Regulations & Safety
Italy Suspends Facial Recognition at Milan Airport Over Privacy Concerns
Italy halts facial recognition at Milan Linate airport citing GDPR non-compliance and passenger consent issues, impacting EU biometric regulations.
Italy’s Suspension of Facial Recognition at Milan Airport: A Critical Analysis of Privacy, Security, and the Future of Biometric Technology in European Aviation
Italy’s privacy watchdog, the Garante per la Protezione dei Dati Personali, has temporarily suspended the use of facial recognition technology at Milan’s Linate airport, marking a significant moment in the ongoing global debate over biometric surveillance in aviation security. This decision, announced on September 17, 2025, represents the latest development in a complex regulatory landscape where privacy rights increasingly clash with technological innovation and security imperatives. The suspension affects the “FaceBoarding” system, which had been operational since May 2024 and was designed to streamline passenger processing through automated identity verification. The Garante justified its action by citing insufficient safeguards to prevent the system from processing biometric data of passengers who had not explicitly consented to participate. This case illuminates broader tensions within the European Union regarding the deployment of artificial intelligence and biometric technologies in public spaces, particularly as the bloc continues to refine its regulatory approach through instruments like the General Data Protection Regulation and the emerging AI Act.
The implications of this suspension extend far beyond a single airport, touching on fundamental questions about digital privacy, algorithmic accountability, and the balance between technological efficiency and individual rights in an increasingly connected world. As Airports globally race to implement biometric solutions for security and operational efficiency, the Milan case serves as a critical reference point for regulators, industry leaders, and privacy advocates alike.
Background and Historical Context of Biometric Technology in Aviation
The integration of biometric technology into aviation security reflects a convergence of technological advancement and evolving policy frameworks. Following the September 11, 2001 attacks, airports worldwide began adopting increasingly sophisticated security measures, with biometric identification, such as facial recognition, emerging as a preferred solution to enhance both security and passenger flow. In the United States, the Transportation Security Administration (TSA) pioneered early applications, deploying facial recognition at more than 80 airports as part of its Credential Authentication Technology program. These systems operate by capturing real-time images of travelers and comparing them against scanned identification documents, with reported high accuracy rates.
In contrast, European adoption of airport biometrics has been more cautious, shaped by the General Data Protection Regulation (GDPR) that came into force in 2018. The GDPR classifies biometric data as a special category of personal information, subject to enhanced protection. The European Data Protection Board (EDPB) has issued comprehensive guidance, emphasizing that biometric data processing “entails heightened risks to data subjects’ rights and freedoms” and requires the highest level of justification for deployment. This has led to a more measured approach, with regulatory oversight at the forefront of any biometric implementation in the EU.
Milan Linate’s FaceBoarding system, launched in May 2024 after years of regulatory review, is emblematic of the European approach. The technology was presented to authorities in 2019 and underwent several modifications to comply with privacy expectations. The global market for airport biometric services continues to grow rapidly, with estimates ranging from USD 26.4 billion in 2023 to over USD 100 billion by 2032, yet regional adoption rates and regulatory frameworks vary significantly.
The Milan Linate Airport Case: Key Facts and Timeline
The suspension at Milan Linate followed a multi-year regulatory process. SEA Milan Airports, the operator of both Milan Malpensa and Milan Linate, introduced the FaceBoarding system as a voluntary, opt-in service for adults. Passengers could register at kiosks or via a mobile app, with the promise of encrypted data storage and deletion after use. The system was designed to allow seamless passage through security and boarding without physical documents.
Despite these safeguards, the Italian Data Protection Authority determined that insufficient mechanisms were in place to prevent biometric data processing of non-consenting passengers. This action was influenced by EDPB Opinion 11/2024, which set out strict requirements for biometric data handling. SEA Milan Airports responded by affirming its compliance efforts and cooperation with regulators, emphasizing that the service was voluntary and only available to registered adults.
The suspension underscores the difficulties in aligning technological innovation with evolving privacy standards. Even with opt-in participation, the system was found lacking in transparency and control, reflecting the high bar set by European regulators for biometric data processing.
“Individuals should have maximum control over their own biometric data.”
, European Data Protection Board, Opinion 11/2024
European Regulatory Framework and GDPR Compliance
The GDPR’s special classification of biometric data means that airport operators must implement robust technical and organizational measures to ensure data security and privacy. EDPB’s guidance distinguishes between different storage models, with only decentralized or passenger-controlled storage deemed potentially compatible with GDPR. Centralized storage, even with encryption, raises concerns about unauthorized access and misuse.
