Consumer Rights Wiki - User contributions [en]

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:36:37Z

2605:6400:30:F440:757E:ADF1:55F7:5A31: Work in Progress

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref> The system, developed by vendor IP Biometrix, tracks physical attributes, infers ethnicity categories (white, black, Asian, Hispanic, Indian, Arabian), and analyses emotional states—including fear and disgust—while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.<ref name="ip-biometrix" />

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria.<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref> In or before 2026, the chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.<ref name="ip-biometrix" /> Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates the system processes both employees and customers. A sample image shows multiple individuals labelled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked including:<ref name="ip-biometrix" />

* Physical features: glasses, dark glasses, beard, moustache, blink, mouth open, mask presence
* Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
* Emotional states: neutral, anger, contempt, disgust, fear, and others

Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analysed, or stored. Happy's published privacy policy makes no mention of facial recognition, biometric processing, or AI surveillance systems in restaurants.<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref> Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.<ref name="gdpr-article9" />

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website.<ref name="happy-privacy" /> IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026.

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:34:42Z

2605:6400:30:F440:757E:ADF1:55F7:5A31: /* References */

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-date=2 January 2026 |access-date=4 March 2026}}</ref> The system, developed by vendor IP Biometrix, tracks physical attributes, infers ethnicity categories (white, black, Asian, Hispanic, Indian, Arabian), and analyses emotional states—including fear and disgust—while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.<ref name="ip-biometrix" />

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria.<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref> In or before 2026, the chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.<ref name="ip-biometrix" /> Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates the system processes both employees and customers. A sample image shows multiple individuals labelled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked including:<ref name="ip-biometrix" />

* Physical features: glasses, dark glasses, beard, moustache, blink, mouth open, mask presence
* Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
* Emotional states: neutral, anger, contempt, disgust, fear, and others

Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analysed, or stored. Happy's published privacy policy makes no mention of facial recognition, biometric processing, or AI surveillance systems in restaurants.<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref> Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.<ref name="gdpr-article9" />

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website.<ref name="happy-privacy" /> IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026.

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:33:02Z

2605:6400:30:F440:757E:ADF1:55F7:5A31:

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-date=2 January 2026 |access-date=4 March 2026}}</ref> The system, developed by vendor IP Biometrix, tracks physical attributes, infers ethnicity categories (white, black, Asian, Hispanic, Indian, Arabian), and analyses emotional states—including fear and disgust—while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.<ref name="ip-biometrix" />

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria.<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref> In or before 2026, the chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.<ref name="ip-biometrix" /> Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates the system processes both employees and customers. A sample image shows multiple individuals labelled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked including:<ref name="ip-biometrix" />

* Physical features: glasses, dark glasses, beard, moustache, blink, mouth open, mask presence
* Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
* Emotional states: neutral, anger, contempt, disgust, fear, and others

Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analysed, or stored. Happy's published privacy policy makes no mention of facial recognition, biometric processing, or AI surveillance systems in restaurants.<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref> Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.<ref name="gdpr-article9" />

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website.<ref name="happy-privacy" /> IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026.

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:27:11Z

2605:6400:30:F440:757E:ADF1:55F7:5A31:

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref> The system, developed by vendor IP Biometrix, tracks physical attributes, infers ethnicity categories (white, black, Asian, Hispanic, Indian, Arabian), and analyzes emotional states—including fear and disgust—while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.<ref name="ip-biometrix" />

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria.<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref> In or before 2026, the chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.<ref name="ip-biometrix" /> Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates the system processes both employees and customers. A sample image shows multiple individuals labeled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked including:<ref name="ip-biometrix" />

* Physical features: glasses, dark glasses, beard, mustache, blink, mouth open, mask presence
* Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
* Emotional states: neutral, anger, contempt, disgust, fear, and others

Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analyzed, or stored. Happy's published privacy policy makes no mention of facial recognition, biometric processing, or AI surveillance systems in restaurants.<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref> Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.<ref name="gdpr-article9" />

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website.<ref name="happy-privacy" /> IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026.

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Face recognition solution for Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="happy-bg">{{Cite web |title=Happy Bar & Grill |url=https://happy.bg/ |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/en/privacy_policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679, Article 9 |url=https://eur-lex.europa.eu/eli/reg/2016/679/art_9/oj |publisher=EUR-Lex |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:19:49Z

2605:6400:30:F440:757E:ADF1:55F7:5A31:

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.<ref name="ip-biometrix" /> The system, developed by vendor IP Biometrix, tracks physical attributes, infers ethnicity, and analyzes emotions—including fear and disgust—while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.<ref name="ip-biometrix" />

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria, Spain, and the Uk. The chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.<ref name="ip-biometrix" /> Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates the system processes both employees and customers. A sample image shows multiple individuals labeled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked including:<ref name="ip-biometrix" />

*Physical features: glasses, dark glasses, beard, mustache, blink, mouth open, mask presence
*Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
*Emotional states: neutral, anger, contempt, disgust, fear, and others

Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analyzed, or stored in a biometric database.

