting another with processing activities that amount to the execution of its detailed instructions, the
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 62/79
situation is clear: the second entity must be considered the data processor and
the first, the data controller.”
Regarding the term “processing” inherent in the definition of the controller,
Guidelines 7/2020 establish that,
“42. The purposes and means determined by the controller must be
related to the “processing of personal data.” Article 4(2) of the GDPR
defines the processing of personal data as “any operation or set of operations performed on personal data or on sets of personal data.” Consequently, the concept of data controller may be linked to a single
processing operation or to a set of operations. This may mean, in practice, that the control exercised by a specific entity may encompass the entire processing in question, but it may also be limited to a specific stage of the processing.
…
45. It is not necessary for the data controller to have actual access to the data being processed. Anyone who outsources a processing activity and, in doing so, exercises a decisive influence on the (essential) purpose and means of the processing (e.g., by adjusting the parameters of a service in such a way that they require the processing of the personal data of certain individuals) must be considered a data controller, even if they never have access to the data.
In the present case concerning the implementation of the TT biometric access system in the designated parks of the respondent, as well as other types of tickets managed with the software of the company ***COMPANY.3, through the same system, it should be noted that the respondent is responsible for the data collected as customers who purchase tickets based on the contract execution relationship, through the online forms contained on its ticket sales website. It is the respondent that decides the purposes and means it wishes to achieve and how, by contracting with the company. The aforementioned company that offers a service. From a reading of the contract provided to the file and the services and data access provided by ***COMPANY.3, it adopts the legal position of data processor, and this is justified by the proven facts.
The purposes and means indicated by the respondent have been followed with the execution of the aforementioned contract. It is not evident that the action related to the processing of the data analyzed arose from the will of the data processor but rather from the respondent, who is accredited as the legal controller and, as such, is responsible for the infringing actions and conduct.
Regarding the claim made by the respondent to the proposed resolution regarding the nullity of the sanctioning procedure due to the complete and absolute disregard of the legally established procedure, as no other entities that could also be responsible were called to the procedure, it should be noted (i) that the entities cited are (ii) and that, in accordance with the GDPR, the data processor, when processing personal data on behalf of the data controller, is, in some way, part of the data controller, as if it were another employee acting within the data controller's organization.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 63/79
In this regard, we should highlight the ECJ ruling of December 5, 2023, issued in
case C-683/21, which states that, "84 Since, as indicated in
paragraph 36 of this judgment, a data controller is responsible not only for all processing of personal data that it carries out, but also for The processing carried out on its own behalf, the controller may be imposed an administrative fine pursuant to Article 83 of the GDPR in a situation where the personal data is subject to unlawful processing and where it is not the controller, but a processor to whom it has engaged, who carried out the processing on its behalf,” a situation that occurs in the case examined, as has been proven.
It is clear from the attribution that this is required only from the controller, who, through the external service, processed the data on behalf of the controller. It is not proven that liability can be derived from the actions that are proven to be attributable solely to the will of the respondent.
VI Response to the allegations
Regarding the allegations included in the file:
- some allegations regarding the nature of the fingerprint, understood as the biometric sample
provided by the person from whom the biometric data are generated, that the respondent has made, such as "At no time are clients' fingerprints recorded" "We do not work with fingerprints, but rather with mathematical representations of the original fingerprint" "Nor are they stored" would be answered by reading legal grounds I, which
detail a brief description of the technical process included in any biometric system, in this case the use of fingerprints.
Likewise, a reading of legal grounds I and II makes it clear that the fingerprint and biometric template used by the respondent are personal data and that biometric data processing has been carried out by the respondent, all in accordance with the GDPR.
- Regarding the allegation that concepts are being used that are not defined in data protection regulations, it should be noted that the GDPR constitutes the general and transversal regulation on data protection that applies in all EU Member States, without prejudice to specific sectoral regulations in areas that require more specific provisions. The definitions The articles used in this case that do not appear in the GDPR usually refer to descriptions that, moreover, the respondent has not challenged or stated were incorrect.
Regarding the reference to opinions or guidelines, "which are not expressly included in the sanctioning regulation," according to the respondent, these are not used to support the sanction, but rather as an interpretive criterion. The Article 29 Working Party, an advisory body established under Article 29 of Directive 95/46/EC, was an independent advisory body composed of the Data Protection Authorities of all Member States, the European Data Protection Supervisor, and the European Commission.
The GDPR created the European Data Protection Board (EDPB) as the body responsible for ensuring the consistent application of the GDPR, which is established as a
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 64/79
a Union body with its own legal personality. It enjoys complete independence in the
performance of its functions and shall not receive instructions of any kind.
With the entry into force of Article 94.2 of the GDPR, all references to the Working Party
in Article 29 of the aforementioned article shall be deemed to be made to the European Data Protection Board established by this Regulation, with the latter assuming the opinions, recommendations, and guidelines issued by the former.