The Italian Garante has been a prominent enforcer of GDPR, with over 484 enforcement actions and more than EUR 300 million in sanctions as of late 2024. The Authority’s decision in the Milan case reflects a broader trend in Europe: a preference for privacy by design and default, and skepticism toward even voluntary biometric systems unless all risks are fully mitigated.
With the introduction of the EU Artificial Intelligence Act, further restrictions on biometric surveillance in public spaces are anticipated. The Act prohibits real-time biometric identification except in narrowly defined circumstances, signaling an even more cautious approach to such technologies in European airports.
Global Airport Biometrics Market and Industry Trends
The airport biometric services market is experiencing rapid growth, with projections of substantial increases in market value over the coming decade. North America leads in adoption, driven by advanced infrastructure and government support, while Asia-Pacific and the Middle East are seeing accelerated growth due to modernization and expansion of air travel. In these regions, biometric systems are often integrated with broader digital transformation initiatives.
European markets, however, face unique regulatory challenges. The GDPR and AI Act create a complex compliance environment, requiring technology providers to develop solutions that prioritize privacy and consent. The competitive landscape includes major companies such as IDEMIA, Thales, NEC, and Vision-Box, all of which are investing in privacy-preserving technologies to meet diverse regulatory requirements.
The COVID-19 pandemic further accelerated demand for contactless processing technologies, making biometric solutions more attractive to both airport operators and travelers. However, the uneven regulatory landscape means that implementation strategies must be tailored to local legal and cultural expectations.
“The global airport biometric services market is projected to reach over USD 100 billion by 2032, but regional adoption is shaped by privacy regulations and public trust.”
Privacy Concerns and Data Protection Challenges
Facial recognition in airports raises profound privacy issues. Biometric data is immutable, once compromised, it cannot be changed. The EDPB highlights the heightened risks of biometric processing, especially in environments where individuals may feel compelled to participate, such as airports. Even opt-in systems can be problematic if consent is not fully informed or freely given.
Accuracy and bias are additional concerns. Studies show that facial recognition systems can have higher error rates for certain demographic groups, raising the risk of discrimination. The European Commission against Racism and Intolerance has warned of the potential for misidentification and racial profiling.
Security breaches involving biometric data have already occurred. For example, in 2019, a U.S. Customs and Border Protection subcontractor’s breach led to traveler images being leaked online. Such incidents highlight the need for rigorous security practices and supply chain oversight in biometric system deployments.
Comparative Analysis: International Approaches to Airport Biometrics
Approaches to airport biometrics vary widely. The U.S. TSA has aggressively expanded facial recognition, with opt-out provisions but differing data retention policies for citizens and non-citizens. European regulators require higher standards of consent and data minimization, often favoring decentralized storage and voluntary participation.
In Hungary, legislative changes have broadened the use of facial recognition beyond airports, raising concerns about surveillance of peaceful demonstrations and minor infractions. Asian and Middle Eastern airports often integrate biometrics into smart city initiatives, with fewer privacy protections than in Europe.
These differences reflect underlying legal, cultural, and policy variations. The Milan Linate case is a clear example of the European preference for stringent privacy safeguards, in contrast to more permissive environments elsewhere.
Expert Perspectives and Industry Response
SEA Milan Airports maintains that its FaceBoarding system complied with Regulations and stresses its cooperation with authorities. Industry players like IDEMIA and Thales argue that privacy-preserving architectures can enable secure and efficient biometric processing, while privacy advocates such as NOYB emphasize the need for strict consent standards and warn against commercial overreach.
The EDPB and other regulatory bodies urge airport operators to consider less intrusive alternatives, and civil society organizations warn of “function creep”, the gradual expansion of surveillance technologies into broader public spaces. Academic researchers continue to highlight technical limitations and social implications, particularly regarding accuracy and bias.
The debate over biometric technology in airports is thus multifaceted, involving operational, ethical, and legal considerations. The Milan suspension has amplified these discussions and is likely to influence future regulatory and industry strategies.
“Biometric identification systems should only be deployed where strictly necessary, and with the highest standards of privacy protection.”
, European Data Protection Board
Future Implications and Regulatory Evolution
The Milan Linate suspension signals a shift toward more stringent oversight of biometric technologies in Europe. The evolving regulatory framework, including the Artificial Intelligence Act, will likely require even more robust consent mechanisms, transparency, and technical safeguards for future deployments. Operators must demonstrate that biometric processing is necessary and proportionate, not merely convenient.
International coordination remains a challenge, as Airlines and airports serving global travelers must navigate a patchwork of regulatory regimes. Technological innovation in privacy-preserving authentication may offer alternatives, but the bar for compliance is rising. The influence of privacy advocates and civil society organizations is set to grow, ensuring sustained scrutiny of biometric surveillance in public spaces.
Conclusion
The decision to suspend facial recognition at Milan Linate airport is a landmark in the ongoing tension between technological innovation and privacy protection. It demonstrates that even voluntary, opt-in systems with privacy safeguards can fall short of evolving European standards if they lack adequate transparency and control mechanisms. The case underscores the importance of robust regulatory oversight and the need for continuous adaptation as both technology and societal expectations evolve.
As the global market for airport biometrics continues to expand, the Milan case will serve as a reference for future deployments, regulatory actions, and public debates. The path forward will require a delicate balance between operational efficiency, security imperatives, and the fundamental rights of individuals, a challenge that will shape the future of aviation and digital privacy for years to come.
FAQ
Why was facial recognition suspended at Milan Linate airport?
Italy’s privacy watchdog suspended the technology due to insufficient safeguards to prevent the processing of biometric data from passengers who had not explicitly consented, reflecting concerns over GDPR compliance.
What is the GDPR’s stance on biometric data?
The GDPR classifies biometric data as a special category of personal information, requiring enhanced protection and strict consent mechanisms for its processing, especially in public spaces like airports.
Are facial recognition systems still used in other airports?
Yes, facial recognition is widely used in airports globally, particularly in the United States and parts of Asia and the Middle East, though regulatory requirements and privacy protections vary by region.
What are the main privacy concerns with airport biometrics?
Key concerns include the immutability of biometric data, risks of unauthorized access or misuse, potential for bias or discrimination, and challenges in obtaining truly informed and voluntary consent.
How might future regulations affect biometric technology in airports?
The European Union’s Artificial Intelligence Act and evolving data protection standards are expected to impose stricter requirements on biometric deployments, potentially limiting their use and requiring advanced privacy-preserving technologies.
Sources: Reuters / Yahoo News
Regulations & Safety
India’s New Aviation Rules Recognize Fractional Aircraft Ownership
India’s Bharatiya Vayuyan Niyam, 2026 recognizes fractional aircraft ownership and replaces the Aircraft Rules, 1937 from January 1, 2027.
India’s new civil aviation rulebook, the Bharatiya Vayuyan Niyam, 2026, recognizes fractional ownership of aircraft, allowing one aircraft to be jointly owned as long as responsibility for its operation and maintenance is clearly identified. The rules take effect on January 1, 2027, and replace the Aircraft Rules, 1937, which served as the country’s principal aviation rulebook for decades.
The provisions were set out in a backgrounder posted on November 4, 2026, by the Government of India’s Press Information Bureau (PIB), citing the Ministry of Civil Aviation. The government notified the new rules under the Bharatiya Vayuyan Adhiniyam, 2024, the act that provides the legislative basis for the overhaul. According to the PIB, the Niyam comprises 220 rules organized into eight chapters and six schedules.
What the rules say about fractional ownership
The PIB document says the rules allow shared investment in an aircraft under arrangements that identify who is responsible for its operation and maintenance. The same section regulates aircraft imports, fractional ownership arrangements and private aircraft operations, and it states that private aircraft cannot be used for hire or reward except as permitted under the rules. The PIB summary does not give further detail on how fractional arrangements must be structured.
Registration rules sit alongside the ownership provisions. Aircraft may be registered under Category A or Category B, depending on prescribed ownership, citizenship, business registration and leasing criteria. Any change in an aircraft’s ownership or lessor must be reported immediately, and further flying is restricted until the registration requirements are met, unless the Directorate General of Civil Aviation (DGCA) grants written permission. Aircraft must display the nationality mark “VT”, followed by a hyphen and three assigned capital letters.
Leasing, deregistration and export
The government links the new rules to its aircraft leasing framework. The Protection of Interests in Aircraft Objects Act, 2025, which grew out of India’s Cape Town aircraft leasing bill, implements the Cape Town Convention framework in India. According to India Code, the government’s legislative database, the act (Act No. 17 of 2025) was enacted on April 16, 2025, came into force on May 1, 2025, and gives effect to the Cape Town Convention on International Interests in Mobile Equipment, signed on November 16, 2001, and its Aircraft Protocol.
Under the new rules, eligible applications from holders of an Irrevocable De-registration and Export Request Authorisation (IDERA) to cancel a registration must be processed within five working days. The rules also provide for the export of aircraft after deregistration. The PIB says that, over time, this may help reduce aircraft acquisition and leasing costs and ease pressure on airfares.
Fares, crews and penalties
For airlines, the rules require tariffs to be set on factors including operating costs and published digitally, and scheduled operators must submit their tariffs to the DGCA for monitoring. Booking websites and tickets must show the total amount payable and a breakdown of fares, taxes, fees and other charges. In extraordinary situations, the central government may issue proportionate, time-bound directions in the public interest.
Crew provisions cover flight and duty-time limits, minimum rest and fatigue management. Crew members may not consume alcohol or specified intoxicants within 12 hours before a flight. For cabin crew, the rules set a minimum of one member for aeroplanes with 10 to 50 seats and helicopters with 20 to 50 seats, two members for aircraft with more than 50 seats, and one more for every 50 seats or part thereof beyond 99 seats. No cabin crew member may serve on more than three aircraft types.
Personnel licensing spans 23 categories of licences, ratings and certificates for pilots, flight engineers, aircraft maintenance engineers, air traffic controllers and radio-telephone operators. On enforcement, the PIB lists 21 punishable offences carrying imprisonment of up to two years, a fine of up to ₹1 crore, or both, plus 18 compoundable offences. A graded penalty structure with ten severity levels sets monetary penalties from ₹10,000 to ₹1 crore, depending on the contravention and the size of the offender.
Design approval and the wider market
The rules also give the DGCA a defined framework for aircraft design and certification. It may issue type certificates for aircraft, engines and propellers where India is the State of Design, validate or accept foreign type certificates, and authorize the design and manufacture of aircraft components. Draft airworthiness directives are generally published on the DGCA website for 30 days for comment, subject to exceptions.
The PIB places the rewrite against the growth of India’s airport network, which it says rose from 74 operational airports in 2014 to 166 as of October 2026. The rules also allow the central government to set up a Regional Air Connectivity Fund for viability gap funding, which may be financed by a levy on domestic scheduled flights. The new rules replace Part IX of the Aircraft Rules, 1920, as well as the 1937 rules, and come into force on January 1, 2027.
Regulations & Safety
FAA Lifts Nationwide Ground Stop as Some Departures Resume
The FAA lifted its nationwide ground stop of November 13, 2026, and said some departures are resuming after it tested its systems.
The Federal Aviation Administration (FAA) has lifted the nationwide ground stop it ordered on November 13, 2026, and some flight departures are resuming, the agency said in a statement on its official X account. The FAA said it tested its systems to confirm they were stable before it cleared flights to resume.
The statement does not give a time for the end of the stop or name a cause, and the FAA says its technicians are investigating. AirPro News reported on the FAA’s original ground stop order on November 13.
What the FAA said
“The safety of the flying public is always the FAA’s highest priority,” the agency said in its X statement. It said the ground stop had been lifted and that some departures were resuming.
The FAA said that before clearing flights to resume, it had tested its systems to confirm they were stable and that operations remain reliable. It told passengers to contact their airlines for flight updates.
The agency’s statement on the nationwide ground stop, published on the FAA website on November 13, says the stop was ordered after communication problems affected multiple Air Route Traffic Control Centers. “FAA technicians are investigating the issue,” the statement says. The FAA marks the statement as preliminary and subject to change.
What the command center advisory set out
Air Traffic Control System Command Center (ATCSCC) Advisory 111, time-stamped 20:54 UTC on November 13 and addressed to all aircraft operators, ground stopped all airports by order of the FAA command center, citing extraordinary circumstances and reasons of safety. It told operators that all departing traffic should remain on the ground until further notice.
The advisory listed the scope of the stop as all airports and the reason as equipment and outage. It gave an event window from 20:53 UTC on November 13 to 04:00 UTC on November 14, and said inbound international flights would be managed on a case by case basis.
