Manchester Airport has rolled out biometric identification systems across its newly restructured terminals as part of a £1.3 billion transformation programme — effective from March 5, 2026. The technology, supplied by Amadeus, uses facial recognition to verify passenger identity and automate boarding processes. But as millions of travellers pass through the new system this spring, a critical question emerges: what happens to your biometric data, who controls it, and what are your rights if you prefer not to participate?
What changed at Manchester Airport in March 2026
Terminal 1 has permanently closed. Manchester Airport now operates a two-terminal model, with the bulk of traffic flowing through the upgraded Terminal 2. Alongside the physical restructuring, a complete overhaul of passenger processing is underway:
- Biometric boarding gates using facial recognition to match passengers to their boarding passes and passport data
- Barrierless car park system (Terminal 2 West Multi-Storey, known as P3) launching late March 2026, replacing physical barriers with ANPR (Automatic Number Plate Recognition)
- New parking nomenclature: all car parks renamed P1–P16 for clearer wayfinding
- 99% automated passenger reconciliation, according to Manchester Airport's own data, while maintaining UK Border Force compliance
The system processes biometric data — specifically facial geometry — to enable what the airport calls "seamless domestic and international passenger flows."
The data privacy reality: who owns your face at the airport?
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, biometric data is classified as Special Category Data — the highest protection tier, alongside health records, religious beliefs and genetic data. Processing biometric data requires one of several specific legal bases, most commonly explicit consent from the individual.
In practice, airport biometric systems operate in a layered legal framework. The Home Office (via UK Border Force) has statutory authority to process passport biometrics for immigration purposes. This is not optional — it is a legal requirement for international travel. However, the additional processing by the airport itself (for commercial efficiency, boarding automation, and security beyond statutory requirements) is a separate matter, and passengers have clearer rights here.
Key questions IT security experts raise about these systems:
- Data retention periods: How long is your facial scan stored? Is it deleted after your flight, or retained in a broader database?
- Data sharing with third parties: Can the airport share your biometric profile with airlines, retail partners within the terminal, or government agencies beyond UK Border Force?
- Accuracy and bias: Facial recognition systems have documented accuracy disparities across demographic groups. False positives can cause delays or denials; false negatives present security risks.
Your rights as a passenger: what the law says
Right to information (Article 13/14 UK GDPR): Before your biometric data is processed, the data controller must clearly inform you about the purposes, retention periods, and your rights. If you have not received a clear privacy notice before using biometric gates, this may constitute a breach.
Right to opt out of non-statutory processing: If the biometric processing goes beyond what is strictly required for immigration control (i.e., it is being used for airport efficiency or commercial purposes), you have the right to request an alternative, non-biometric verification process. Airports cannot legally refuse you boarding solely for exercising this right.
Right of access (Subject Access Request): You can request a copy of all personal data held about you, including any biometric profiles. The data controller must respond within one calendar month.
Right to erasure: If the legal basis for processing is consent, you can withdraw consent and request deletion of your biometric data. If the legal basis is legitimate interests, the right to erasure is more limited but still applies in certain circumstances.
What IT specialists say about biometric security risks
For business travellers and frequent flyers, the expansion of biometric databases creates an enlarged attack surface. In 2025, a data breach at a European airport handling operator exposed over 1.5 million passenger records — a reminder that centralised biometric databases are high-value targets for cybercriminals.
IT security professionals recommend several practical steps:
- Enable biometric protections on your travel devices. Phones and laptops crossing international borders can be inspected by customs authorities. Ensure your device is encrypted and that biometric unlock (fingerprint/face) requires a PIN fallback.
- Review your airline's and airport's privacy policy before travel. Look specifically for clauses about biometric data sharing with third parties and retention periods.
- Use a password manager and unique credentials for airline loyalty programmes. If a biometric database is breached, attackers may try credential stuffing against travel-adjacent accounts.
- Consider a VPN for airport Wi-Fi. The new terminal infrastructure at Manchester includes upgraded public Wi-Fi, but open networks remain a risk for business data.
What to do if your rights are violated
If you believe your biometric data has been processed without adequate legal basis, or if you have been denied access to information about your data:
- Contact the Data Protection Officer (DPO) of the relevant data controller (Manchester Airport Group, your airline, or the relevant government department).
- File a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator. The ICO can investigate, issue enforcement notices, and levy fines of up to £17.5 million or 4% of global annual turnover for serious breaches.
- Seek specialist legal advice. An IT law specialist or data protection solicitor can advise on whether you have grounds for compensation under UK GDPR Article 82, which allows individuals to claim damages for material or non-material harm caused by GDPR violations.
Expert Zoom connects you with IT specialists and technology legal advisors who can explain your options clearly, without technical jargon. Whether you're a frequent traveller, a business owner handling employee travel data, or simply want to understand what happens to your biometric information at the new Manchester Airport — expert advice is available within minutes.
Note: This article provides general information about data protection law in the UK and does not constitute legal advice. Consult a qualified solicitor or IT legal specialist for advice specific to your situation.
