Source: https://www.lawinsport.com/content/articles/commercial-law/item/faces-in-the-crowd-legal-considerations-for-use-of-facial-recognition-technology-at-sports-arenas?category_id=122
Timestamp: 2019-08-21 19:00:47
Document Index: 378322217

Matched Legal Cases: ['§14', '§503', '§9', '§14', '§503', '§9', '§ 3344', '§ 63', '§ 51']

Faces in the crowd: legal considerations for use of facial recognition technology at sports arenas - LawInSport
Published 29 August 2018 By: Richard L. Brand, Eva Pulliam
As new reports of violence and crimes at large venues become more commonplace, operators of sports and entertainment venues around the United States are becoming increasingly more interested in the use of facial recognition technology1 to help protect their employees, guests, performers, and athletes.
Facial recognition technology uses several key points on faces to recognize individuals based upon certain identifying features. Although the business case for employing these techniques is strong (and becomes stronger with each technological innovation), venue operators need to consider the legal implications and requirements applicable to the use of this technology – in particular with respect to the myriad laws governing the collection of facial images. These laws are both in the US and abroad although the focus of this article is primarily on US law.
This article considers the advantages of the technology and some of the key legal considerations associated with its use. In the end, as with most decisions, there is a balancing test that must be applied before the decision to employ the technology is made. Specifically, it looks at:
The advantages of venue operators using facial recognition technology
Potential pitfalls of using the technology:
Is the technology advanced enough to be worthwhile?
Ensuring its use is within state laws – giving notice and obtaining consent
Ensuring adequate security of the data
Balancing the benefits and legal concerns
In Your Face! Let’s Consider the Perks
There are definitely some tangible benefits to the use of facial recognition technology. It may be used to identify:
Players and other known visitors as they enter facilities;
Celebrities and others in attendance;
Known criminals (which could help avoid potential threats and attacks); and
Individuals who have committed crimes while visiting the arena.
By utilizing facial recognition technology, the venue operator can create new avenues for advertising and marketing, as well as means of providing security.
Recognizing Team Players. Facial scans of individuals entering facilities is a state-of-the-art way to ensure that those coming and going to and from secure areas are only those persons entitled to be present. Unlike a badge or key, a face (and the facial markers utilized) are uniquely personal and identifiable that only the cleared individual can be permitted entry – one cannot lend its face to another guest or invitee. It is also easy to set up a protocol to have a defined group of individuals participate or register. As a security measure and a means of expediting entry, this can be a helpful way to permit cleared individuals into a facility.
Identifying and Locating Publicly Recognizable or Crowd Participant People. Identifying and locating publicly recognizable or crowd participant people in the crowd can also be a productive (and interesting) use of technology. It creates a new means of hosting promotions, an avenue for direct advertising to individuals who Register for certain marketing, and provides an accurate and effortless process for identifying well-known guests or couples for the “kiss cam” or other promotional events. Considering the anonymity enjoyed in large crowds and the legal rights tied to an individual’s privacy and persona, getting sign-on for this activity has certain challenges. Consider, for example, the settlement between Katherine Heigl and pharmacy chain Duane Reade after the company tweeted an image of her leaving their store.2 While the image was captured by paparazzi and not so much by facial recognition technology, it is a reminder that the loss of anonymity may not be welcomed or appreciated. Given this, the decision to use this type of technology requires consideration of some of the legal obstacles discussed in more detail below.
No Place to Hide. Facial recognition technology prevents criminals from being able to hide in crowds. When attempting to locate known criminals, police databases can be used to scan large venues and locate a known fugitive and to locate other individuals who have committed crimes outside of the event who are present during a special concert, game, or other activity taking place. This enables law enforcement and the venue operators to develop a mutually advantageous partnership with each side getting specific benefits – law enforcement can identify and bring criminals to justice and venue operators can provide for a safer environment for its fans. Given that there is no expectation of privacy in public venues, and public venues may find it beneficial to work closely with police to provide assurances of security and responsiveness, the pairing can stretch the arm of the law across fields and into the Big Game. This may or may not be a desirable outcome as it can be a bit of a Pandora’s box.
Rewind the Tape. After an incident has occurred, facial recognition technology can be used to later prosecute an individual and track them through the venue. Consider casino movies where security in a back room watches a card shark or purse thief work the room. This same method can be used in sports and entertainment venues as well. Further, when there is suspicion that a crime has occurred (or may take place), the use of sketches and other identifying information with facial recognition technology can help to track a guest through a venue, provide insight into finding lost persons, and offer tips and leads in a criminal investigation.
Pyric Victories: Potential Pitfalls of the Technology
While the benefits of employing facial recognition technology are appealing, there are also some serious business related and legal considerations before implementing facial recognition technology in facilities. Most notably, a venue operator needs to consider (1) the effectiveness and accuracy of present technologies, (2) notice and consent requirements and options, and (3) security and potential risks associated with storing the images.
