If you, as a passenger, have opted voluntarily to use the biometric system that appears on the devices located at the airport, and features on the Aena and the AIRLINE apps, the data received by this system will be processed by Aena for the following purposes:
(1) to improve your passenger experience by facilitating faster and more convenient access via security checkpoints by eliminating the need to show documentation at the different access points. This process involves the identification of the passenger by Aena. Although this is not done by traditional means, the voluntary use of this system will mean that Aena will identify the passenger during this airport process, thereby reducing the time passengers usually spend looking for their documents at the access point (you will not need to wait for the previous passenger to look for their documents), and increasing their comfort as they do not need to show their boarding pass to the readers.
(2) to improve the security processes applicable to the identification and monitoring of passengers boarding aircraft.
The ultimate purpose is to verify passengers’ identity through facial recognition in the security checkpoint and boarding processes at Aena airports that have this system, managing their access to these controls with higher levels of security, efficiency and effectiveness than those achieved by the identity verification methods currently used.
The legitimate basis for the processing of your personal data is the express consent that you freely give by registering with this system, which you may revoke at any time by sending an email to the following address: ocpd@aena.es (please include the identification number of your official identity document in your message).
This consent is given jointly for all these processes, since they are complementary and none would exist without the others.
To achieve those aims, the following operations are carried out:
- (i) Registration in the biometric database of Aena, as the data controller: processing of the user's data, including biometric data, to register his or her information in the biometric database and to carry out the relevant comparison of the photo from the identity document with the image of the user obtained at that time, to verify his or her identity (authentication by means of 1:1 comparison) and also that he or she is the owner of the identity document, with the resulting biometric data being discarded and only the selfie image and the identification data being saved. We will send you an email acknowledging receipt of your registration.
- (ii) When you are going to obtain your boarding card from an AIRLINE subscribed to this service, that airline will request your consent to consult Aena regarding your registration and, if you are registered, send Aena your boarding card, such that, from then on, for as long as you do not withdraw the consent given to the airline or ask to be removed from the system, Aena will receive the details of your boarding cards (current and future). In no event will the airline have access to your biometric data. We will send you an email each time we receive a boarding card from your airline to inform you that you can, if you wish, use this service on your flight. After receiving the details of your boarding card from your AIRLINE, Aena, as mentioned above, will associate it with your identification data for the flight in question. Such processing is based on the consent given to your AIRLINE, as mentioned above, which you will be able to revoke at any time using the channels provided for that purpose.
- (iii) On the day of your flight, when you appear at the airport in front one of the devices identified as ‘facial recognition’ devices, we will automatically verify your identity at the security/biometric identity checkpoints, managed by Aena, using the biometric database. This phase implies the use of your biometric facial recognition data and is based on your express consent, as mentioned above, which you will be able to revoke at any time, also as mentioned above. With regard to the biometric facial recognition data, they will be processed during this phase by AENA when you appear physically at the airport and at one of the biometric gates, by comparing the image of you obtained at the biometric gate with the images registered in the biometric database and obtained previously by AENA (identification by means of 1:N comparison), for the purposes of allowing you to pass through security checkpoints and/or boarding gates.
- (iv) Verification and communication to the AIRLINE, by Aena, of your data (non-biometric) and boarding card when checking in and boarding: data processing whereby the AIRLINE validates the boarding card, relying on the identity check carried out by Aena, who communicates the identification data, flight information and the result of the identity check (only if the check has been successful or not, without transferring biometric data).
All these operations are based on your express consent as indicated above, which you may withdraw at any time, as indicated, such that by giving your consent, you consent to all these operations, all of which are necessary for the biometric management of your journey through the minimum and essential airport processes (passage through the security checkpoints and passage through the boarding gate associated with your flight) for the effective completion of your journey.
We will use the email address you provided to us or, if applicable, the one you used to register as an Aena Club member, to send you only operational emails related to this service, such as a welcome email as an acknowledgement of receipt, informing you that your registration in the system has been successful and indicating the next steps; and emails whenever we receive a boarding pass to let you know that you can board your flight biometrically if you wish, and to let you know that your identification document is about to expire so that you can re-register or update it with a new document.
In addition, Aena will carry out the following forms of processing:
- (i) AENA will process your boarding pass data to control access through security checkpoints based on compliance with a legal obligation applicable to AENA to monitor access to restricted areas (National Security Programme for Civil Aviation based on the Aviation Security Act).
- (ii) Within the framework of the new identification system implemented in Spanish airports, and specifically at the security checkpoints and boarding gates, AENA will process the following categories and types of personal data collected throughout the biometric system process: identification data, boarding passes, access data and selfie photographs, NFC chip and photographs taken at the gates, and only the numerical data of the percentage of match obtained when comparing them, only for the purpose of adjusting this percentage in the system during the first months of implementation, and never the biometric data itself.
The purposes of this processing of personal data will be (i) the resolution of incidents, (ii) statistical uses for the improvement and monitoring of the service and (iii) the adjustment of the configurable parameters of the service, based on AENA's legitimate interest in evaluating the efficiency, viability and improvement of the user experience and of the service itself.
In this regard, AENA guarantees that in no case will your biometric data be processed for the purposes described in the previous paragraph, the processing being limited to the personal data previously mentioned.
Prior to carrying out the processing of your personal data for the purposes indicated in the previous paragraph, we weighed up your right to data protection against our interest in carrying out this type of analysis to improve the user experience and the service itself (obtaining information on the number of passengers that have checked in via Aena's or the airline's apps, the number of passengers on a given flight or route that have used the biometric gates at the checkpoints or boarding gates, the number of passengers who have checked in correctly, the fine-tuning of the system in the photo-matching processes and only during the first months of implementation of the system, etc., and all this by means of a process of anonymisation by means of removing any data that allows for identification, through processes of deletion, aggregation or replacement of these data with others that cannot be associated with a natural person), concluding that this processing, which does not involve the processing of biometric data or automated decisions, gives rise to a reasonable expectation on the part of passengers.
The processing of your personal data for the purposes described in this section allows AENA, in general terms, to identify areas for improvement in its own service at the airport, to try to reduce waiting times as much as possible, both at the security checkpoint and at the boarding gate controls, to ensure the agility of the new identification system, to measure the degree of efficiency of the system, etc. This processing is therefore clearly in your interest, as it aims to provide you with a better service and user experience.
In view of the above, AENA, while respecting your rights and freedoms, and in particular your fundamental right to the protection of personal data, considers that this processing is in your interest and for your benefit.
However, you can exercise your right of opposition by sending an email to dpd@aena.es.
Likewise, if you wish to know more details about the balancing exercise between your rights and freedoms and the legitimate interest of AENA, you can contact the Data Protection Delegate at the following email address dpd@aena.es.