The Spanish Data Protection Agency is an independent agency of the government of Spain which oversees the compliance with the legal provisions on the protection of personal data. From Wikipedia
The AEPD imposed the penalty after Sidecu SA acknowledged violating GDPR Article 9 to compel an overhaul of the chain’s facial-recognition access.