-Regarding the respondent's claim that technical reports were provided proving
that "mathematical codes do not identify individuals," the respondent only provides the manufacturer's manual for the biometric device and a report on security measures regarding the biometric access validation control system of the data processor ***COMPANY.3. Neither report contains this claim. The report mentions Article 25 and the data minimization principle.
- Regarding the information note that appears in the images of the information boards at the parks' access points - a photo of an entrance booth - regarding the TWIN TICKET tickets, joint tickets for both parks, LORO PARQUE AND SIAM PARK (these are the types of tickets purchased by the complainants, although they also featured the logos of the "ULTIMATE TENERIFE" and "VUELVE" tickets) at least on September 16, 2022 - the date of complainant 1's complaint - with the following addition at the bottom: "This system does not store the image of your fingerprint, it simply reads it." Next to it, in the same color, is an information panel: "Place your right index finger here, and follow the operator's instructions."
In this regard, it should be reiterated that, although the fingerprint is not stored, the raw data is not stored, but rather an extract of its characteristics, a summary of these characteristics, which, for the purposes claimed by the respondent, serve. Undoubtedly to confirm the access of users of the
TT who are not registered.
The fact that the entire fingerprint is not stored, as the defendant seems to mean, and that a reading of that fingerprint is performed, which is not complete, does not prevent us from deducing that what is done when the index finger is inserted into the sensor at the entrance to the second park is
a reading of the mathematical representation or biometric template containing the automatically processed personal data. To grant the customer access to the
second park, the part of the ticket with the QR code must be inserted again, and then the index finger must be inserted into the access sensor, which compares the fingerprint with that
mathematical representation or biometric template that the data controller has saved to verify the match and grant access. Biometric data is thus processed because it fulfills its function of allowing or confirming the unique identification of that person based on specific technical processing. This template or mathematical representation is therefore capable of identifying its owner in any case. This is demonstrated by the fact that, after registration for the first park for the purpose that the defendant imposed as mandatory, it is through this registration that, on the second occasion, the bearer of the fingerprint gains access to the second park. The personal data itself is the same template or mathematical representation.
Thus, it turns out that the processing of your data is permitted, and therefore, upon reading, if a threshold of matches is exceeded (% of matches of the biometric system established by the software), the person can be uniquely identified, and a matching (matching of the fingerprint taken with the fingerprint registered for the same person) can be performed. However, the definition of biometric data is characterized by the fact that it is personal data obtained from specific technical processing.
This use occurs because biometric personal data is used, resulting from the technical processing carried out for this purpose, at the will of the system's developer, the respondent, who is the data controller.
-Regarding the claim that there is no cross-referencing between ticket purchase data and the biometric data used, it has been established that in fact there is a mixed use
of both data, with the defendant's own data, all of which are stored in the systems and which
belong to the entrance ticket. The latter, along with the use resulting from fingerprinting at the entrances. In practice, the QR code associated with the ticket, which also contains all the elements that allow the person to be identified, must be entered on both occasions upon access, in a sequential order. The QR code, associated with and unique to each ticket, is read by the ticket terminal. The fingerprint is then taken, and the stored template is compared by comparing the entry made on the second visit, creating a new template that, as indicated, is compared with the stored template, fully identifying the person identified through the ticket sales and access control software. Considering that all data is available and managed by the defendant through said system, which also has other functionalities related to the controls of said users, as reflected in the system's Manual, contemplated in the proven facts.
- In the report by ***COMPANY.3, "ticketing, "Specific security measures," it is inferred that the respondent has never obtained fingerprints or fingerprint points,
but rather that through the fingerprint sensors ***DEVICE.1, the fingerprint captured is internally encrypted at the time of capture, such that the "software that launches the fingerprint capture request directly receives the encoded data."
1. "LORO PARQUE directly receives encoded data; it does not receive a fingerprint or fingerprint points. Therefore, when the respondent receives encoded data, it does not receive any personal data as defined in Article 4.1 of the GDPR."
Considering that a code or encoded information can identify a person,
the biometric template, even if encoded in its storage, is undoubtedly used for security purposes.
When the fingerprint is entered to access the second park, it is unlocked and the person gains access. This is done because the system verifies, as in
this case, whether there is a stored template that matches the one extracted by the system when
the finger is placed on the reading terminal for the second time. The result is that the
person who accessed the first park and the second park automatically recognizes the
person based on the probabilistic technology used. Remember that when the templates are compared, they deduce a greater or lesser probability that the person will be
identified if this probability exceeds a certain threshold in the system, defined by the
user or system developer (confidence score).
In this context, the EDPB considers it important to remember that Guidelines 5/2022
on the use of facial recognition technology in the field of law enforcement,
whether for authentication or identification purposes, does not provide for a definitive result, but rather
is based on the probability that two faces, or images of faces, correspond to the
same person.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 66/79
The respondent has stated that it authenticates the person and verifies their data, a typical function
of biometric data for control purposes, whether for access, presence, security,
etc. The software used, based on the minutiae of the finger, serves, according to the software manual, to identify or authenticate.
