The current wording of the Bill classifies facial recognition technologies as “Excessive Risk”, but establishes a broad list of exceptions that cover all current uses of these technologies in the context of public security and criminal prosecution in Brazil (PL 2338/2023 Art. 13, item VII). In fact, the bill approved by the federal senate creates a regulatory vacuum by establishing a broad list of exceptions that are not covered by any governance structure proposed by the text.
In this sense, the Rights on the Net Coalition, the Get My Face Out of Your Sights Campaign and the other organizations that signed this initiative ask the rapporteur to reconsider his position and create mechanisms to regulate the use of facial recognition technologies in public spaces. This request is based on technical evidence and on grounds of unconstitutionality and violation of fundamental rights, as set out below.
Bills and normative acts that intend to employ biometric technologies for the purposes of criminal prosecution and surveillance of the Brazilian population do not stand up to an analysis of constitutionality, proportionality and justice, as required by the due legislative process.
This analysis must also cover the actions of the Executive Branch, under the terms of articles 20 and 21 of the Law on the Introduction of Brazilian Law (LINDB), which impose the duty to consider the practical and social consequences of administrative and normative decisions, not just based on abstract legal values. Thus, it is imperative that any public policy based on facial recognition be preceded by a regulatory impact assessment, independent studies and public consultation, under penalty of incurring arbitrariness and misuse of purpose.
Shedding light on facial recognition is urgent if the country is to make decisions based on evidence and not on spurious technological promises. This is a high-impact technology that directly touches on principles of public administration (legality, publicity, efficiency), the protection of personal data (Law No. 13,709/2018 – General Data Protection Law – LGPD) and fundamental rights such as privacy, equality and freedom of assembly. Without robust safeguards, independent evaluations and social control, facial recognition produces discrimination, mass surveillance and inefficient public spending – as well as opening up space for private and foreign interference in the personal data of Brazilian citizens and critical infrastructures, compromising our sovereignty and weakening our democracy. Here we list some of the axes that need legislators’ attention:
- Precepts of public administration, budget and undue interference by the private sector
Since 2014, the use of facial recognition in public security has taken place without any regulatory framework, revealing serious risks to budgetary integrity and public management. In Goiás, for example, several newly-opened companies with notably no expertise have signed million-dollar contracts with the state to implement and manage the technology (Nunes et. al, 2023; ANPD, 2024), usually acquired under a waiver of bidding, with no transparency about budget execution, no counterparts or impact reports and, often, without the public administration even knowing its real effectiveness. To make matters worse, in addition to spending public money, the population’s sensitive biometric data is safeguarded by companies with private interests, which goes against the LGPD itself. This scenario violates the principles of legality, efficiency and publicity, art. 37 of the Federal Constitution, and creates technological dependence on private companies, often foreign ones, over the population’s sensitive data, affronting national sovereignty and the LGPD.
The use of facial recognition has been an expense for the Public Administration. The Smart Sampa project cost the contracted consortium approximately 10 million per month. In Bahia, 600 million reais have already been spent since the facial recognition system began to be implemented in 2019. The O Panóptico project estimates that these 600 million reais could be spent on 1,500 ambulances, 300 emergency care units (UPA) and funding a state reference hospital for 32 years. Even with these massive investments, the report pointed out that the technology showed a low hit rate and high potential for errors, resulting in arrests of innocent people and inefficient use of the public budget.
- Violation of the Right to Liberty and the Presumption of Innocence
The use of these technologies violates the fundamental right to liberty (Art. 5, caput and XV of CF/88) and the principle of the presumption of innocence (Art. 5, LVII of CF/88). By associating the generalized surveillance of the entire population with criminal databases, the State imposes a collective “penalty of suspicion”, treating every citizen as a potential offender without just cause and violating, incompatibly with due process of law and the logic of the Democratic State of Law.
- Violation of the Right to Equality and Discriminatory Character
Organized civil society has been denouncing for years the problems of facial recognition and the fundamentally biased and racist way in which it operates, subjecting the population to the risk of having their right to come and go curtailed. No wonder, in April 2025, an 80-year-old man was mistaken for a wanted rapist and held for 10 hours in a police station. The arrest occurred because of a false alert from the Smart Sampa cameras located in a Basic Health Unit. In Sergipe, a woman was mistaken twice during the same event in 2024, one of which culminated in a truculent approach that made her feel “coerced and desperate”. In her terror, the woman even urinated. In Rio de Janeiro, during a racial equality conference, a public servant was approached and taken to the police station because of a tool error. The errors are systematic and have a preferred target: black people. It is not possible for democracy to coexist with a public security policy based on the massive production of unequal experiences in terms of access to rights, goods and services.
Biometric systems contravene the principle of equality before the law (Art. 5, caput of CF/88), as studies and concrete evidence show that these tools have disproportionately higher error rates against specific demographic groups (such as black people and women). Technological inaccuracy deepens structural biases, resulting in selective false positives and discriminatory policing, which undermines the Republic’s fundamental objective of promoting the good of all, without prejudice (Art. 3, IV of CF/88).
- Objective responsibility and the risk of conviction for the state
It should be noted that these failures and unjust arrests due to the use of facial recognition technology can also lead to compensation from the state. This technology, as part of a public security policy, by leading to situations of embarrassment and violation of rights, ends up being covered by the constitutional provision for the liability of legal entities governed by public law in the event of damage caused by their agents ( Art, 37, §6, CF/88).
- Violation of Personal Data Protection
The large-scale collection and processing of biometric data, defined as sensitive personal data by the General Data Protection Law (Art. 5, II), violates the fundamental right to data protection (Art. 5, LXXIX of CF/88), recognized by the Federal Supreme Court. Such applications disregard the principles of purpose and necessity (LGPD, Art. 6, I and III), as mass surveillance of the entire population exceeds the minimum required for criminal prosecution. The absence of a specific law for this treatment in the public security sphere, required by the LGPD itself, makes the operation precarious and illegitimate.
It is important to note that the exception to the General Data Protection Law for the use of personal data for public security/criminal investigation purposes does not mean that the law does not apply. It is important to reaffirm that the principles, including purpose, necessity and accountability, and the rights listed in the LGPD still apply to these public security activities and that data protection is a fundamental right listed in the Federal Constitution and endorsed by decisions of the Federal Supreme Court. This perspective was already endorsed by the National Data Protection Agency (ANPD) at least two years ago in Technical Note 175/2023.
It should be noted that even if it does not apply in full, the LGPD itself lays down reporting obligations for the Authority when personal data is processed for public security purposes and criminal investigations involving private entities. Likewise, the LGPD prohibits all processing for these specific purposes.
- Violation of the Duties of Ponderation and Consequentialism (LINDB)
Conclusion
In view of the above, and in strict compliance with the pillars established by the Federal Constitution of 1988, the General Data Protection Law and the Law of Introduction to the Norms of Brazilian Law, the signatory entities reiterate their vehement request for the inclusion in PL 2338/2023 of control mechanisms and limitations on the use of biometric technologies for the purposes of criminal prosecution and mass surveillance in Brazil, due to their manifest unconstitutionality and incompatibility with a Democratic State of Law.
Get My Face Out of Your Sights Campaign
Rights on the Net Coalition