Supermarket chain faces GDPR probe over facial recognition system

Spanish data regulator launches inquiry just four days after AI system's rollout

Spanish supermarket chain Mercadona is under investigation by the country’s data protection regulator over the use of a new facial recognition system in 40 of its stores.

The company introduced the AI-powered facial recognition system on 2 July in the cities of Zaragoza and Mallorca, as well as its home city of Valencia.

As reported by The Local es, the “early detection system”, as the company is calling it, is intended to detect people who have restraining orders issued against them preventing them from entering Mercadona shops or contacting members of staff, or who have been convicted of offences such as shoplifting.

When it rolled out the system, the company explained that no information on other customers will be stored and that footage is deleted after 0.3 seconds, or “in the blink of an eye."

It’s clear the supermarket believes these measures are enough to comply with GDPR, which came into force across the European Union in 2018. Biometric data, however, is regarded as a “special category” of personal data and is considered to be particularly sensitive, which affords it extra protections under the regulation.

In light of this, the Spanish Data Protection Agency (AEPD) launched an official investigation into the use of this technology last week, following reports in the media about it.

"Mercadona has provided the agency with some initial information about the facial recognition initiative in its establishments, and the AEPD has expressed reservations about its compliance with data protection regulations," a spokesperson told IT Pro."

"We are in the preliminary stages of the investigation, so are unable to give any further information about it," they added.

Mercadona, however, told Spanish newspaper El País on 6 July that it had “no record of a file being opened by the agency”, but that it had contacted the AEPD itself, sending “all the information about the project” to the regulator and acting with “total transparency”.

Related Resource

The IT Pro Podcast: Happy birthday GDPR

As GDPR turns two, we look back on its impact and how it’s changed data protection - if at all

Listen now

“We will continue to provide any information that is requested from us,” the company added.

The use of facial recognition software is increasingly controversial and is known to throw up false positives, particularly when the subject is female or has darker skin. In response to both this and potential privacy violations, some local authorities, notably in the US, have prohibited the use of facial recognition software.

Some technology companies have followed suit, with IBM announcing it has stopped working on commercial facial recognition AI altogether, while Amazon has put development on pause.

IT Pro has contacted both AEPD and Mercadona for comment but hadn’t received a response at the time of publication

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

The smart buyer’s guide to flash

Find out whether flash storage is right for your business

Download now

How MSPs build outperforming sales teams

The definitive guide to sales

Download now

The business guide to ransomware

Everything you need to know to keep your company afloat

Download now

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021