Facial recognition surveillance in sports venues has become a flashpoint in the Czech Republic. After a chaotic incident at a recent match, both football clubs and political figures have advocated for biometric monitoring systems. The proposal has triggered resistance from civil society and digital rights advocates, particularly IuRe, even as some government figures continue exploring ways to deploy such technology.
When match safety is underestimated
On Saturday, May 9, 2026, Czech football experienced a significant security failure. During the Prague derby between Sparta and Slavia, hundreds of Slavia supporters rushed onto the pitch in the final minutes of play, with smoke from flares obscuring the field.
Masked Slavia fans launched flares toward the Sparta supporters' section, and three Sparta players were assaulted. The incident cost Slavia the match, but the real concern lay elsewhere: stadium security proved wholly inadequate, with personnel making no effort to contain the disturbance or prevent fans from gathering near the goal before the invasion occurred.
"We will implement biometric surveillance and impose fines"
Jaroslav Tvrdík, Slavia's president, expressed regret and acknowledged responsibility. Rather than addressing the security lapses, however, he redirected blame toward European Union data protection rules. He claimed the club had already invested 16 million crowns in facial recognition equipment but could not activate it due to legal constraints.
It really pains me that we have this system (face recognition cameras) installed for 16 million crowns; we could turn it on and immediately know who did it. Unfortunately, we live in the European Union, which prioritises the right to data protection over the safety of stadium visitors.
Jaroslav Tvrdík, president of Slavia Prague
Tvrdík escalated his position further, announcing he had requested a meeting with the Office for Personal Data Protection's chairman. He reported that the club's owner, Pavel Tykač, had instructed him to activate the systems regardless of penalties.
This week I requested a meeting with the chairman of the Office for Personal Data Protection. The owner of Slavia (Pavel Tykač) told me this morning that we should activate those systems. Let them fine us; we'll pay them. Until the courts ban it, we'll use it to identify violent offenders and rioters. I suppose we need to escalate the situation and decide whether the priority here is protecting public health or protecting data.
Jaroslav Tvrdík
Criticism from experts and protests across football clubs
By May 17, the situation shifted dramatically. Following a three-and-a-half-hour session with the Office for Personal Data Protection, Tvrdík announced that Slavia would not proceed with biometric surveillance.
Tvrdík attributed the reversal to the Artificial Intelligence Act, which he identified as the primary legal barrier. He also disclosed that officials had warned him of potential criminal consequences, including prison terms of two to three years and fines reaching hundreds of millions of crowns.
Legal experts at IuRe, an EDRi member organization, had already outlined the illegality of such surveillance the previous week. Football supporters from multiple clubs also mobilized against the proposal, displaying banners at various stadiums stating: "Tvrdík, scan your conscience, not our faces."
The episode marked a rare moment when opposition to biometric surveillance transcended the digital rights sector and reached mainstream sports audiences in the Czech Republic.
Biometric surveillance in the Czech Republic: constantly on the edge of legality
IuRe's advocacy has produced mixed results in the country's broader surveillance landscape. The organization successfully challenged a facial recognition system at Václav Havel Airport in Prague last year for breaching the Artificial Intelligence Act. The system was subsequently reactivated, however, after the necessary legal approvals and court authorization were obtained.
Three years earlier, IuRe lawyers had raised concerns about the Czech police's "Digital Image of Persons" system. This database contains millions of photographs extracted from identity cards and passports, each linked to personal identifiers that allow officers to access associated information including names, addresses, and dates of birth. The system's architecture technically permits uploading images from social media or surveillance cameras for identification purposes. The Office for Personal Data Protection subsequently confirmed the system lacked adequate legal foundation.
More recently, IuRe identified additional deficiencies in the EyeDentity system deployed by two regional police forces, particularly the absence of a Data Protection Impact Assessment (DPIA).
The football stadium controversy may ultimately serve a constructive purpose by shifting debate away from emotional reactions toward evidence-based legal analysis. European legislation, closely tracked by EDRi member organizations, has thus far prevented facial recognition from expanding beyond airport settings into broader public spaces across the Czech Republic.
Yet the threat persists. Several Czech government officials continue advocating for legislative changes that would authorize or mandate facial recognition deployment. Many adopted this stance following the recent stadium incident. The scandal also exposed that numerous football clubs already possess camera infrastructure capable of facial recognition, though these capabilities remain dormant.
Slavia's decision to keep its cameras inactive represents only a single victory in what appears destined to become a prolonged struggle over surveillance and privacy rights in Czech football venues.
Source: EDRi (European Digital Rights)
