Cybersecurity Policy Report, Italian Regulator: Facial Recognition System at Airport Violates GDPR, (Apr 17, 2026)
By Tony Foley
In its latest newsletter, Garante, the Italian data protection authority, announced the release of a decision reached last month in which it found that the processing of facial recognition data via a system operated by a company at Milan’s airport violated the European Union’s General Data Protection Regulation (GDPR).
The decision from Garante noted that Esercizi Aeroportuali SEA (SEA) informed the agency in May 2024 that it planned to install a facial recognition system called ‘FaceBoarding” at the Milan Linate Airport. Later that month, the European Data Protection Board (EDPB) issued Opinion 11/2024 on the use of facial recognition to streamline airport passenger flow in compliance with the GDPR. In that opinion, the EDPB identified a variety of scenarios in which such processing would and would not comply with GDPR requirements. Garante took this opinion into account in reaching its conclusion regarding SEA’s processing activities.
Specifically, Garante launched an investigation to verify which of the scenarios presented in Opinion 11/2024 the FaceBoarding system could be traced back to. The agency found that the FaceBoarding system provided for the storage of passengers’ biometric templates in a central location at the airport operator, meaning that SEA could not guarantee that data subjects, as required by Opinion 11/2024, had exclusive control over their biometric data, in violation of articles 5(1)(f), 25, and 32 of the GDPR. Garante found that the system required passengers’ biometric model to be stored centrally on SEA’s servers, both when registration takes place at an airport kiosk or when it is performed via SEA’s app.
Garante further found the following:
SEA had not adopted encryption measures for the storage of biometric templates in its systems, resulting in inadequate security under GDPR article 32;
SEA’s information notice to passengers incorrectly stated that the biometric template was stored solely on the subject’s mobile device, when in fact Garante’s inspection revealed that it was stored on SEA’s servers, resulting in a violation of the transparency requirement of GDPR article 13; and
SEA improperly processed (and briefly stored) data of passengers who, despite not using the FaceBoarding system, used dedicated hybrid checkpoints at security entrances, despite passengers never having given consent to the processing as required under GDPR article 6.
Given that SEA ceased all processing of biometric data through the FaceBoarding system in September 2025 and deleted all data gathered by the system, Garante decided not to pursue further corrective measures against the company.
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR