Facial recognition is a biometric technology that identifies a person by analysing the unique features of their face and comparing them against a reference database, all within fractions of a second. Its use in access control (including security in shopping centres and their car parks) is growing rapidly, but it comes with a demanding regulatory framework: the GDPR, the EU AI Act and the criteria of the Spanish Data Protection Agency (AEPD) set out precise conditions that any operator must know before deploying it.
The whole process unfolds in three phases that, in today’s systems, run in milliseconds:
Facial recognition systems operate in two modes with different technical and legal implications:
| Mode | How does it work? | Typical use |
|---|---|---|
| Verification (1:1) | Compares the captured face with a single template previously registered in that person’s name. | Private car park access, employee control. |
| Identification (1:N) | Compares the face against the entire database looking for a match. | Surveillance in public spaces (use highly restricted by regulation). |
In private access control environments, such as a corporate car park or a shopping centre car park, 1:1 verification mode is the standard. It is more accurate, faster and, above all, easier to justify under data protection regulations.
A common question is whether a photograph or a screen can fool the system. The answer is no, with today’s professional terminals. Anti-spoofing technology combines the visible-spectrum camera with the infrared sensor to analyse depth, skin surface temperature and three-dimensional volumes. A flat image, printed or on a screen, does not reproduce these physical properties, so the system rejects it immediately.
Contactless access control has a clear operational advantage in high-traffic facilities: it eliminates queues at the entrance, removes cards and remotes that get lost or lent, and provides exact traceability of who enters and when. The most widespread applications in the sector include:
Facial recognition operates on biometric data, which places it in the highest protection category under European law. Three rules make up the framework in force in Spain in 2026.
The General Data Protection Regulation classifies biometric data as a special category in Article 9, alongside health data, ethnic origin or ideology. This means that its processing is prohibited by default, unless one of the exhaustive exceptions in Article 9.2 applies.
In practice, for a car park operator or a shopping centre manager, there are two applicable exceptions:
Facial biometric data also has a feature that makes it especially sensitive: it is irrevocable. If a password leaks, it can be changed; if a faceprint leaks, the person cannot change their face.
The EU Artificial Intelligence Act, in force since August 2024 with phased application until August 2026, introduces a classification by risk levels with direct consequences for any system that uses biometrics:
Non-compliance with the AI Act can lead to penalties, independent of those under the GDPR, of up to €20 million or 4% of annual worldwide turnover.
The Spanish Data Protection Agency (AEPD), in line with the criteria of the European Data Protection Board (EDPB), applies a strict necessity and proportionality test to any biometric processing.
Organic Law 3/2018 (LOPDGDD) supplements the GDPR in Spain and reinforces the requirements for transparency, proactive information to the user and the provision of channels to exercise rights.
Yes, but with conditions. The key distinction between what is allowed and what is not is context and purpose:
To deploy facial recognition in a compliant way in 2026, the operator must meet at least these requirements:
Not in systems designed to comply with the GDPR. What is stored is a mathematical template, the faceprint, which does not allow the original image to be reconstructed. Captured images are discarded after verification and are not stored in the car park’s infrastructure.
Current deep learning algorithms achieve error rates below 0.1% under controlled conditions. In the case of identical twins, accuracy depends on the model: the most advanced systems, based on 3D analysis and infrared sensors, can tell them apart because they process micro-differences in texture and depth that are not visible to the naked eye.
Verification (1:1) compares the face with a single template linked to an already registered person, such as confirming that whoever is driving the authorised car is actually the season-ticket holder. Identification (1:N) searches for the individual across the whole database without knowing who they are. European regulation is far more restrictive with 1:N identification, especially in publicly accessible spaces.
Not as a general rule. The AI Act’s prohibition focuses on real-time remote biometric identification in publicly accessible spaces by law enforcement authorities. 1:1 verification systems in private facilities are classified as high risk, which imposes additional requirements (registration, auditing, human oversight), but does not ban them.
Yes. Systems such as Meypar’s EVO FaceDrive Gate facial recognition for car parks combine facial identification of the driver with automatic licence plate reading of the vehicle, offering double validation at the access point without storing images in the car park’s infrastructure.
On April 21 and 22, Meypar Peru will be present at the 23rd International Retail Congress, one of the most relevant forums in the retail sector in Latin America, organized by Seminarium Peru. The event will take place at The Westin Lima Hotel and will bring together executives, managers, and professionals from operations, technology, marketing, […]
Read more
Intertraffic Amsterdam 2026 has closed its doors after three days of intense activity, bringing together 30,000 mobility professionals from more than 140 countries. With 900 exhibitors across 12 halls and more than 300 sessions led by international experts, the event once again confirms its position as the world’s leading meeting point for traffic solutions, mobility, […]
Read more