Loro Parque fined €250,000 over use of visitors’ fingerprints
The Spanish Data Protection Agency (AEPD) has fined Loro Parque S.A. €250,000 for what it considers a “very serious” breach of Article 9 of the General Data Protection Regulation (GDPR).
The sanction relates to the park’s use of visitors’ fingerprints as part of its entry system, which the AEPD deemed to be the processing of biometric data, a category of personal data subject to special protection under European law.
The case began in 2022 when three visitors filed complaints after being required to register their fingerprint in order to use the “Twin Ticket”, a combined pass granting entry to both Loro Parque and Siam Park on different days. The complainants said they were given no prior information and no alternative method to verify their ticket.
According to the complaints, access to the second park was only possible if the fingerprint matched in a specific reader at the gate.
Loro Parque argued that it did not process personal data because the system did not store actual fingerprint images, only encrypted mathematical templates that were automatically deleted when the ticket expired. The company maintained these could not be used to recreate the fingerprint or identify an individual, citing GDPR provisions on anonymised data.
However, the AEPD rejected this defence, stating that under GDPR Article 4.14, biometric data includes any technical process that identifies or confirms a person’s identity through physical characteristics. In this case, the fingerprint template was used specifically to verify that the same individual entered both parks, meaning it retained an identifying function.
The agency also stressed that encryption and the absence of a name on the ticket do not remove the classification as personal data if the information can be linked to an individual in a specific context.
The AEPD found that the fingerprint system was also used for other ticket types, and that online purchases required names, email addresses, and phone numbers. It concluded the method was disproportionate, as no evidence was provided to show that less intrusive alternatives were unavailable.
In addition to the fine, Loro Parque has been ordered to adopt corrective measures to ensure compliance with data protection regulations.
Share:
