In recent years, Paraguay has increased the use of surveillance cameras in sporting events and public spaces. Law 7269/2024 introduces measures that include the collection of biometric data, such as facial recognition, from all persons attending sporting events, without distinguishing between those who participate in violent acts and the rest of the people attending1. This law, processed in less than a year and without sufficient legislative debate, reflects a lack of consultation with affected people, digital rights experts, and civil society organizations.
At TEDIC, we express deep concerns about a law that allows and encourages the massive collection of biometric data, considered sensitive personal data, without establishing clear criteria. This situation jeopardizes the right to privacy, freedom of expression and the presumption of innocence, which could have serious consequences for sports enthusiasts. This is especially alarming in a country that lacks a comprehensive personal data protection law and has recently implemented mass biometric surveillance technology without transparency, accountability or an adequate human rights perspective.
Biometric data is considered sensitive data because it includes unique physical or behavioral characteristics that can unequivocally identify an individual, such as fingerprints, face, hand geometry, among other physical aspects of a person. Facial recognition, a specific form of biometrics, converts facial features into digital data that can be stored and compared, posing risks of tracking and surveillance without consent. Being unique and irreplaceable, this data cannot be modified or replaced as with passwords or credit cards, leading to serious concerns. If biometric data is leaked or hacked, the consequences could be irreversible for the affected individuals, as already happened in Paraguay in 2023 with a National Police database2.
One of the most worrying aspects of this law is the lack of transparency in the management of biometric data and the possibility of its use for commercial purposes by private actors or for indiscriminate surveillance, completely ignoring the informed consent and the rights of spectators. Furthermore, the risk of abuse increases, as the implementation of these technologies could be used in a discretionary manner, without the necessary guarantees for the protection of human rights.
Chronology of Law 7269/2024 and the business interests behind its implementation
The bill “for the prevention, control and eradication of violence in sports”, presented on June 8, 2023, by deputies of the ruling party, advanced rapidly in Congress. It was approved in the Chamber of Deputies in September 2023, amended in the Senate in March 2024 and finally sanctioned on April 17, 2024. The law was promulgated by President Santiago Peña on June 11, 2024, in an accelerated legislative process and without consultation with digital rights experts or civil society. In contrast, the bill for Comprehensive Personal Data Protection, introduced in 2021 by the Personal Data Coalition of Paraguay, remains unaddressed3.
In parallel, in January 2024, the Ministry of the Interior (MDI) and the Paraguayan Football Association (APF) announced that they have signed an agreement to implement security systems with facial recognition in stadiums4. However, a request for access to information made to the MDI by TEDIC revealed that this agreement was not signed, without any public explanation regarding the matter5.
The company ITTI SAECA, part of the Vázquez Group6 and related to the current President of the Republic -who had disclosed owning shares and bonds of this company- played a key role in the implementation of these technologies7. According to a request for access to public information made by journalist Josué Congo,8 ITTI signed an agreement with the National Sports Secretariat (SND) for a value of USD 1,733,000 in October 2023, months before the enactment of the law. These agreements included the installation of video surveillance technologies and biometric systems to manage the data of people attending sporting events, analyze their behavior and use the data for financial intelligence. Moreover, UENO, a brand of the Vázquez Group, became an official sponsor of the APF and several football clubs, at the same time the legislative process of this law was occurring.
The Vázquez Group also controls Red UTS, a ticket issuer for sporting events, and the UENO bank, which sponsors the Paraguayan national soccer team. This relationship between private actors and the State, along with the presence of legislators with ties to sports during the law’s consideration, raises concerns about the possible commercial interests behind the approval of Law 7269/2024.
The risk of censorship in stadiums: a threat to freedom of expression
One of the most alarming aspects of Law 7269/2024 is its potential use as a censorship tool. Article 2, subparagraph h) defines violent conduct as
“ (…) offenses to honor and sportsmanship through insulting words or gestures” and “discrimination or outrage to a person or groups of persons”.
Although these provisions aim to maintain order at sporting events, the vague and broad wording allows for discretionary interpretations that could severely restrict freedom of expression.
Article 18 adds sanctions for those who display banners or chant slogans that:
“ (…) incite violence, discrimination or promote offenses to honor and sportsmanship”.