On the other hand, the claim that internal fingerprint encryption at the time of capture, by receiving the data encoded in an encrypted template that is stored, contributes to data anonymization by effectively separating biometric information from any other identifiable information, is not credible. This is because the system continues to allow or confirm the unique identification of said person, which is what the respondent uses it for. Anonymization would, where appropriate, involve the technical application so that it is no longer possible to identify individuals, in which case the GDPR would not apply. Recital 26 of the GDPR states:
“…Therefore, the data protection principles should not apply to anonymous information, that is, information that does not relate to an identified or identifiable natural person, nor to data rendered anonymous in such a way that the data subject is not, or ceases to be, identifiable. Consequently, this Regulation does not apply to the processing of such anonymous information, including for statistical or research purposes.”
A careful reading provides a definition of anonymization. To anonymize any data, it is necessary to remove sufficient elements so that the data subject cannot be identified. Anonymization is a technique applied to personal data to achieve irreversible de-identification.
Finally, biometric data is personal data because it allows the purchaser to be identified when they are the ones accessing the park, and by reference to the tickets they acquire,
any user who accesses the parks using their fingerprints could also be identifiable. Considering that the ticket identification data is assigned by the ticket and access control software program, having this purpose and as functionalities, it is not unreasonable, and it is also possible to identify that other user with data not directly provided by them.
Therefore, the respondent's repeated allegation regarding the
claims that the registration and use of fingerprints for ticket holders are not
associated with any personal data, not even with that of the person who acquires the ticket,
such that they do not identify them per se, nor can they be identifiable, must be assessed.
In this regard, it should be noted:
-The biometric template used by the respondent is likely to allow and confirm the unique identification for access to the parks, and therefore processes the personal data
obtained, it should be added, by the technology that the respondent provides for tickets and access through ***COMPANY.3, with its ticket reservation management and access control contract, which it uses to operate this system by integrating biometric control, as indicated in its Manual (document 3) provided as evidence,
presumably to obtain certain purposes from its use that are explained in said
Manual.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 67/79
-Since these types of tickets are valid for a period of time, which can be established in the requested offer itself, such as 15 days, 6 months, or one year, the park has the technical means, including the contracted software, that would allow for the identification and identifiability of the
person who has entered the park for the first time and will enter the park for the second time, and even after the ticket's validity period has expired.
This results in:
-Each ticket is assigned a QR code on the ticket issued, which bears a number, as well as a tracking number on the tickets, which must be scanned before entering the second park.
This QR code, in addition to the elements
inserted on it, the printed paper bears a numerical code, a date, and a time.
All of this is controlled by the reservation issuance and access control program.
- In addition, the person who purchases the ticket registers their information on the website, which is also managed by the aforementioned system when they purchase it online, through reservations, or through an agency. Tickets are sent to the email address they provide when registering. This way, the user could be correlated with the person accessing the ticket using their information, the assigned date and time, the QR code, and the tracking number. Furthermore, the ticket is purchased for a specific date and time, which is saved in a file belonging to the claimant. The claimant can request an invoice for the purchase. The time of access, the space or location through which the ticket is accessed, how many tickets are associated with the ticket and whether they entered at the same time as the person who purchased the tickets, and the other circumstances listed in the ticket sales and access software manual referred to in the proven facts are also recorded.
Likewise, ticket purchasers who provide contact information on the website are
informed that their purpose is "administrative management: ticket issuance and access control to the venues," emphasizing that the purchase is related to said
access control.
In this case, in addition to what has already been indicated, other entities that
use a standard sample collection system like the one complained about could
have templates generated with the same algorithm, also associating the template with the
identity of the individuals, which would also involve processing personal data, as it could be identifiable.
Contrary to the defendant's statement, the data, which is stored and used, does allow for its association with a person, since it is biometric data of a personal nature and can
also identify or make identifiable users who access the parks, and is processed to confirm the individual's unique identity, so the GDPR regulations would apply.
All of this, without losing sight of the fact that this is a highly intrusive system for the fundamental rights and
freedoms of individuals, due, among other reasons, to the fact that it
operates through artificial intelligence systems that implement algorithms
to design and read the biometric template, in relation to the deficiencies in the
manufacturing standards for approved and certified systems for the software used, in addition to the extent and interoperability of these systems.
As processing activities become increasingly complex, this requires implementing
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 68/79
a compliance model called "accountability," "proactive responsibility," or "accountability."
The principle of "accountability" characterizes, in completely innovative terms,
the entire GDPR system (see, in addition to Article 5 and, among others, Articles 24 to 25, Article 28 and Recitals 74 and 78).
Indeed, the personal data protection system is no longer defined solely as
direct and precise provisions whose non-application entails a sanction, but also
as an objective to be achieved that obliges the controller to demonstrate respect and compliance
with the data processing implemented, the regulation, through the adoption of preventive internal policies and appropriate mechanisms to ensure such compliance;
They must take the form of a series of specific and demonstrable activities aimed at ensuring risk management related to the processing of personal data, to the point that the request to document the options related to achieving the objective with personal data must be made explicit.
This model is data processing-oriented, and its management is based on a risk-based approach. The controller is responsible for ensuring the adoption of measures to manage the risk to the rights and freedoms of data subjects. In the case of high-risk processing, the GDPR establishes that the controller is responsible for carrying out the DPIA, with the advice, where appropriate, of the Data Protection Officer (DPO) (Articles 35 and 39 GDPR).
Thus, prior to any decision to implement a system that involves the processing of biometric data, considering this from the design and by default, it is essential to carry out risk management (Article 24.1 GDPR) and, in accordance with the provisions of Article 25 of the GDPR, data protection by design and by default, to apply appropriate technical and organizational measures to comply with the requirements of the GDPR, protect data subjects, and ensure and demonstrate that the processing complies with the GDPR. In this regard, in line with the defendant's allegations, not only must technical measures related to security be developed or taken into account.
Because even before processing begins, measures must be taken regarding the different processing operations that comprise it, including the concept and design of the processing, data protection policies, transparency policies, data minimization policies, organizational measures, personnel measures, etc., along with safeguards regarding the risk posed by the processing and the high risk it poses to rights and freedoms. Compliance monitoring and related continuous improvement would also be required.
In particular, in the case of high-risk processing, risk management must necessarily include preparing and successfully completing a DPIA.
The DPIA must, among other things:
1. Include and pass the triple test of suitability, necessity, and strict proportionality established in Article 35.7.b and also provided for by the doctrine of the Constitutional Court.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 69/79
2. Verify the existence of any of the conditions provided for in Article
9.2 of the GDPR so that the general prohibition on the
processing of these personal data does not apply.
3. Analyze and conclude that the processing may be carried out in application of
any of the lawful conditions set forth in Article 6 of the GDPR.
4. Adopt appropriate technical and organizational measures to prevent the
risks to the rights and freedoms of individuals present in the processing of personal data from materializing.
These questions regarding the existence of legitimacy for the processing or the exception that
lifts the prohibition of Article 9.2 of the GDPR for the processing of biometric data must be
examined and considered in the DPIA, and there is evidence that the latter has not been
carried out. Furthermore, in this specific case, the respondent did not even prepare a document
to verify a minimum analysis that could be reasoned, analyzing the
components of the processing operations, that it was not its responsibility to carry out such an impact assessment, as it does not even include any assessment of risks to the fundamental rights and duties of users.
It should be noted that any loss of integrity, confidentiality, and
availability with respect to the databases where the templates are stored would be
clearly detrimental to any future application based on the information contained
in said databases, and would also cause irreparable harm to the data subjects, including minors. For example, if the fingerprints of an authorized person were associated with the identity of an unauthorized person, the latter could
access the services available to the owner of the fingerprints, without having
the right to do so. The result would be identity theft, which (regardless of its detection) would undermine the reliability of a person's fingerprints for future applications and, consequently, restrict their freedom. The reality of technology is that every day new forms of social engineering generate new vulnerabilities that appear in the processing environment where biometric operations are implemented. Therefore, it is necessary to consider data breach scenarios and determine the impact a data breach could have on the rights and freedoms of data subjects.
Considering that the respondent has not estimated that it was processing personal data with the system in place, which has been proven not to be the case, it should be noted that the same coded template can be subject to attacks that aim to make it reversible, even if it is coded or encrypted. It is necessary to understand the reality of the type of hacks and breaches in these systems that are already occurring and which ones could determine the inadequacy of the biometric technique or biometrics in general.
This implies a continuous evaluation of the processing based on the events that occur. To this end, since the processing of biometric data is considered high-risk, it would be necessary to first conduct and successfully pass a risk analysis for the rights and freedoms of individuals arising from the processing of personal data through a Data Protection Impact Assessment (DPIA), a process used to reinforce and demonstrate compliance.
VII. Classification of the Violation
The conduct referred to in the above grounds is classified in Article 83.5 a) of the GDPR, which provides: "Violations of the following provisions shall be punished, in accordance with Section 2, with administrative fines of up to €20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the preceding financial year, whichever is greater:
a) The basic principles for processing, including the conditions for consent pursuant to Articles 5, 6, 7, and 9."
For the sole purpose of limitation, Article 72 of the LOPDGDD states: “1. Pursuant to
the provisions of Article 83.5 of Regulation (EU) 2016/679, infringements that constitute a substantial violation of the articles mentioned therein, and in particular the following, are considered very serious and will be subject to a three-year statute of limitations:
“e) The processing of personal data of the categories referred to in Article 9 of
Regulation (EU) 2016/679, without any of the circumstances provided for in
said provision and in Article 9 of this Organic Law occurring.”
Regarding the allegation of the expiration of the file, because the duration date in the initiation agreement is stated as nine months, when it should have been stated as twelve months, the defendant must understand that the duration of the procedure does not derive from the citation—possibly due to a material or factual error. It is a reality independent of any opinion, criterion, or qualification. The initiation agreement signed on 2/10/2023 expressly mentions Article 64 of the LOPDGDD, which is evident, indisputable, and manifest. The lapse is not due to a legal issue, assessment or significance of the facts, evaluation of the evidence, or interpretation of the provisions that may be established, in accordance with the doctrine indicated by the Supreme Court ruling of 4/10/1993, among others.