Mirror Images: Has Facial Recognition Technology Advanced Enough to be Worthwhile?
While identifying individuals through the use of facial recognition is an exciting and innovative technique, all forms of technology (particularly new and cutting-edge forms) have a degree of human error. Just as other eye witness identifications can be flawed, so too may be identifications made using facial recognition technology. In fact, some reports have suggested that the technology can struggle to differentiate between individuals with darker skin tones.3 This means that the technology has the potential to overly track and target darker skinned individuals that are not the actual targets of an investigation or completely miss these individuals – either of which has a significant adverse effect to the venue operators and the individuals involved. While this concern is highly problematic, the solution may be forthcoming as technology innovators work to eliminate (or at least greatly reduce) this problem. Microsoft recently announced that it made substantial improvements to increase its technology’s gender identification across skin tones.4 This is a meaningful step forward in considering some of the inherent biases present in artificial technologies. Computers are programmed by humans and, therefore, human error is not wholly avoidable.
Any venue operator choosing to employ facial recognition technology for some or all of the purposes described above, needs to remain mindful of developments and improvements in the use of the technology and to be willing to constantly update the systems in order to minimize both human error and unintended discrimination.
Blocks and Screens: Notice and Consent
Beyond potential inaccuracies, there are various legal concerns related to the use of facial recognition technology. These laws fall both into the areas of privacy and tort (duties of care). From a privacy standpoint, the Federal Trade Commission (FTC) has long pushed for providing the public with transparent, simple choices regarding the use of their images.5
From a privacy standpoint, the collection of details related to someone’s face is classified as “biometric” information, which requires specific forms of notice and consent in line with the laws of certain states. Additionally, the use of an individual’s picture in advertising (after identified using the technology) may give rise to claims under publicity rights laws, which cross the line between privacy rights and property right violations (i.e. torts).
From a privacy rights perspective, we first consider the laws that apply to “biometric information.” Biometric information is, generally, any information that is received through the processing of data points pulled from physical and physiological characteristics.6 This information offers the ability to uniquely identify someone and includes things such as faces, fingerprints, and DNA. Though the FTC has explicitly addressed this type of information, many states do not have statutes specifically discussing how private entities can handle such a sensitive category of information, particularly outside of the employment context. Illinois, Texas, and Washington currently stand out in this area with specific statutes on the book to address biometrics.7 While other states are behind, general principles of data privacy law and compliance with stated privacy policies will still be enforced in other states. Simply stated: if you say you don’t collect it, then don’t collect it.
Based on the current laws and practices, certain of the uses discussed above may arguably involve security. For law enforcement, venues operators may consider requiring warrants to use their technologies. For employees, notice and consent should be built into employment and consulting arrangements. Using facial recognition technology to identify individuals for marketing and advertising purposes is clearly for “commercial purposes” and will therefore likely receive the highest scrutiny and have the most requirements imposed.
In Texas, Illinois, and Washington, notice is a requirement for collecting biometric data.8 In Illinois and Texas, notice must be accompanied by consent. To disclose information for commercial purposes, the consent must specifically address this point. Further, disclosure is limited absent certain exceptions, such as where a warrant is issued. This means that venues will need to consider alterations in their processes to address these requirements if they choose to collect and use this category of information. It may be that tweaks to the ticket purchasing process involve notice and consent to data collection in this manner. That said, addressing issues involving the tickets given away as prizes and those otherwise traded may give rise to issues with obtaining appropriate consent from all attendees and should be carefully considered. In any event, this is an important consideration. Consider Facebook’s current legal troubles involving its use of facial recognition technology without written consent where photographs are uploaded.9 While not in a public setting, the lack of consent remains a key issue in using this technology and failure to obtain it may give rise to a similar class action.
In other states, signage (i.e., notice) is always suggested. This is because there are publicity rights laws in place that would restrict the use of images for commercial purposes even where the biometric law hurdles are crossed. For these areas, the notice and consent required above is still helpful, but widespread use of any individual’s face without permission would likely draw potential legal risks if the individual did not agree. Even for the use of images of crowds in public spaces, the posting of signage is suggested to avoid a complaint. Then, if an individual is identifiable or particularly focused upon, a specific release would be needed.
Many states recognize publicity rights to varying degrees, which involves the right of an individual to his or her own persona well as the right to control the commercial use of such persona.10 In many cases, this right emanated from the right of privacy, but has now become a part of tort law whereby a lawsuit for civil damages may be lodged for the commercial use of a picture, voice, or the like. While this article does not focus on this area, a venue operator must remember that it is a potential legal risk that must not be ignored. Releases should be obtained prior to using any person’s image.