The wording of the recently approved law, in addition to combating violence in sports, could lead to the censorship of legitimate expressions of social, political or sports criticism, such as chants against club directors or banners with political messages. The sanctions could extend to expressions of criticism, for example, against public figures. Consequently, fans run the risk of being disproportionately punished, with administrative sanctions and penalties that can include a ban on attending sporting events for up to 10 years.
A legal discussion: urgent and necessary
The use of facial recognition in Paraguayan soccer stadiums, promoted by Law 7269/2024, makes it necessary to promote an intense debate on its constitutionality and its impact on the fundamental rights of the population. While the law seeks to combat violence at sporting events, the implementation of this technology raises serious concerns from the point of view of criminal law, the protection of privacy, freedom of expression, and the right to non-discrimination.
Legality
From a constitutional point of view, Article 33 of the National Constitution of Paraguay establishes that the privacy of individuals is inviolable and that any interference with private life must be based on the law. In exceptional cases where such interference is necessary, a prior court order is required9. This responds to the principle of legality, which is fundamental in criminal law. Article 200 of the Paraguayan Code of Criminal Procedure states that any intervention in communications, such as the use of surveillance technologies – in this case massive – must be judicially authorized and must be of an exceptional nature. However, Law 7269/2024 delegates to the Ministry of the Interior the power to implement video surveillance systems without proper judicial supervision, thus violating basic constitutional guarantees. In this regard, the Inter-American Court of Human Rights (IACHR) has established in its Advisory Opinion OC-5/85 that any measure affecting fundamental rights must be ‘provided for by law’ and be ‘necessary in a democratic society’10.
Proportionality
The principle of proportionality is another key element that Law 7269/2024 ignores. At the international level, General Comment 34 of the UN Human Rights Committee states that any limitation to fundamental rights, such as privacy or freedom of expression, must be proportional and based on the need to achieve a legitimate aim11. In this sense, the use of technologies such as facial recognition must be justified by their necessity and effectiveness in relation to the problems they are intended to solve. However, statistics show that the effectiveness of this technology in preventing violence in stadiums is limited. Data compiled by TEDIC shows that, of the more than 1641 cameras installed nationwide by 2024, only four facial recognition alerts were generated during all of 202312. This not only calls into question the effectiveness of the technology, but also raises questions about its necessity, especially when there are other less intrusive measures to ensure stadium security.
Necessity
Criminal law establishes that any measure that interferes with the rights of individuals must comply with the principle of necessity. In the case of facial recognition, it has not been demonstrated that it is indispensable to prevent violence. Additionally, the possibility of applying less invasive alternatives that better respect the individuals’ rights has not been explored. As stated in Article 11.2 of the American Convention on Human Rights, any interference with privacy must be proportionate and necessary, which implies that the authorities must demonstrate that there is no other less restrictive measure to achieve the same end13. In this case, no impact assessment has been carried out to justify the need for this technology, which reinforces the criticism that its use is disproportionate and does not comply with the principles of legality and necessity.
Censorship
From the perspective of the right to freedom of expression, Law 7269/2024 also presents serious violations. The Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights (IACHR), as well as the United Nations Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, have addressed in various reports how surveillance can have a deterrent effect or “chilling effect” on the exercise of freedom of expression14.
The “chilling effect” refers to the self-censorship that arises when people, aware that they are being watched or monitored, refrain from exercising their right to express themselves freely for fear of reprisals or being punished. This type of surveillance particularly affects journalists, activists and human rights defenders whose work depends on their ability to communicate freely without fear of interference or monitoring.
People may be discouraged from expressing their opinions or participating in legitimate demonstrations for fear of being identified and sanctioned. In the context of soccer stadiums, where chants and banners are part of the culture of protest and social criticism, the use of facial recognition technologies can be used to criminalize legitimate expressions of discontent. In this regard, Article 13 of the American Convention on Human Rights guarantees freedom of thought and expression, prohibiting any form of prior censorship15.
Illegal mass surveillance
It is important to highlight that the right to protest and free expression in public spaces is an essential component of any democratic society. The use of facial recognition in these contexts not only inhibits citizen participation, but also opens the door to illegal mass surveillance, in the absence of clear mechanisms of control and judicial supervision over the use of this data. The UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression has warned that the massive collection of biometric data (facial recognition and gestures), without adequate safeguards, can be used to persecute people for their political opinions, thus violating the right to freedom of thought.16.
Discrimination
Another concerning aspect of Law 7269/2024 is the inherent discrimination in the implementation of facial recognition. Studies conducted by institutions such as the National Institute of Standards and Technology (NIST) of the United States of America have shown that facial recognition algorithms tend to be less accurate in dark-skinned people and women17 This creates a risk of structural discrimination, as individuals belonging to ethnic or gender minorities are more likely to be misidentified, which can lead to their unfair criminalization.This discrimination contravenes not only the National Constitution, which in Article 46 prohibits any form of discrimination, but also international treaties such as the International Convention on the Elimination of All Forms of Racial Discrimination and the Convention on the Elimination of All Forms of Discrimination against Women (CEDAW) in Articles 1, 2, 3 and 1518.
Lack of personal data protection
From a more technical perspective, the lack of clear and specific regulation for the treatment of biometric data in Paraguay aggravates the situation. Currently, there is no personal data protection law that establishes adequate safeguards for the use of these technologies, with a supervisory authority to prevent abuses that could be committed by both public and private actors, such as the soccer clubs themselves. Law 6534/2020, which regulates the protection of credit data, provides some provisions on the processing of personal data, but it is not sufficient to address the specific risks posed by facial recognition. In this regard, the Inter-American Juridical Committee (CJI) of the Organization of American States (OAS) has recommended that any use of sensitive personal data, such as biometric data, should be strictly regulated, and that individuals should have the right to grant or withdraw their consent at any time19.
Facial recognition at a global level: an ineffective and dangerous technology
In recent years, the use of facial recognition technologies has grown in sporting events around the world. However, evidence shows that this technology does not guarantee greater security or an effective reduction in violence. Furthermore, it raises significant concerns about its accuracy and its impact on human rights.
An emblematic case occurred at the Champions League final in Cardiff, UK, in 2017, where the facial recognition system generated 2297 false positives out of 2470 possible matches20. This high number of errors showed the unreliability of this technology and generated criticism about its implementation in large-scale events.
Another example occurred during the Copa America 2019 in Brazil, where several innocent fans were mistakenly identified and added to alert lists, exposing the dangers of relying on this technology for security at mass events21
In Mexico, where facial recognition was made mandatory in all stadiums following violent incidents at La Corregidora stadium, no significant decrease in violence has been observed22. The Fan ID system, used to manage biometric identification of stadium attendees, has raised concerns about privacy and mishandling of personal data by the Mexican Football Federation (FMF).
In Chile, for example, the “Garra Blanca” fans of Club Colo Colo have expressed their concern about possible abuses in the processing of personal data and the potential criminalization of social protest through the use of these technologies. In this regard, they urge opposition to voluntary biometric registration23.
In Europe, the Spanish Data Protection Agency (AEPD) has ruled that the use of facial recognition systems in stadiums is highly intrusive to the rights of individuals and has warned that this technology does not comply with the principles of proportionality and necessity24. According to the AEPD, there are less invasive alternatives to ensure security at events, which has led to a ban on the use of this technology in Spain25.
Conclusion
The implementation of facial recognition in Paraguayan soccer stadiums, within the framework of Law 7269/2024, poses a significant challenge to the protection of fundamental rights. Despite the proclaimed objectives of ensuring security and preventing violence at sporting events, the regulation suffers from structural flaws that make it a disproportionate threat to privacy, freedom of expression and non-discrimination. The use of biometric data without an adequate protection framework and without the required judicial supervision exposes individuals to risks of mass surveillance, abuse of power and possible violations of their human rights.
In a global context where multiple international examples have already shown the inherent dangers of facial recognition technology, ranging from technical errors to structural discrimination, Paraguay is at a crucial point. The country lacks comprehensive legislation on personal data protection and effective mechanisms to control the misuse of this technology. This raises questions about the constitutionality of the law and its consistency with international human rights standards, such as the American Convention on Human Rights and the National Constitution itself.