The last paragraph of Article 64.2 of the LOPDGDD is imperative in this regard: "The procedure shall have a maximum duration of twelve months." months from the date of the
start agreement." Since the start agreement is an act of application of the current regulations,
it cannot be deduced, but rather the one established by the regulations applicable at the time the start agreement was signed, 2/10/2023. Therefore, the
effects claimed by the claimant of expiration and archiving of proceedings that would occur if the factual situation actually occurred, which does not occur, cannot occur, so the
claim cannot prosper.
Regarding the nullity of the procedure for the reason included in Article 47.1.e) of the
LPACAP, which states: "Issues totally and absolutely disregarding the
legally established procedure or the regulations that contain the essential rules
for the formation of the will of the collegiate bodies," according to the respondent, "by imputing
facts related to the processing of personal data in which there is no
identification of the user, of which there is no is responsible, causing defenselessness." It should be noted that this allegation that the Spanish Data Protection Agency is caused defenselessness by initiating a procedure in which it does not process personal data is a theory it defends, but it cannot be grounds for such nullity when it does not specify how it occurs. Its explanations and allegations regarding the system used have been taken into account, which have been considered or refuted with arguments, without this leading to any defenselessness in the opinion of the investigating authority.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 71/79
VIII Determination of the Sanction
The corrective powers available to the Spanish Data Protection Agency,
as the supervisory authority, are established in Article 58.2 of the GDPR. These include the power to impose an administrative fine in accordance with Article 83 of the GDPR - Article 58.2 i)-, or the power to order the controller or processor to ensure that processing operations comply with the provisions of the GDPR, where appropriate, in a specified manner and within a specified period—Article 58.2(d).
Pursuant to Article 83.2 of the GDPR, the measure provided for in Article 58.2(d) of the aforementioned Regulation is compatible with the sanction of an administrative fine.
Determining the appropriate sanction to be imposed in the present case requires observing the provisions of Articles 83.1) and 83.2) of the GDPR, which respectively provide as follows:
“1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each individual case, effective, proportionate, and dissuasive.”
“2. Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures provided for in Article 58(2)(a) to (h) and (j). When deciding whether to impose an administrative fine and its amount in each individual case, due account shall be taken of:
a) the nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them;
b) the intentionality or negligence involved in the infringement;
c) any measures taken by the controller or processor to mitigate the damage suffered by data subjects;
d) the degree of responsibility of the controller or processor, taking into account any technical or organizational measures implemented by them pursuant to Articles
25 and 32;
(e) any previous breach committed by the controller or processor; (f) the extent of cooperation with the supervisory authority to remedy the breach and mitigate the potential adverse effects of the breach;
(g) the categories of personal data affected by the breach;
(h) how the supervisory authority became aware of the breach, in particular whether the controller or processor notified the breach and, if so, to what extent;
(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same matter, compliance with those measures;
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 72/79
j) adherence to codes of conduct pursuant to Article 40 or to certification mechanisms approved pursuant to Article 42, and
k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as
financial benefits obtained or losses avoided, directly or indirectly, through the infringement."
Within this section, the LOPDGDD provides in Article 76, entitled: "Sanctions and corrective measures":
"1. The sanctions provided for in sections 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the grading criteria established in section 2 of the aforementioned article.
2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account:
a) The continuous nature of the infringement.
b) The connection between the offender's activity and the processing of personal data.
c) The benefits obtained as a result of the infringement.
d) The possibility that the affected party's conduct could have led to the infringement.
e) The existence of a merger by absorption process subsequent to the infringement, which cannot be attributed to the acquiring entity.
f) The impact on the rights of minors.
g) Provide, where not mandatory, a data protection officer.
h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms in cases where there are disputes between them and any data subject.
3. It shall be possible, additionally or alternatively, to adopt, where appropriate, the other corrective measures referred to in Article 83.2 of Regulation (EU) 2016/679.
Recital (148) states: In order to strengthen the application of the rules of this Regulation, any breach of this Regulation should be punishable by sanctions, including administrative fines […]. However, special attention must be paid to the nature, severity, and duration of the violation, its intentional nature, the measures taken to mitigate the damages suffered, the degree of liability or any relevant prior violation, the manner in which the supervisory authority became aware of the violation, compliance with measures ordered against the controller or processor, adherence to codes of conduct, and any other aggravating or mitigating circumstances.
[…]»
In accordance with the transcribed provisions, for the purposes of determining the amount of the fines to be imposed in this case, for which the defendant is held responsible, for the violation of Article 9.1 of the GDPR, the following circumstances are deemed to be present:
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 73/79
-83.2.a) of the GDPR” the nature, severity, and duration of the violation, taking into account
the nature, scope, or purpose of the processing operation in question, as well as
the number of data subjects affected and the level of damages they have suffered;”
The defendant owns theme parks open to the public with a varied influx of people, usually the whole family and throughout the year, and collects personal data, including that of minors, affecting all of them. The nature of the processing comes from a leisure service provider, such as a recreational and cultural entertainment service that provides access to the parks, and that did not, nor is there any record of providing an alternative to the use of the biometric system for access, at least with this type of ticket.
