Results: RFID and Identity Management in everyday life - ITAS

popular matches. They can also be approached if for example they did not renew their season ticket or
did not buy a new T-shirt that year.
A smart stadium indeed, but what do the fans think of this? During our visit, one member cardholder
commented on the fact his whole history is retained and analysed: “It is good that they can see who are
the better supporters.” Another mentioned: “It then helps keep good fans in the club and get rid of
troublemakers”. A third regular mentioned: “Yes this is good so you get a benefit for attending more
matches.” Still, the fans do have one worry: the use of information by third parties. This should not be
allowed according to them. One person says they do not have any experience with non-football related
marketing, but are not certain if this will remain like this: “But they probably also use personal
information for marketing purposes. What can you do about it? You can not prove it and you can not
change it”. Another supporter states he would want to have a say in the applications for which
personal information or the information gained through the RFID system is used and that he would not
want any third party being involved or benefiting from this. According to Mr. Hanson, the information
gained in the RFID environment is only used for in-house purposes. The stadium can and will not
trade the information to third parties. For one thing, the Data Protection Statement of the register
procedure prohibits this and this and other issues about privacy are covered by British Law.
The Fortress system is currently in use in many British and Norwegian football stadiums and we found
accounts of comparable systems in other countries. Although these systems can be seen as being very
invasive, taking full control over a persons' Identity Management within a stadium setting, we did not
encounter any public controversy. One controversy we did encounter in football was on a ticketing
system which was even less intrusive concerning tracking people, but was just of a different league:
the World Cup 2006 in Germany.
Football fans who attended a match at the football world cup in Germany got their ticket through the
FIFA World Cup ticketing Centre [case #19]. These tickets contained passive RFID tags in order to
combat counterfeiting and to ensure only those with legitimate tickets can get in. On applying for a
ticket one has to provide personal information: name, address, nationality, sex, date of birth, passport
number, e-mail address (optional), telephone number (optional) and, possible, also the club you are
supporting. This information is stored in a database and linked to the ID-number on the chip. The
chips were only scanned at the entrance of the stadium, while there were no scanners inside the
stadium or anywhere else. The data however, are shared with third parties such as security agencies,
stadium operators and shipping providers if necessary, as is stated on the FIFA website. This led some
privacy groups to accuse Germans football authorities of “Big Brother tactics”. Foe Bud for example
stated that the RFID tags are being justified under false pretexts, like security reasons, and that it is
unfair to insert this kind of technology in an item that much wanted by fans.
“What could be nicer: A top-event with millions of enthusiastic people who would do just
about anything for their most beloved hobby. Add to this a September 11 heralding no
end of "threat by terrorism", and you have all the justification you need for just about any
measure to cut down on freedom rights as long as there is a sticker on it saying
"security". And should the World Cup go past without any assaults you have every
justification to afterwards call the whole "security-concept" a success, RFID in the tickets
and all, and silence all the critics with a hearty salute: "Hey, all of you conspiracy
theorists, hundreds of thousands of soccer fans didn't have any problems with RFID!"
Another group entering the debate was the German Data Protection Centre. They state on their website
that supervision and security are two different things. Therefore, introducing technologies under the
pretext of enhanced security cannot be done just like that. According to the FIFA however personal
data are processed in compliance with the Data Protection Legislation. Moreover, compared to the
other cases in football, this RFID system is not as much intrusive as it only tracks the user at one
point: the access of the stadium. Still, it was the privacy watch groups which led the debate over this
case. Our final case in the leisure sector did involve a much broader public debate, urging not just
privacy groups, but also a whole host of journalists and even parliamentarians to participate. Not
23