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.<ref name="gdpr-article9" /> Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.<ref name="gdpr-article9" />

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website detailing the presence of facial recognition technology or customers' GDPR rights.<ref name="happy-privacy" /> IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026. However, similar biometric surveillance practices in EU retail environments have resulted in regulatory enforcement: the Dutch Data Protection Authority fined a shopping center €565,000 in 2023 for emotion recognition cameras processing customers' biometric data without valid legal basis.<ref name="dutch-dpa" />

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
*Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
*Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg" />
*Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Разпознаване на лица за Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679 (GDPR), Article 9 |url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 |publisher=European Union |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/privacy-policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="dutch-dpa">{{Cite web |title=Dutch DPA fines shopping center for illegal use of cameras with emotion recognition |url=https://www.autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-shopping-center-illegal-use-cameras-emotion-recognition |publisher=Dutch Data Protection Authority |date=20 June 2023 |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:16:11Z

2605:6400:30:F440:757E:ADF1:55F7:5A31:

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.<ref name="ip-biometrix" /> The system, developed by vendor IP Biometrix, tracks physical attributes, infers ethnicity, and analyzes emotions—including fear and disgust—while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.<ref name="ip-biometrix" />

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria. In or before 2026, the chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.<ref name="ip-biometrix" /> Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates the system processes both employees and customers. A sample image shows multiple individuals labeled as "Subject 6053," "6054," and "6055" with extensive biometric attributes tracked including:<ref name="ip-biometrix" />

* Physical features: glasses, dark glasses, beard, mustache, blink, mouth open, mask presence
* Ethnicity classifications: white, black, Asian, Hispanic, Indian, Arabian
* Emotional states: neutral, anger, contempt, disgust, fear, and others

Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analyzed, or stored in a biometric database.

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.<ref name="gdpr-article9" /> Inferring ethnicity and emotional states triggers additional restrictions as these reveal "racial or ethnic origin" and constitute sensitive psychological profiling. The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.<ref name="gdpr-article9" />

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website detailing the presence of facial recognition technology or customers' GDPR rights.<ref name="happy-privacy" /> IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026. However, similar biometric surveillance practices in EU retail environments have resulted in regulatory enforcement: the Dutch Data Protection Authority fined a shopping center €565,000 in 2023 for emotion recognition cameras processing customers' biometric data without valid legal basis.<ref name="dutch-dpa" />

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg" />
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Разпознаване на лица за Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679 (GDPR), Article 9 |url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 |publisher=European Union |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/privacy-policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="dutch-dpa">{{Cite web |title=Dutch DPA fines shopping center for illegal use of cameras with emotion recognition |url=https://www.autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-shopping-center-illegal-use-cameras-emotion-recognition |publisher=Dutch Data Protection Authority |date=20 June 2023 |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:11:48Z

2605:6400:30:F440:757E:ADF1:55F7:5A31: /* Company's response */

Happy Bar & Grill, a Bulgarian restaurant chain, deployed an AI facial recognition system that biometrically profiles customers without transparent notice or valid legal basis under GDPR.[1] The system, developed by vendor IP Biometrix, tracks facial attributes including ethnicity while claiming to monitor staff "smiles," raising systemic privacy concerns for all patrons.[1]

==Background==
Happy Bar & Grill is a Bulgarian restaurant chain operating multiple locations across Bulgaria. In or before 2026, the chain implemented an AI-powered facial recognition system developed by Bulgarian security vendor IP Biometrix.[1] Marketed for "smile monitoring" of staff to generate employee performance rankings, the system uses existing security cameras for real-time facial recognition.

==Biometric surveillance without notice==
IP Biometrix's portfolio page demonstrates that the system processes not only employees but also customers. A sample image shows a customer's face labeled "Subject 6053" with biometric attributes tracked including glasses, sunglasses, beard, mustache, and ethnicity.[1] Patrons entering affected locations receive no visible signage at entrances or within dining areas informing them that their facial biometrics are being captured, analyzed, or stored in a biometric database.

Under the EU General Data Protection Regulation (GDPR), facial recognition constitutes processing of biometric data—a "special category" of personal data requiring explicit consent or another narrow legal basis under Article 9.[2] Inferring ethnicity triggers additional restrictions as it reveals "racial or ethnic origin." The absence of transparent notice before data collection violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.[2]

==Company's response==
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI camera systems appear at restaurant entrances or on the company website detailing the presence of facial recognition technology or customers' GDPR rights.[3] IP Biometrix continues to showcase the Happy Bar & Grill implementation in its portfolio without addressing transparency or consent requirements for customer processing.[1]

==Lawsuit==
No lawsuits against Happy Bar & Grill regarding this system have been publicly reported as of March 2026. However, similar biometric surveillance practices in EU retail environments have resulted in regulatory enforcement: the Dutch Data Protection Authority fined a shopping center €565,000 in 2023 for emotion recognition cameras processing customers' biometric data without valid legal basis.[4]

