Every day, nearly 5 million people use São Paulo's metro system. Every one of their faces may have been recorded in a facial recognition system that has been in use since early 2020. In a March 23 decision, a São Paulo State court ordered the Metro company to stop using the technology.
The Metro appealed the decision, claiming its monitoring system “rigorously obeys the General Law on Data Protection,” but the argument was rejected by the same court in mid-April.
The decision is considered a win for a group of civil society entities who filed the public civil lawsuit to stop this data collection, something they deem unconstitutional and out of step with Brazil's legal framework on digital civil rights.
At the beginning of March 2022, this group filed a civil public lawsuit against the São Paulo State Metro, demanding that they interrupt this data collection and pay compensation for collective moral damages of at least BRL 42 million (around USD 8.5 million).
But the group aspires to have a larger impact beyond the tracks of the São Paulo subway system. They strive to play a part in forming jurisprudence about facial recognition technologies in a country whose legal framework says little to nothing about such systems.
“This decision can have a national impact on what we are currently debating about how the General Law on Data Protection is being applied, about a protective legal framework which is still new and in the process of formulating jurisprudence and understandings in the Judicial system,” explained Sheila de Carvalho, coordinator of the Center for Legal Reference at Article 19 Brazil and South America.
Article 19 is one of the organizations that signed the lawsuit, along with the São Paulo State Public Defenders Office; the Federal Public Defenders Office; the Brazilian Institute in Consumer Defense (Idec); Intervozes, a social communications collective; and CADHu, the Human Rights Advocacy Collective.
Carvalho explained that the core aim of the lawsuit is to spark the debate on how to handle personal data, the need for consent, and the discriminatory impact and social prejudices of these data collection methods.
“This lawsuit [including the arguments in it] opens the way for us to establish more protective parameters in regards to the use of personal data,” the lawyer told Global Voices during a video interview.
Over the past few years, Congress members have proposed bills that attempt to regulate and establish procedures for artificial intelligence implementation, particularly in regard to public security. The Senate, however, has been holding debates with experts which it hopes will result in a new, more privacy-conscious bill, to absorb other existing propositions on the topic.
In February 2020, the São Paulo Metro announced it would implement an “electronic monitoring system using images” for three of the five metro lines. The project was given to the consortium Engie Ineo Johnson, formed by Irish and French firms, with a foreseen investment of BRL 58.6 million (around USD 11.5 million).
At the time, a coalition of civil society entities — the same ones that filed the civil public lawsuit — went to court to obtain more information about the system. They wanted to know how the initiative would align with the principles established by Brazil's General Law on Data Protection (LGPD), approved in 2018 and set to go into effect in August 2020.
Two years later, that question has been answered. According to the organizations behind the lawsuit, the system repeatedly violates the LGPD and goes against other legal mechanisms, such as the Federal Constitution, the Statute for Children and Teenagers, and the Code for Consumer Rights.
The lawsuit claims that the São Paulo Metro company is using facial recognition technology on passengers and using their personal data without consent, without due transparency, and is not making information about the data available to users, such as what it will be used for and how it will be treated.
They also point that the company did not assess the risk of the program or mitigate the issues inherent to facial recognition technologies, as required by law. Moreover, its facial recognition practices violate fundamental human and consumer rights, which harms all public transportation users, particularly marginalized social groups, who would be affected by incorporated racial biases.
Moving against the tide
In the United States, some places are moving to ban facial recognition on the state and municipal levels, while others increasingly normalize the employment of such technology, Wired reports. This paradox highlights the importance of regulation at the federal level.
But Brazil seems to be swimming against the tide. The São Paulo Metro is not the only public entity resorting to facial recognition. Around the country, state governments are implementing it across a range of sectors. According to Instituto Igarapé, an independent Brazilian think tank, by 2019, there were 47 cases of facial recognition implemented in 15 States.
This is particularly problematic in a country where 56.1 percent of the population self-declares themselves Black. This is evident in Bahia, where the leftist government of Rui Costa, a Workers Party politician, is transforming the state into a “facial recognition lab,” as reported by The Intercept Brasil.
Despite having little evidence that such a system is successful for public security purposes, in July 2021, Bahia's government decided to expand the program by piloting a new system in the state's capital, Salvador.
Valued at BRL 18 million (USD 3.56 million), the new system is provided by Spanish firm Iecisa in partnership with Huawei. Cameras spread across the city will collect faces id and archive them in a system, grouping together images of the same person. The system, according to the Intercept, also uses artificial intelligence to cross the collected images with faces that are in the State Public Security Secretary's database for wanted individuals.
According to civil society actors, Brazil still lacks a legal framework that establishes limits and parameters for the use of facial recognition technologies.
“What exists today is the absence of a regulation or guidance of general scope, which results in the tacit authorization for the use of facial recognition systems,” wrote Igarapé in a 2020 report.
In the international community, there is already a more consolidated understanding of this issue, which served as arguments in the lawsuit. The United Nations Human Rights Commission, for instance, recognizes that facial recognition tools may be used to “perpetuate and amplify discrimination,” particularly against women and people of color.
The fact that Brazil does not have a consolidated legal framework, however, is not a hall pass for abuse and violations. The civil society groups who filed the lawsuit against the São Paulo Metro argue that the data being collected in subway stations and trains is illegally being commercialized.
The assumption has grounding: in 2021, ViaQuatro, the private company that administers one of São Paulo's privatized metro lines, was condemned by the São Paulo State Court for using facial recognition without authorization.
At the time, the judge wrote that she had no doubts that passengers’ images were being captured without their consent for commercial purposes that benefit the company and other third-party firms involved.
“We are importing technology in a very non-conscious manner, simply reproducing what was being applied. And even a flawed reproduction, considering that most of these countries have abandoned these technologies. But these countries they need to sell this technology, which is extremely expensive, and use countries with a high inequality rate,” explained Carvalho.
She adds that Brazil operates under a logic of mass incarceration, of criminalization, without being able to use the criminal law parsimoniously for conflicts that truly require it.
“We use it as a first resource and not the last. So it is more permissive for mechanisms like these, which violate rights, to find space to bloom inside our country.”