Facial recognition used without consent at French running events
PhotoRunning, a sports photography company, used facial recognition technology at approximately 48 running events in France without valid GDPR consent, affecting over 320,000 runners and spectators including children. The company did not disclose the facial recognition use in event regulations, and researchers demonstrated they could retrieve individual participants' photos through facial matching without authorization.
What happened
PhotoRunning, a sports photography service, used facial recognition technology at approximately 48 running events across France over twelve months to match photographs with participants' biometric data.
None of the 48 event regulations mentioned facial recognition use, and image rights clauses in race rules did not constitute valid GDPR consent for biometric processing. More than 320,000 people including runners and spectators of all ages were potentially affected, including children as young as 6 years old at the SaintéGones event.
Reported impact
PhotoRunning stated that selfies uploaded for matching were not retained and facial vectors were deleted after thirty days, and that participants could retrieve only their own photographs from the platform. However, researchers recovered photographs from SaintéGones participants through facial recognition without users' knowledge.
Index analysis
GDPR prohibits facial recognition use except with valid consent meeting specific criteria. Legal analysis found that race event image rights clauses in regulations do not meet those criteria and do not cover biometric data processing.
Governance controls
A complaint was filed with the CNIL regarding the unauthorized use of facial recognition.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.