It is imperative that the Paraguayan State promote a thorough review of Law 7269/2024, ensuring that any measure involving the collection of biometric data complies with the principles of legality, necessity and proportionality, as indicated by the IACHR, the UN and other international organizations. The legislative debate must include civil society and experts in digital rights, who have already warned about the risks of this technology when used without the necessary guarantees. In addition, it needs to accelerate the legislative process for the comprehensive bill on the protection of personal data.
Otherwise, the implementation of this law will not only have a negative impact on the individual rights of sports enthusiasts, but could set a dangerous precedent for the adoption of mass surveillance technologies in other sectors of public life. The costs, both in terms of public resources and citizen trust, will be too high if corrective measures are not adopted now.
Recommendations
- Evaluation of the law’s implementation: We urge the Executive Branch to carefully evaluate the implementation of Law 7269/2024. This evaluation should include a thorough analysis of the risks to human rights and consider less invasive alternatives before implementing mass surveillance technologies.
- Participatory regulatory process: It is essential that any regulation of this law be conducted through a public, inclusive process that takes into account the voices of civil society organizations, digital rights experts, and representatives of the affected population, such as organized fan groups. Only a participatory and transparent approach will ensure that the rights of all people are protected.
- Human rights impact evaluation: Before the implementation of surveillance technologies, a human rights impact evaluation must be conducted to guarantee that these technologies do not violate fundamental rights, especially those of the most vulnerable groups, such as children and adolescents.
- Full transparency: We demand full transparency in the use of facial recognition technologies and other surveillance systems. It is essential that clear mechanisms are established to audit the use of biometric data and ensure that they are not used for commercial purposes or indiscriminate surveillance. All clubs, as well as private and public entities, should be transparent and inform affected individuals of the contracts and legal terms that bind the use of their sensitive personal data.
- Guarantees for the protection of personal data: The protection of biometric data must be a priority. It is crucial to establish clear measures to safeguard the privacy of individuals attending sporting events by preventing the processing of sensitive personal data from being mandatory to everyone. The collection of biometric data must be strictly limited to what is necessary to ensure security, provided that this policy is supported by evidence and human rights impact studies.
- Approval of the Personal Data Protection Law: Before implementing Law 7269/2024, Congress should accelerate the approval of the Personal Data Protection Bill currently under discussion in the Chamber of Deputies. Only with an adequate legal framework can we guarantee that the use of biometric technologies respects the rights of the population.
A campaign to raise awareness
For more information on the consequences of mass surveillance in sports, TEDIC is promoting the Con Mi Cara No campaign. This initiative aims to inform and provide resources, specially to soccer fans, about the use of facial recognition in stadiums, the implications of the recently approved law against violence in sports, and the risks of its implementation in Paraguay. The website with all the information is available at conmicarano.tedic.org.
At TEDIC, we want fans to be aware of the situation. Together with civil society and the technical community, we can move forward in demanding respect for our personal data and privacy.
Footnotes
1 Law 7269/24 on the prevention, control and eradication of violence in sports is available here: https://silpy.congreso.gov.py/web/descarga/resolucion-450687?preview
2 TEDIC. 2023. La filtración de datos policiales en Paraguay y una imperante urgencia de respuestas.
3 TEDIC. (2024). Última versión del proyecto de ley de datos personales en Paraguay: Un trabajo colectivo y participativo. https://www.tedic.org/ultima-version-del-proyecto-de-ley-de-datos-personales-en-paraguay/
4 Market Data. (2024, enero 23). Pagos digitales en los estadios y reconocimiento facial anti vandalismo, en busca de más seguridad en el deporte. MarketData. https://marketdata.com.py/noticias/nacionales/pagos-digitales-en-los-estadios-y-reconocimiento-facial-anti-vandalismo-sectores-publico-y-privado-buscan-mas-seguridad-en-el-deporte-127768/
5 Portal Unificado de Acceso a la Información Pública. (2024). Solicitud #84930. Solicitud de acuerdo entre la Asociación Paraguaya de Futbol (APF) y el Ministerio del Interior (MDI) https://informacionpublica.paraguay.gov.py/#!/ciudadano/solicitud/84930
6 Vazquez Group https://www.grupovazquez.com/
7 El Urbano. (2024). Declaraciones Juradas de Santiago Peña muestran inconsistencias. https://elurbano.com.py/declaraciones-juradas-de-santiago-pena-muestran-inconsistencias/
8 Portal Unificado de Acceso a la Información Pública. (2024). Solicitud #83985. Acuerdo de patrocinio entre la SND y ITTI. https://informacionpublica.paraguay.gov.py/#!/ciudadano/solicitud/8398
