Industry trade group GSMA was slapped with a fine from Spain’s data protection agency tied to the lack of sufficient detail in paperwork filed by the organization for how it would manage personal registration and facial recognition data collected from attendees at the MWC Barcelona 2021 event. That information is accessible by a Hong Kong-based vendor used by GSMA in that special administration region of China.

GSMA, which organizes the mobile telecom-focused MWC events, was cited by Spain’s Data Protection Agency (AEPD) for what it termed "nominal" information from a required data protection impact assessment from GSMA on the risks associated with and the need to collect attendee data. That impact assessment is required by the European Union’s General Data Protection Regulation (GDPR), with published reports linking AEPD's concerns to specific registration and facial recognition data from GSMA's Biometric Recognition Easy Entry Zone (BREEZ) service used at the MWC 2021 Barcelona event.

GSMA was fined approximately $220,000 for the lack of proper documentation.

GSMA noted in a statement that the BREEZ facial recognition technology was “an option for attendees at MWC 2021 as part of a comprehensive health and safety program.” The vague statement mostly focused on GSMA stating the AEPD finding was not tied to any breach of the organization’s collected information.

The MWC 2021 event was the first run after the previous year’s event was cancelled due to the COVID-19 pandemic, and itself was delayed by a few months in order to work through slowly loosening travel delays. GSMA at the time reported around 20,000 in-person attendees for the MWC Barcelona 2021 event.

“The GSMA will continue to cooperate with the AEPD and is reviewing the resolution and considering options to respond,” the organization added.

GSMA initially began using its BREEZ technology at the MWC Barcelona 2019 event, touting that more than 40% of that year’s more than 109,000 telecom-hungry in-person attendees used the facial recognition service. The service has been used at subsequent MWC Barcelona events.

GSMA notes in an FAQ for its BREEZ service that the facial recognition software analyzes facial features by taking measurements of “data points that make up the face.” It processes that information to create a “real-time map” of the attendee’s face, which is then compared to the passport or EU ID card required by GSMA for registration.

This security requirement was questioned by Dr. Anastasia Dedyukhina, a speaker at the 2021 event, in a recent LinkedIn post questioned GSMA’s need for personal data to register for the event.

“The organizers asked me to upload biometric data (passport) online in order to verify my identity, which I refused because I could not find a reasonable justification for it,” Dr. Dedyukhina wrote. “Their website suggested that I could also bring my ID/passport for in-person verification, which I didn't mind. However, the organizers insisted that unless I upload my passport details, I could not attend the live event and would need to join virtually, which I ended up doing.”

GSMA’s BREEZ FAQ also states that the data used to create the real-time map of an attendee’s face is converted into a “secure anonymous data pattern using a complex algorithm to create” a biometric token. That token is “stored and retained in the European Union” and “securely destroyed within 28 days of the final day of the event.” GSMA adds that each biometric token is encrypted and stored separately from “raw data used in its creation.”

However, GSMA also notes the biometric data is disclosed to Hong Kong-based firm ScanVis Ltd., “which is the supplier who carries out the facial recognition activities for the event. ScanVis Ltd. is based in Hong Kong and this means that your biometric data will be accessed from a location in Hong Kong.”

GSMA’s most recent MWC Barcelona 2023 event was also marred by controversy tied to reports that China-based telecom vendor Huawei might have been able to track visitors to its extensive booth. Huawei is one of the world's largest telecom vendors, but has been bared from providing telecom equipment to a number of Western countries over security concerns.

LightReading’s Iain Morris reported that booth-specific badges included an electronic chip and vague wording about the use of RFID and Bluetooth technology “to collect the swipe time of this Huawei Card at the entrance of Huawei exhibition area, real-time location information and the residence time information of this Huawei Card holders within Huawei exhibition area.”

CORRECTION: This story and headline has been corrected to show that the amount of the fine was approximately $220,000 and not $220 million.

CLARIFICATION: The story and headline have been clarified to note the fine was tied to GSMA's lack of detail in filing of paperwork related to how it would manage attendee data.