Need to know
- Facial recognition is in use at major sporting and concert venues around Australia
- The owners and operators of these stadiums are not being open and transparent with consumers or the media about its use
- Advocates say the widespread use of the technology highlights the need for law reform
Facial recognition technology is being deployed at major concert venues and sporting events around Australia, often without consumers' knowledge or consent.
Facial recognition is an advanced and controversial technology which involves the use of cameras to collect the biometric information – or the unique 'faceprint' – of someone, which is often then matched to a database. Because of the unique nature of the biometric information, it is considered "sensitive data" under privacy legislation.
Analysing the privacy policy and conditions of entry statements of ten stadiums and stadium operators around Australia, CHOICE found many allowed for facial recognition to be used, but the operators were vague or non-responsive when we contacted them seeking more information.
Consumers need to be properly informed
CHOICE's consumer data advocate Kate Bower says any entities using facial recognition technology (FRT) need, at a minimum, to be upfront with customers about where and why it is being used and whether the data is being shared or stored.
"I think one of the main problems from a consumer's perspective is that they don't know when facial recognition is being used and then when they are told that it is being used, it's very deep in some conditions of entry or privacy policy. They often don't find out about it until after they've already bought a ticket," she says.
"But then even when they do find out, they have no idea what it's being used for, they've got no idea how long their information is stored, how securely it's stored. The consumers don't really have a choice."
Stadiums around Australia using FRT
Some of Australia's best known sporting stadiums, including the Sydney Cricket Ground (SCG), the Melbourne Cricket Ground (MCG) and Allianz Stadium state in their conditions of entry that FRT is in use.
The MCG's conditions of entry says: "Patrons consent to the collection of biometric information (including biometric templates) for what is reasonably necessary for one of the MCG's functions or activities". The MCG did not respond to requests for clarification on the type of data it collects, what "functions" it is used for, or how long the images are stored.
A spokesperson for Venues NSW, who own and operate the SCG and Allianz stadiums responded to our enquiries only to say: "We abide strictly with our privacy obligations. We do not monetise facial recognition data".
The MCG did not respond to requests for clarification on the type of data it collects, what "functions" it is used for, or how long the images are stored
ASM Global is a event and venue management company based in Los Angeles that, according to their website, operates major stadiums in Australia such as RAC Arena (Perth); Qudos Bank Arena and Aware Super Theatre (Sydney); and Suncorp Stadium (Brisbane).
They also operate a range of large convention centres around the country including in Sydney, Brisbane, Cairns and Darwin.
The privacy policy available on their website says they have the right to collect "biometric data" including "images from facial recognition systems operated at Venues (if any)". They did not respond to our requests for information about which stadiums had FRT in use in Australia.
We visited Qudos Bank Arena in Sydney's Olympic Park to see if the conditions of entry signage is easy to find and consumer friendly.
Qudos Bank Arena stores images for 'a period of time'
While there are data security and privacy concerns arising from customers having their faceprints stored, perhaps most concerning is the potential link between biometric data collection and companies that make money out of selling your data.
Qudos Bank Arena is a major concert venue in Sydney owned by TEG, a company best known for owning Ticketek and less known as a major data broker, although selling data is a big part of their business.
ASM is contracted by TEG to manage Qudos Bank Arena. They told CHOICE they do use facial recognition at the venue and that images of persons who had been evicted or issued banning notices were stored on the system "for a period of time".
We asked a CHOICE supporter who recently attended a Michael Bublé concert at the venue to be on the lookout for signage mentioning facial recognition and she reported that she was unable to spot them
When asked whether customers were made aware of the use of facial recognition cameras, the company said digital signage was displayed in addition to traditional signs at all external entry points. They also provided photos of a lengthy 'conditions of entry' sign located near the door of the main auditorium which mentioned facial recognition is in use.
But these signs are not easy to find. We asked a CHOICE supporter who recently attended a Michael Bublé concert at the venue to be on the lookout for signage mentioning facial recognition and she reported that she was unable to spot them.
Qudos Bank Arena's conditions of entry available on their website is over 3000 words long and would take an average reader over 12 minutes to read, according to Grammarly.
TEG did not respond directly to a list of questions about how data was collected or shared at the stadium, but said in a brief statement that "Whilst TEG is the lessee of Qudos Bank Arena, TEG does not run the day-to-day operations of the venue. TEG does not collect biometric data in any form across the TEG group".
Qudos Bank Arena provided images of the following signs.
Major data broker
Dr Katharine Kemp from the Faculty of Law and Justice at the University of New South Wales has done research on data broking in Australia and says TEG is one of the biggest local companies in the space.
She says the company has signed lucrative contracts to provide "data enrichment" with the likes of FlyBuys, NewsCorp and Seven West Media. Data enrichment is a process by which several companies share the data they have on a single customer in order to build larger and more in-depth profiles of spending and behavioural habits.
They seem to regard themselves as not accountable to the consumers or responsible for what might happen to that information
Dr Katharine Kemp, Faculty of Law and Justice, University of New South Wales
Kemp thinks TEG should be more transparent about the data they are collecting and what they are doing with it.
"They're not providing information, they're not being accountable about what they're doing with that sensitive data. They seem to regard themselves as not accountable to the consumers or responsible for what might happen to that information."
In a 2018 article in the Australian Financial Review, TEG chief technology officer at the time Matt Cudworth boasted that FRT would be in place at major venues in Australia within five years and that the move would provide data opportunities for the company.
"We won't be the owner of that technology (FRT), but we're a key participant and the line is blurring between what data gets shared between participants," he said.
Lauren Perry from UTS Human Technology Institute says efforts by stadium managers to obtain consent from patrons have been inadequate
Need for reform
Lauren Perry from the UTS Human Technology Institute says venue managers shouldn't be using FRT as a default approach. The fact that they are highlights the need for law reform.
"We're talking here about semi-public places where community members, including a lot of children, gather and watch sports events and entertainment. In this context, the risks of using surveillance technologies to our civil and human rights really appear to outweigh any benefits to the sorts of security incidents you'd potentially be seeing at an event like a sporting match," she says.
Perry says efforts by stadium managers to obtain consent from patrons have been inadequate.
Everyday Australians really aren't going to be aware of the use of these technologies when they turn up at a venue
Lauren Perry, UTS Human Technology Institute
"Everyday Australians really aren't going to be aware of the use of these technologies when they turn up at a venue. Any affected individual who's coming in contact with facial recognition must have the opportunity to provide or withhold free and informed consent prior to their exposure to the technology," she adds.
Bower agrees and says the federal government needs to act to better protect consumers.
"I think what we really need to see is a business being more transparent and leading by example, but we also need stronger regulators to be able to hold them to account and to actually give some clear guidelines about what is a safe and responsible use of this technology, which can be incredibly harmful and invasive and also comes with high level of security risk."
Stock images: Getty, unless otherwise stated.
