Sports venues are offering facial recognition to let people in. What are the risks?

Sports venues across Australia are increasingly turning to facial recognition technology to streamline entry processes for fans. The Geelong Football Club, for instance, has introduced an express lane for members, allowing them to enter the GMHBA Stadium by providing a selfie for facial authentication. This technology is not new to Australian sports venues, with recent examples including the Australian Open, where fans could register for faster entry.

While the convenience of facial recognition is undeniable, concerns about privacy and consent have emerged. In Australia, facial images and biometric information are classified as "sensitive information," which means that their collection generally requires informed consent. The Australian Information Commissioner's Office has previously noted that the collection of facial data must be accompanied by informed consent.

The question then arises: how can consent be made truly meaningful? Under Australian law, consent must be informed, voluntary, and revocable. In the case of Geelong Cats' fans, facial authentication is completely optional, which allows individuals to change their minds if they choose. However, the introduction of incentives, such as loyalty points, raises concerns about the pressure that might be exerted on fans to sign up for facial recognition.

Facial recognition technologies are becoming more prevalent in various settings, including retail and law enforcement. While these technologies offer convenience, they also raise significant privacy concerns. Cybersecurity risks are a major concern, as evidenced by large-scale data breaches involving companies like Optus, Qantas, and Medibank. Biometric information, being particularly sensitive, cannot be changed once compromised.

Another issue to consider is the potential for future data sharing. Consent given today might not cover future technological developments or commercial partnerships that a sports club could enter into. The normalization of facial recognition technology could lead to its broader use, potentially resulting in function creep and everyday life surveillance.

Given these concerns, fans should have the option to opt-in or opt-out of facial recognition technology. However, the decision should be informed, voluntary, and not coerced. Sports clubs and venues must clearly communicate the benefits and risks to patrons and ensure that personal information is safeguarded.