What officials said
Homeland Security Secretary Markwayne Mullin spoke to reporters at the White House on November 13, and Transportation Secretary Sean Duffy also addressed the ground stop, The Associated Press reported. According to the AP, Trump administration officials said new technology added to the air traffic control system had overloaded older systems, leading to “intermittent” communications and radar gaps.
Mullin said the FAA was installing “new equipment, new technology” and that it “was overwhelming the older system,” the AP reported. Asked whether a cyberattack could be ruled out, Mullin said: “There’s nothing completely certain right now. It doesn’t appear that way.” He said there were no “footprints” of an attack. The AP reported that officials were still searching for the cause.
Mullin said no one was in danger and that more than 3,000 flights were safely landed, according to the AP. Duffy said 3,500 airplanes were in the sky when the stop began, and added: “And last time I looked, we had less than 400 in the airspace.” According to the AP, Duffy said he could not guarantee that it would not happen again.
Diversions and recovery
The AP reported that the ground stop was lifted on the night of November 13 after about five hours, and that limited domestic departures resumed that evening. About 11,000 flights carrying more than 1.5 million passengers had been scheduled to depart U.S. airports after 4 p.m. EST on November 13, according to the AP.
Citing Cirium data, the AP reported that at least 827 flights were diverted. As of 7:05 p.m. EST, 670 had been sent back to their departure airports and 157 had been redirected to other airports.
The AP reported that aircraft and crews were out of position after the stop and that a full recovery was expected to take days. Duffy said NCAA teams would be prioritized for travel to football games. Cargo flights were also delayed, and FedEx said it was prepared to activate contingency plans, according to the AP, which cited Airlines for America figures showing that U.S. airlines move about 61,000 tons (55,340 metric tonnes) of goods each day.
What comes next
The FAA has said its technicians are investigating and that it will provide updates. According to the AP, officials expect normal operations in time for the Thanksgiving travel rush.
Regulations & Safety
FAA Orders Ground Stop at All Airports After Telecommunications Outage
The FAA ordered all airports ground stopped on November 13, 2026, citing a temporary telecommunications outage and reasons of safety.
This is a developing story. Information may change as official details are released.
The Federal Aviation Administration (FAA) ordered all airports ground stopped on November 13, 2026, after what the agency described as a temporary telecommunications outage. An advisory from the FAA’s Air Traffic Control System Command Center (ATCSCC) set the start of the ground stop at 20:53 UTC (3:53 p.m. EST) and told operators that departing traffic should remain on the ground until further notice.
In a statement posted on its official account on X on November 13, 2026, the FAA said:
“There has been a temporary telecommunications outage – out of an abundance of caution all flights have been halted. Every flight has been accounted for and international flights will be handled on a case by case basis.”
What the command center advisory says
ATCSCC Advisory 111, time-stamped 20:54 UTC on November 13, is addressed to all aircraft operators. It states that, by order of the command center, all airports are ground stopped “due to extraordinary circumstances and for reasons of safety.”
The advisory’s summary table lists the scope as all airports and the reason as equipment/outage. It gives an event window from 20:53 UTC on November 13 to 04:00 UTC on November 14 (11 p.m. EST on November 13), lists 04:00 UTC as the time of its next update, and says inbound international flights will be managed on a case by case basis.
A follow-up operations plan, ATCSCC Advisory 112, time-stamped 21:02 UTC, carried the national ground stop forward with an event time of 21:00 UTC “and later.” It repeated that all departing traffic should remain ground stopped until further notice.
What the FAA has not yet said
The FAA’s statement does not say where the telecommunications outage occurred, which systems or facilities were affected, or when departures are expected to resume. The FAA has not stated the cause of the outage.
Neither advisory gives the number of flights held on the ground or airborne when the order took effect. The FAA’s statement says every flight has been accounted for. The command center’s advisory lists 04:00 UTC on November 14 as its next scheduled update.
-
Space & Satellites4 days agoNASA Picks Eight Firms for $10 Billion CLPS 2 Moon Delivery Contract
-
Aircraft Orders & Deliveries7 days agoGE Aerospace Signs Record CIIE Deals Including 202 LEAP-1A Engines
-
Regulations & Safety5 days agoFAA Proposes Tighter Falcon 7X Airworthiness Limits for 161 US Jets
-
Space & Satellites6 days agoPrometheus Engine Hot-Fires at P5 With Cold-Spray Combustion Chamber
-
Defense & Military7 days agoAFGSC Starts BSTAR Business Jet Training for B-1B Pilots in Abilene