9 Convención Nacional Constituyente. (1992). Constitución Nacional de Paraguay. Convención Nacional Constituyente.
10 Inter-American Court of Human Rights. Advisory Opinion OC-5/85, Series A No. 5 (1985).
11 United Nations. (2011). General comment No. 34. Article 19: Freedoms of opinion and expression. https://www2.ohchr.org/english/bodies/hrc/docs/gc34.pdf
12 Data collected from National Police accountability reports. The exact number of cameras implemented was collected following a report submitted by this institution in compliance with the Supreme Court of Justice (2024). Acuerdo y sentencia No. 2. Tribunal de Apelación de Feria. Juicio “Leonardo Gómez Berniga c/ Policía Nacional s/ Amparo”. Año 2023 No. 395. Available in: https://www.pj.gov.py/descargas/transparencia/ID214F2-65e8627302a1d-a-y-s-n-02-de-fecha-15-de-enero-de-2024.pdf
13 Organization of American States (1978). American Convention on Human Rights (Pact of San José de Costa Rica). https://www.oas.org/dil/treaties_b-32_american_convention_on_human_rights.pdf
14 See, for example, the Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue (A/HRC/23/40); the Report of the IACHR (OEA/Ser.L/V/II.149); and the Report of the Special Rapporteur on the right to privacy, Joseph Cannataci (A/HRC/31/64).
15 Organization of American States (1978). American Convention on Human Rights (Pact of San José de Costa Rica). https://www.oas.org/dil/treaties_b-32_american_convention_on_human_rights.pdf
16 United Nations (2019). Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression (A/HRC/41/35). https://documents.un.org/doc/undoc/gen/g19/148/76/pdf/g1914876.pdf
17 NIST. (2019). Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects. https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8280.pdf
18 United Nations (1979). Convention on the elimination of all forms of discrimination against women. https://www.ohchr.org/en/instruments-mechanisms/instruments/convention-elimination-all-forms-discrimination-against-women
19 Organization of American States. Department of International Law. Secretariat for Legal Affairs (2023). Updated principles on privacy and personal data protection. Secretariat for Legal Affairs of the Organization of American States. https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf
20 The Guardian. (2018). Welsh police wrongly identify thousands as potential criminals. https://www.theguardian.com/uk-news/2018/may/05/welsh-police-wrongly-identify-thousands-as-potential-criminals
21 Sceiza, B., Rodríguez, N., Aguilar, L., & Lopez, M. (2022). Vigilados en la cancha. Vice En Español—Bootcamp TEDIC. https://bootcamp.tedic.org/vigilados-en-la-cancha/
22 González, M., Zamora, A., & Velazco, A. (2024, agosto 12). El reconocimiento facial avanza en los estadios de fútbol de América Latina. La Política Online. https://www.lapoliticaonline.com/politica/controlados-y-fuera-de-juego-el-reconocimiento-facial-copa-los-estadios-de-futbol-en-la-region/
23 Garra Blanca Oficial (2024). Instagram post from july 19: https://www.instagram.com/p/C9n6Sk-uOLe/utm_source=ig_web_copy_link&igsh=MzRlODBiNWFlZA
24 Agencia Española de Protección de Datos (AEPD). (2022). Gabinete Jurídico. N/REF: 0098/2022. https://www.aepd.es/documento/2022-0098.pdf
25 Agencia Española de Protección de Datos (AEPD). (2023). Expediente No: AI/00394/2023. Asunto: Advertencia. https://www.aepd.es/documento/ai-00394-2023-advertencia.pdf
Starlink in Paraguay: are there risks or concerns about this technology?