AENA and the 10‑Million Fine: Critical GDPR Lessons Your E‑Commerce Cannot Ignore

At the end of November 2025, the Spanish Data Protection Authority (AEPD) imposed a historic fine of more than 10 million euros on AENA for implementing biometric facial recognition systems in eight Spanish airports without properly complying with the GDPR. This sanction, comparable to the one Google received in 2022, is not an isolated event: it is a clear warning that European authorities are stepping up enforcement of data protection regulations, and that non‑compliance with prior requirements—such as the Data Protection Impact Assessment (DPIA)—has catastrophic financial consequences.

For e‑commerce owners, the message is blunt: if a state‑owned multinational like AENA can receive a 7‑digit fine, no online shop is exempt. Even if your business does not use facial recognition, the legal principles where AENA failed apply directly to how you manage customer data, cookies, forms and third‑party providers.

This analysis breaks down what went wrong with AENA and how to apply those lessons to strengthen GDPR compliance in your e‑commerce.

1. The AENA case: Anatomy of a massive GDPR breach

What AENA did and why it was problematic

AENA implemented biometric identification systems (facial recognition) in eight Spanish airports to speed up access to security filters, boarding gates and self bag drop points. The system functioned as an alternative to the traditional documentary verification method.

The central problem, according to the AEPD: AENA processed high‑risk biometric data without adequate justification and without complying with essential prior obligations.

The specific errors identified by the AEPD

The European context: Opinion of the European Data Protection Board

The European Data Protection Board issued an opinion (11/2024) on biometrics in airports, concluding that “the processing cannot comply with the principles of necessity and proportionality” in certain scenarios. AENA fit exactly into that rejected scenario, which means that the AEPD did not only sanction procedural breaches, but also a processing operation that was fundamentally disproportionate.

2. The fine: Magnitude and precedents

10 million euros: A proportionate punishment for AENA’s size

The fine of more than 10 million is the maximum set under the GDPR for this type of infringement (Article 83.4), equivalent to 4% of worldwide annual turnover. For e‑commerce:

• AENA bills around 3,000M/year → 4% = 120M theoretical maximum sanctions

• Your typical online shop → If it bills 1M/year, 4% = 40,000€ fine

• Large shops (10M/year) → 400,000€ fine

Google’s precedent (2022) reinforces that these maximum sanctions are applied to large organizations with gravely disproportionate processing. However, even mid‑sized companies have received 7‑digit fines in other sectors for similar infringements.

Why this figure matters for your business

A GDPR fine is not a “cost of doing business”—it is existential for small and medium‑sized e‑commerce. A 100,000€ sanction can mean:

• Permanent closure

• Impossibility of refinancing

• Legal history that affects future loans or investors

3. Direct lessons for e‑commerce: AENA’s errors your online shop also makes

Lesson 1: The DPIA is not optional; it is mandatory for high‑risk processing

What AENA did wrong: It did not carry out an adequate DPIA before implementing facial recognition. The document lacked risk analysis and did not assess necessity or proportionality.

Does your e‑commerce make this mistake? Yes, if:

• You use Google Analytics, Facebook Pixel or tracking tools without documenting why they are necessary

• You implement customer recommendation or profiling systems without prior risk assessment

• You collect biometric data (even experimentally) without a DPIA

• You change data providers without auditing the impact

Practical application: For any new tool or change in the data flow, document a basic risk assessment by answering:

• What data does it process?

• What is the risk for the customer if it is leaked or misused?

• Is this tool necessary or are there less intrusive alternatives?

• How long do we retain the data?

Wyverton can help: A GDPR audit reduces these assessments to key questions and generates a compliance record.

Lesson 2: Informed consent is not an excuse; it is insufficient without legitimacy

What AENA did wrong: It argued that passengers gave voluntary “informed consent”. The AEPD rejected this because consent is not enough when the processing is disproportionate at its core.

Does your e‑commerce make this mistake? Yes, if:

• You assume that a newsletter checkbox = GDPR compliance

• You use “consent” as a legal basis for marketing when “legitimate interest” should apply

• You do not document that consent is truly voluntary and not coercive

• You ask for consent for data you could process under other clearer legal bases

Practical application: For each type of data, identify the real legal basis:

Lesson 3: Data minimization is non‑negotiable

What AENA did wrong: It collected and stored “many more personal data than traditional methods”—including contents of identification documents it did not need.

Does your e‑commerce make this mistake? Yes, if:

• You store the phone number even though you never call

• You collect the full address when you only need the postal code

• You store all browsing history “just in case”

• You ask for optional data in checkout forms

• You retain inactive customer data for years

Practical application:

1. Map what data you really need for each function (shipping, billing, marketing, analytics).

2. Set specific retention periods:

   • Shipping 3 years (tax limit)

   • Payment delegated to the processor (do not store on your server)

   • Marketing while the customer is active + 1 year

   • Analytics cookies: maximum 13 months

3. Automate deletion when the period expires.

Lesson 4: Consulting the authority without changing anything is negligence

What AENA did wrong: It “consulted the AEPD twice during the pilots, without correcting the breaches detected.” In other words: the authority warned, AENA ignored and went ahead anyway.

Does your e‑commerce make this mistake? Yes, if:

• You received a letter from the DPA and did not take immediate action

• An external auditor pointed out GDPR vulnerabilities that are still present

• You know your cookie banner is not compliant but “it still works”

• You have a generic privacy policy you know is incomplete

Practical application: Implement a GDPR findings resolution process:

1. Prioritization: High risk (immediate), Medium risk (30 days), Low risk (90 days).

2. Assignment: Define owners and budgets.

3. Follow‑up: Track each finding until it is documented as closed.

4. Independence: Consider annual external audits to validate progress.

Lesson 5: Proportionality is a legal criterion, not optional

What AENA did wrong: It implemented 1:N biometric technology—intrusive, expensive, complex—for a use case that could be resolved with traditional document verification.

Does your e‑commerce make this mistake? Yes, if:

• You use 5 tracking tools when 2 would cover your needs

• You store data at the maximum level of detail when aggregated intervals would be enough

• You implement advanced behavioural profiling for a small shop

• You store session‑recording videos of customers “just in case”

Practical application: For each tool or processing activity, ask:

• What problem does it solve? Be specific (not “better analytics” but “reduce cart abandonment from 40% to 35%”).

• Is there a less intrusive solution? Aggregated vs. individualized data, sampling vs. 100%, anonymization vs. pseudonymization.

• Proportionate impact? Does the benefit justify the risk and complexity?

If you cannot answer these questions, it is likely not proportionate.

4. AENA’s specific procedural errors vs. e‑commerce

The deficient risk analysis

AENA submitted a risk analysis that “does not meet the essential requirements”—a key phrase from the AEPD. This means:

• It did not identify what could go wrong

• It did not assess likelihood vs. impact

• It did not evaluate overall vulnerability

For e‑commerce, a minimum risk analysis must include:

1. Confidentiality risks: Data theft, unauthorized access, leaks to competitors.

2. Integrity risks: Data alteration, fraud, manipulation of profiles.

3. Availability risks: Data loss, ransomware, service downtime.

4. Transparency risks: Users not knowing what data you use, how you use it, who sees it.

AENA failed here. Are you better documented?

Lack of contemporaneous documentation

AENA implemented systems in March 2019 but did not prepare an adequate DPIA. Years later, when the audit arrived, the documents did not exist or were insufficient.

For e‑commerce: Document GDPR decisions in real time, not retrospectively:

• When you implement a tool, keep: what it is, why, legal basis, assessed risks.

• When your privacy policy changes, archive previous versions with dates.

• When you reject a tool for GDPR reasons, document why.

• When you resolve a risk, record the solution and who validated it.

Documentation is your defence in audits. AENA did not have it. You can.

5. Operational impact: Beyond the fine

Suspension of systems

The AEPD not only fined AENA; it also temporarily suspended “all processing of biometric data and in particular that relating to the facial recognition identification system until AENA carries out a DPIA under Article 35 of the GDPR”.

For e‑commerce, a GDPR sanction can result in:

• Immediate cease‑and‑desist order on certain data processing

• Blocking tools (such as Google Analytics or Facebook Pixel)

• Operational restrictions in marketing or personalization

• Supervised audits before being allowed to reactivate functions

Imagine losing access to your recommendation engine or analytics for months. That is more costly than the initial fine.

Reputational damage

AENA has already announced that it will appeal. But in the meantime:

• International media will cover the news

• Digital rights associations will use it as a precedent

• Investors/partners will see the company as “risky”

For e‑commerce, a public sanction:

• Affects customer trust

• Generates negative media coverage

• Complicates relationships with banks and providers

• Reduces valuation if you seek investment

6. AENA’s defence and why it will not work (lessons for your e‑commerce)

AENA has argued:

1. “There was no security breach” → The GDPR does not only sanction leaks; it sanctions procedural non‑compliance. AENA lacked both DPIA and risk analysis, regardless of whether data were leaked.