The scope is for all people who access the parks, including minors, and for the entire period, since at least August 2022, with no indication that it has been
interrupted due to the receipt of complaints or the processing of this procedure.
Furthermore, at that time, there was no information regarding the use of this system,
and there was no reasonable expectation of such use. Those affected are aware that they are being compelled to provide such data, and that it is being stored, but even when they ask the establishment manager, they are not given any information about who is collecting their data and how it will be used. They are faced with the dilemma of either providing the data to access the establishment or ignoring the importance of their rights that are being violated, which is why an administrative fine is imposed.
Furthermore, the processing of data concerning minors, which the GDPR specifies as
requiring specific protection as a vulnerable group, also qualifies the
very serious nature and degree of unlawfulness of the violation.
-83.2 b) "the intentionality or negligence in the violation." There is no evidence that the
entity acted fraudulently, although the actions reveal a serious and significant lack
of diligence in its conduct, which aggravates the violation due to its unlawfulness due to the
total absence of the required duty. In this regard, we must take into account the statement made in the
National Court's ruling of 10/17/2007 (rec. 63/2006), which, based on the fact that these are entities whose activity involves continuous data processing, states that "...the Supreme Court has held that negligence exists whenever a legal duty of care is
disregarded, that is, when the offender fails to behave with the required diligence. And in assessing the degree of diligence, the professionalism or lack thereof of the subject must be especially considered, and there is no doubt that, in the case now under review, when the appellant's activity involves constant and extensive handling of personal data, rigor and exquisite care must be emphasized to comply with the legal provisions in this regard." The defendant had a registered fingerprint file under the previous LOPD (Data Protection Act) that was supposedly used for the same purposes, which, as such, apparently could contain personal data, as it was declared, and in this case, it initially stated its exclusion from the GDPR's application, without having provided any technical report. This contrasts with the claim that its access system is
compliant with the GDPR and the LOPDGDD (Data Protection Act), when the purpose of this system could have been
achieved in a less intrusive manner with effective alternative measures.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 74/79
The defendant would be required to pay a minimum amount of attention to the implemented access system, which
it appears to use for other types of entrances, and did not take care or concern to carry out an
assessment that took all the elements into account to determine the degree of impact on
the rights at stake, along with the technology and the risks to personal data that are part of a fundamental right of users, including minors, versus the
need or alternatives that exist to verify park visitor passes.
The degree of culpability, while not openly described as intentional, is not mere negligence, and is considered a serious lack of diligence.
Regarding the respondent's claim that it collects biometric fingerprints and fingerprint samples from minors, she has acknowledged this, and there is evidence in the proceedings that this is the case (proven facts first, sixth, and thirteenth). The respondent adds that this data, like the data collected for access purposes, is not personal data because it does not contain or obtain the identity of the data subject, or because the data subject is not identifiable. In this regard, the necessity and proportionality of implementing the measure must first be questioned, and alternative mechanisms for its use must be provided given the minors' immaturity in understanding and exercising their rights. Furthermore, in this case, the minor is uniquely singled out, with a purpose that is fulfilled because it has been in operation at least since the date of the claims, with the use of his or her biometric data being achieved, the creation of a database of his or her biometric templates for accessing a leisure and entertainment facility.
Regarding the claim of lack of culpability, and that "it adopted all means at its disposal to ensure that it did not obtain any personal data of the customers who used said product," or that XELIOS "guaranteed that it did not work with fingerprints but with mathematical representations," in this case, it is not possible to consider what was intended, but rather what has occurred and been carried out and has had its effects, not recently.
The Supreme Court, in its ruling of 10/23/2010 - appeal no. 1.067/2006 states that, "although the culpability of the conduct must also be subject to proof, it must be considered, in order to assume the corresponding burden, that ordinarily the volitional and cognitive elements necessary to assess it are part of the proven typical conduct, and that their exclusion requires proof of the absence of such elements, or, in its normative aspect, that the due diligence required by the person claiming their absence has been exercised; in short, the invocation of the absence of culpability is not sufficient to exonerate oneself from typically unlawful conduct."
Guilty or negligent conduct is considered to exist and appears to be justified, also considering that the subject matter of the sanction is related to the rights
of individuals in the face of unilaterally imposed practices, without taking into account normative considerations or the risks to the rights and freedoms of those affected.
Regarding the respondent's claim that the application of the principle of proportionality and grading criteria set forth in Article 29.3 of the LRJSP must be considered. In this regard, it should be noted that, in this matter, the determination of the applicable regulations, LOPDGDD, Article 76, paragraph 1: "The sanctions provided for in sections 4, 5, and 6 of
Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the grading criteria established in section 2 of the aforementioned article." Article 83.2.1 ("Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article for the infringements of this Regulation indicated in paragraphs 4, 5, and 6 are effective, proportionate, and dissuasive in each individual case"), adding
in paragraph 2 the criteria to be taken into account; meanwhile, Article 76.2 b) specifies the mitigating or aggravating factors to be taken into account, in accordance with Article 83.2 k) GDPR.
The interpretation made in this regard by various CJEU judgments also has a similar effect. An example is that of December 5, 2023, Case C-683/2021, which indicated
regarding the material requirements that a supervisory authority must meet when deciding
to impose an administrative fine on a controller for an infringement indicated in
Articles 4 to 6 of that article, nothing in Article 83, paragraphs 1 to 6 indicates that the
legislator intended to leave such discretion to the Member States. It concludes by stating
that these requirements fall solely within the scope of Union law (paragraphs
61 to 71).
This application of the GDPR respects the principles mentioned in the aforementioned
Article 29.3 of the LRJSP, also taking into account which of the principles comprising it
the respondent would consider to have been violated.
In this regard, no inconsistency is observed with the magnitude of the violation committed and the
known circumstances of the incident, the degree of unlawfulness, and the attitude of the defendant,
given the knowledge of the claims and throughout the processing of this procedure.
Furthermore, the proportionality of sanctions is understood as the appropriateness, according to criteria of justice and equity, between the facts underlying the offense and the determination of the applicable sanction, taking into account the intensity of the fault involved, that is, the degree of intentionality, carelessness, or negligence revealed by the conduct. And of course, a reasoning is required for the judgment of the intensity of the fault involved, which has been detailed here. Furthermore, considering that this amount could increase in accordance
with Article 83.5.a) of the GDPR, which provides for administrative fines of a maximum of €20,000,000 for violations of Article 9 of the GDPR, or, in the case of a company, an amount equivalent to a maximum of 4% of the total annual global turnover of the previous financial year, whichever is higher, and with a net turnover of (...) euros in 2021, the last financial year presented.
Finally, the defendant points out that an unlawful act has been alleged without sufficient evidence,
demonstrating this by requesting various documents and information as evidence, placing the burden of proof of the alleged acts on the defendant.
In this regard, it should be noted that from the outset, responses were given to explanations that did not
contain a minimum of reasonableness, in accordance with the importance of the matter,
considering that it would be sufficient to refer the matter to the files registered in 2010,
a declaratory obligation that is replaced as of May 25, 2018, the date on which the GDPR enters
into force, by the obligation to prepare a record of processing activities
that must contain the information specified in Article 30 of the aforementioned Regulation.
Likewise, the GDPR establishes a catalog of measures that controllers, and
sometimes processors, must implement to ensure that processing is
compliant with the aforementioned GDPR, as well as that they are in a position to demonstrate this.
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 76/79
These proactive accountability measures are as follows:
1. Risk analysis.
2. Data protection by design and by default.
3. Adoption of security measures.
4. Notifications of "data security breaches."
5. Data protection impact assessments.
6. Appointment of the Data Protection Officer.
This has resulted in the need to specifically request information in prior actions to understand the architecture of the implemented biometric recognition system, which would massively affect all people accessing their establishments. Furthermore, given that all tickets issued are non-personally identifiable, and the biometric data process analyzed for access in this file occurs with other types of tickets. However, it should be noted that the burden of proof is not reversed by requesting evidence, in order to better understand the functioning of the
system, which involves various aspects that involve nuances that can contribute to an understanding of the implementation of said system. It is thus agreed that, when the initiation agreement is issued, there is sufficient grounds to support, in principle, the processing of the violation of the conduct reported by at least three
system users.
Under these circumstances, it is estimated that a fine of €250,000 would be appropriate, which does not violate proportionality in relation to the seriousness of the violation committed and the magnitude of the facts, and no grounds for mitigation are apparent.
IX Adoption of Other Corrective Measures
As stated in Article 83.2 of the GDPR: "Administrative fines shall be imposed, depending on the circumstances of each individual case, in addition to or as a substitute for the measures referred to in Article 58(2)(a) to (h) and (j)."
The controller must be required to adopt appropriate measures to bring its actions into compliance with the regulations mentioned in this act, in accordance with the provisions of the aforementioned Article 58.1 of the GDPR, which states:
"Each supervisory authority shall have all of the following corrective powers:
"(d) order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a
specified manner and within a specified period;"
f) impose a temporary or permanent restriction on processing, including prohibiting it;
[…]”
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 77/79
The proposed resolution stated that: “The respondent continues to use fingerprints without a legitimate basis, without complying with the requirements set forth in the GDPR for biometric data, such as, among other things, the preparation and passing of a DPIA or the preparation of the RAT, whose compliance requirements, as developed, would go beyond compliance with said exception that lifts the prohibition regarding the legitimate basis for processing, which affects biometric data as special data with prohibited processing except in certain cases.
It is therefore considered, in order to guarantee the rights and freedoms of data subjects, which, it should not be forgotten, includes minors, that there is a need and justification for adopting powers of attorney. Corrective measures determined to be appropriate and proportional to the
protection of the rights of park users in which the respondent with the TT ticket uses the biometric system analyzed here.
Given that there may be alternatives to such use that are more proportional to the purposes, it is decided to prohibit the processing of the analyzed data."
The proposed measure specified the following: "ORDER LORO PARQUE, S.A., with NIF A38009023, pursuant to Article 58.2.f) of the GDPR, to demonstrate, within 30 days of the decision ending this procedure becoming enforceable, that it has
complied with the measure in legal ground VIII, specifically the prohibition of the processing of the analyzed data."
In its submissions to the proposal, the respondent stated that it has ceased using the access control system for TWIN TICKET-type tickets referred to in this
procedure, without indicating what the new system consisted of, "which could not be enabled overnight," without certifying any of the aspects, nor what these new access controls would be based on, and it is unknown whether biometric data plays any role in the system implemented. Since there is no evidence that the system analyzed has ceased to be used, it is imperative to impose the corrective measure in order to verify exact compliance with the definitive restriction on the processing analyzed.
It is noted that failure to comply with the order to adopt the measures imposed may be considered an administrative violation in accordance with the provisions of the GDPR, classified as a violation in Articles 83.5 and 83.6, and such conduct may lead to the opening of a subsequent administrative sanctioning procedure.
Therefore, in accordance with applicable legislation and having assessed the criteria for graduating sanctions whose existence has been proven,
the Director of the Spanish Data Protection Agency
RESOLVES:
FIRST: TO IMPOSE on LORO PARQUE, S.A., with NIF A38009023, for a violation of
Article 9 of the GDPR, classified in Article 83.5 a) of the GDPR, and classified as very serious
for the sole purposes of the statute of limitations for said violation, in Article 72.1.e) of the
LOPDGDD, a fine of 250,000 euros,
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 78/79
SECOND: TO ORDER LORO PARQUE, S.A., with NIF A38009023, that, in Pursuant to Article 58.2.f) of the GDPR, within 30 days of the resolution terminating this procedure becoming enforceable, the applicant must prove compliance with the measure
under legal ground IX, specifically the prohibition of data processing
analyzed.
THIRD: NOTIFY this resolution to LORO PARQUE, S.A.
FOURTH: This resolution will become enforceable once the deadline for filing the optional appeal for reconsideration (one month from the day following notification of this resolution) expires without the interested party having exercised this right. The sanctioned party is warned that they must pay the imposed sanction once this resolution becomes enforceable, in accordance with the provisions of Article 98.1.b) of the LPACAP, within the voluntary payment period established in Article 10. 68 of the General Collection Regulations, approved
by Royal Decree 939/2005, of July 29, in conjunction with Article 62 of Law 58/2003, of December 17,
by depositing the fine, indicating the sanctioned party's NIF (Tax Identification Number) and the procedure number shown in the heading of this document, into the restricted account IBAN: ES00-
0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX), opened in the name of the
Spanish Data Protection Agency at the banking institution CAIXABANK, S.A. Otherwise, the fine will be collected during the enforcement period.
Once the notification is received and enforced, if the enforcement date falls between the 1st and 15th of each month, inclusive, the deadline for making the voluntary payment will be until the 20th of the following month or the next business day after, and if it falls between the 16th and last day of each month, inclusive, the payment deadline will be until the 5th of the second
following month or the next business day after.
In accordance with the provisions of Article 50 of the LOPDGDD (Organic Law on the Protection of Personal Data), this Resolution will be made public once it has been notified to the interested parties.
Any action against this resolution, which terminates the administrative process pursuant to Art. 48.6 of the LOPDGDD, and in accordance with the provisions of Article 123 of the LPACAP, interested parties may optionally file an appeal for reconsideration with the Director of the Spanish Data Protection Agency within one month from the day following notification of this resolution, or directly file an administrative appeal before the Administrative Litigation Division of the National Court, in accordance with the provisions of Article 25 and Section 5 of the Fourth Additional Provision of Law 29/1998, of July 13, regulating the Administrative Litigation Jurisdiction, within two months from the day following notification of this decision, as provided for in Article 46.1 of the aforementioned Law.
Finally, it is noted that pursuant to the provisions of Art. 90.3 a) of the LPACAP, a final administrative decision may be provisionally suspended if the interested party expresses their intention to file an administrative appeal. If this is the case, the interested party must formally notify this fact in writing to the Spanish Data Protection Agency, submitting it through the Agency's Electronic Registry [https://sedeagpd.gob.es/sede-electronica-web/], or through one of the other registries provided for in article 16.4 of the aforementioned LPACAP. They must also submit to the Agency the documentation proving the effective filing of the administrative appeal. If the Agency does not become aware of the filing of the appeal
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es 79/79
within two months from the day following notification of this resolution, it will terminate the precautionary suspension.
938-16012024
Mar España Martí
Director of the Spanish Data Protection Agency
C/ Jorge Juan, 6 www.aepd.es
28001 – Madrid sedeagpd.gob.es