Ensuring that privacy programs are updated to ensure that notice and consent are obtained in accordance with applicable law is of utmost importance. Even the ACLU has voiced concerns over unrestricted scanning of crowds.11 Beyond the ACLU, fans and other patrons of sporting events and venues may raise additional concerns if provided with notice and prompted to consent to the capture of facial recognition information when purchasing tickets.
Always Protect Home: Ensuring Adequate Security
As noted above, biometric data is considered a more sensitive category of data given its potential uses. Securing this information is of utmost importance. Unlawful access or acquisition of data points used to recognize specific faces can lead to identity theft, future hacks into any technology using the face as a biometric identifier, and more. A program designed around the collection of biometric data must consider the sensitive nature of this form of data in designing administrative, physical, and technical controls.
Individuals without a need to access or use the information should not be able to access it. Any video tapes should be maintained in secure areas. Further, technical security standards should be regularly reviewed to ensure that they are up-to-date and state-of-the-art.
Failure to adequately secure this data could result in its misuse and a negative impact on the subject individuals, as noted above. From a legal standpoint, there are data breach notification requirements associated with the loss of biometric information given its sensitivity. Further, where an organization maintains a privacy policy asserting that it uses “reasonable security” and it is determined that the security used for the information was actually unreasonable under the circumstances, a breach may also be considered a breach of the privacy policy. Federal and state regulators, as well as consumers, hold organizations to the privacy promises that they make. An inconsistency may lead to enforcement actions, as well as civil lawsuits. Beyond this, such a breach would lead to extensive public relations concerns.
Win Some, Lose Some: Balancing the Benefits and Legal Concerns
Having considered both the benefits and legal concerns associated with using facial recognition technology, it is important for all venues to balance these considerations in developing a plan for implementation and operation of a facial recognition program and for ensuring appropriate legal compliance in connection with such program.
Each venue will need to look to both federal and state laws and regulations in crafting programs that consider individual rights, safety, and security, and each venue needs to have legal advice and support from a legal team with experience in dealing with such programs. And if some fun new uses can be worked in as well, then….play (or watch) ball!
For questions regarding facial recognition technology, sports law, and the intersection of sports with cybersecurity, please contact the authors.
1† Kevin Draper, ‘Madison Square Garden Has Used Face-Scanning Technology on Customers’, nytimes.com, 13 March 2018, last accessed 29 Aug 2018, https://www.nytimes.com/2018/03/13/sports/facial-recognition-madison-square-garden.html
2† Heigl v. Duane Reade, No. 14-2502 (S.D. N.Y. Apr. 9, 2014).
3† See e.g., Lohr, Steve. “Facial Recognition Is Accurate, if You’re a White Guy” (published Feb. 9, 2018), available at https://www.nytimes.com/2018/02/09/technology/facial-recognition-race-artificial-intelligence.html (last visited Jul. 23, 2018).
4† Roach, John. “Microsoft improves facial recognition technology to perform well across all skin tones, genders” (published Jun. 26, 2018), available at https://blogs.microsoft.com/ai/gender-skin-tone-facial-recognition-improvement/ (last visited Jul. 23, 2018).
5† See FTC, Facing Facts: Best Practices for Common Uses of Facial Recognition Technology (Oct. 2012).
6† See generally, EU general data protection regulation 2016/679 (GDPR); 740 Ill. Comp. Stat. §14 et seq.; Tex. Bus & Com. Code §503.001; Rev. Code. Wash. 1§9.375 et seq.
7† 740 Ill. Comp. Stat. §14 et seq.; Tex. Bus & Com. Code §503.001; Rev. Code. Wash. 1§9.375 et seq.
8† Id.
9† Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018).
10† See e.g., Cal. Civ. Code § 3344 et seq; Wash. Rev. Code Ann. § 63.60; NY Civ Rights L § 51.
11† See “Face Recognition Technology,” available at https://www.aclu.org/issues/privacy-technology/surveillance-technologies/face-recognition-technology (last visited Jul. 23, 2018).
Views 11287
Tags: Data Collection | Facial Recognition Technology | Major League Soccer (MLS) | National Basketball Association (NBA) | National Basketball League (NBL) | National Hockey League (NHL) | Privacy | Regulation | Safety | Stadium Safety | United States of America (USA)
Eva Pulliam is a senior associate at Arent Fox where she concentrates her practice in the areas of data privacy & security, advertising and marketing, e-commerce, and intellectual property. As a member of Arent Fox’s Advertising team, Eva reviews advertising materials and advises clients on federal and state laws, including unfair and deceptive trade practice regulations enforced by the Federal Trade Commission (FTC) as well as FTC guidance related to green marketing, e-mail marketing, and telemarketing. Eva also has experience drafting and reviewing promotion rules for contests and sweepstakes, as well as assisting clients with prize fulfillment and other aspects of client promotions. She currently reviews sweeps and promotions for sports teams and arenas and also advises on the privacy and advertising aspects of sports licensing deals. Some of Eva's other notable experience is in the area of online gaming and lottery regulations.