2. “Users gave informed consent” → Consent does not cure processing that is disproportionate at its core. Proportionality is an independent legal requirement.

3. “We complied with all regulatory requirements” → The AEPD found that it did not. The administrative appeal will likely fail because the documentation exists and is insufficient.

For your e‑commerce: These defences will also fail if you use them. Do not rely on:

• “Our lawyer reviewed everything” (without independent auditing)

• “Customers accepted” (without a clear legal basis)

• “There was no impact” (irrelevant under GDPR)

The only solid defence is proactive, documented compliance.

7. Improved GDPR checklist in light of the AENA case

Based on AENA’s errors, strengthen your e‑commerce:

Phase 1: Audit and mapping

• Map ALL data you collect, where it is stored, how long it persists.

• Identify legal basis for each type of processing (contract, consent, legitimate interest, legal obligation, etc.).

• Review each third‑party provider: Google Analytics, Facebook, Mailchimp, Shopify, payment processors, review plugins, etc.

• Verify data processing agreements (DPAs) with each tool.

• Validate DPIA: If you process high‑risk data (profiling, automation, sensitive data), do you have a documented impact assessment?

• Analyse risks: confidentiality, integrity, availability, transparency.

Phase 2: Legal documentation

• Specific privacy policy (not generic): what data, how, how long, who, user rights.

• Updated terms and conditions with GDPR clauses.

• Signed DPAs with each provider.

• Record of processing activities (ROPA): internal document mapping what data you process, legal basis, risks, measures.

• Clear cookie policy: which cookies, why, how to reject, duration.

Phase 3: Technical implementation

• Cookie banner: Explains options, allows rejection without friction, does not activate until consent.

• Checkboxes in forms: Explicit consent, not pre‑ticked, with description of use.

• User rights: Form to request access, rectification, erasure, portability (respond within 30 days).

• Automated retention: Data automatically deleted after the defined period.

• Technical audit: Scan the site with tools such as OneTrust, Complianz or similar.

Phase 4: Continuous monitoring

• Quarterly review of new tools before implementation.

• Annual follow‑up of GDPR compliance.

• Policy updates when processes change.

• Incident log: Record data breaches, rights requests, changes.

8. Tools and resources for post‑AENA e‑commerce

Given that AENA had resources but failed on documentation and analysis, tools that help automate and document are now critical:

Conclusion: The post‑AENA era of GDPR compliance

The 10‑million‑euro AENA case marks a turning point: European authorities are aggressively sanctioning procedural non‑compliance, not just data breaches.

For e‑commerce, the message is clear:

1. Documentation is defence: Without DPIA, risk analysis and contracts in order, any audit can result in catastrophic sanctions.

2. Proportionality is mandatory: It is not enough to “have security”; you must demonstrate that each data point collected is necessary, appropriate and proportionate.

3. Consultations without action are negligence: If an authority warns you, act immediately.

4. Consent does not cure disproportion: Assuming checkbox + privacy policy = compliance repeats AENA’s error.

5. Fines are growing: From Google (2022, 10M) to AENA (2025, 10M+), maximum sanctions are being applied in serious cases, and even mid‑sized companies see 7‑digit fines.

The good news: Unlike AENA (which only discovered its problems after an audit), you can be proactive. A GDPR audit of your e‑commerce this week can identify and resolve the same errors that led AENA to a historic sanction.

Next steps

1. Carry out a GDPR audit of your online shop: data collected, legal bases, providers, risks.

2. Prioritize findings by severity: critical risks vs. medium‑term improvements.

3. Implement core documentation: basic DPIA, risk analysis, ROPA.

4. Configure technical controls: cookie banner, clear checkboxes, user rights.

5. Schedule annual audits to maintain compliance and anticipate future regulations.

The cost of an audit is marginal compared to 10 million in sanctions. Do not repeat AENA’s mistakes.

Is your e‑commerce ready for the level of regulatory scrutiny seen in 2025?

Access Wyverton’s GDPR audit (report in less than 2 minutes) and receive a detailed analysis of your compliance gaps, specific risks and a prioritized roadmap of solutions.

→ Get your free GDPR audit here