==Consumer response==
Consumer awareness of the surveillance system appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests (Article 15) demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection[5]
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
<references>
<ref name="ip-biometrix">{{Cite web |title=Разпознаване на лица за Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref>
<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679 (GDPR), Article 9 |url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 |publisher=European Union |access-date=4 March 2026}}</ref>
<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/privacy-policy |website=happy.bg |access-date=4 March 2026}}</ref>
<ref name="dutch-dpa">{{Cite web |title=Dutch DPA fines shopping center for illegal use of cameras with emotion recognition |url=https://www.autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-shopping-center-illegal-use-cameras-emotion-recognition |publisher=Dutch Data Protection Authority |date=20 June 2023 |access-date=4 March 2026}}</ref>
<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
</references>

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:09:49Z

2605:6400:30:F440:757E:ADF1:55F7:5A31:

{{IncidentCargo
|Company=Happy Bar & Grill
|Status=Active
|Product=Restaurant
|ArticleType=Service
|Type=Privacy Concern
|Description=Happy Bar & Grill uses AI facial recognition to biometrically profile customers without notice or consent, violating GDPR.
}}
{{Ph-I-Int}}
==Background==
{{Ph-I-B}}
Happy Bar & Grill is a Bulgarian restaurant chain that implemented an AI facial recognition system developed by security vendor IP Biometrix.<ref name="ip-biometrix">{{Cite web |title=Разпознаване на лица за Happy Bar and Grill |url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |website=IP Biometrix |archive-url=https://web.archive.org/web/20260102224149/https://ip-biometrix.com/portfolio/happy-face-recognition/ |archive-date=2 January 2026 |access-date=4 March 2026}}</ref> Marketed for "smile monitoring" of staff, the system uses existing security cameras for real-time facial recognition.

==Incident==
{{Ph-I-I}}
IP Biometrix's portfolio page shows the system processes not only employees but also customers. A demonstration image displays a customer's face labeled "Subject 6053" with biometric attributes tracked including glasses, facial hair, and ethnicity.<ref name="ip-biometrix" /> Patrons receive no visible signage at entrances or within dining areas informing them their facial biometrics are being captured, analyzed, or stored.

Under GDPR, facial recognition constitutes processing of biometric data—a "special category" requiring explicit consent or another valid legal basis (Article 9).<ref name="gdpr-article9">{{Cite web |title=Regulation (EU) 2016/679 (GDPR), Article 9 |url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 |publisher=European Union |access-date=4 March 2026}}</ref> Inferring ethnicity triggers additional restrictions as it reveals "racial or ethnic origin." The absence of transparent notice violates GDPR Articles 13–14, while processing customers' biometrics for staff performance monitoring lacks a proportionate legal basis under Articles 6 and 9.

===Company's response===
{{Ph-I-ComR}}
As of March 2026, Happy Bar & Grill has issued no public statement addressing biometric processing of customers. No privacy notices specific to AI cameras appear at restaurant entrances or on the company website.<ref name="happy-privacy">{{Cite web |title=Privacy Policy |url=https://happy.bg/privacy-policy |website=happy.bg |access-date=4 March 2026}}</ref> IP Biometrix continues to showcase the implementation without addressing transparency or consent requirements for customer processing.<ref name="ip-biometrix" />

==Lawsuit==
{{Ph-I-L}}
No lawsuits have been publicly reported as of March 2026. However, similar practices have faced regulatory action elsewhere in the EU: the Dutch DPA fined a shopping center €565,000 in 2023 for emotion recognition cameras processing customers' biometric data without valid legal basis.<ref name="dutch-dpa">{{Cite web |title=Dutch DPA fines shopping center for illegal use of cameras with emotion recognition |url=https://www.autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-shopping-center-illegal-use-cameras-emotion-recognition |publisher=Dutch Data Protection Authority |date=20 June 2023 |access-date=4 March 2026}}</ref>

==Consumer response==
{{Ph-I-ConR}}
Consumer awareness appears limited due to absent on-site notices. Affected customers may exercise GDPR rights by:
* Submitting Subject Access Requests demanding all biometric data processed about them
* Filing complaints with Bulgaria's Commission for Personal Data Protection<ref name="cpdp-bg">{{Cite web |title=Commission for Personal Data Protection |url=https://www.cpdp.bg/en/ |website=cpdp.bg |access-date=4 March 2026}}</ref>
* Requesting deletion of biometric templates under the right to erasure (Article 17)

==References==
{{reflist}}

{{Ph-I-C}}

Happy Bar & Grill biometric surveillance tool development

2026-03-04T15:04:54Z

2605:6400:30:F440:757E:ADF1:55F7:5A31: Created page with "{{IncidentCargo |Company=Happy Bar & Grill |Status=Active |Product=Restaurant |ArticleType=Service |Type=Privacy Concern |Description=Happy Bar & Grill uses AI facial recognition to biometrically profile customers without notice or consent, violating GDPR. }} {{Ph-I-Int}} ==Background== {{Ph-I-B}} ==[Incident]== {{Ph-I-I}} ===[Company]'s response=== {{Ph-I-ComR}} ==Lawsuit== {{Ph-I-L}} ==Consumer response== {{Ph-I-ConR}} ==References== {{refli..."