According to the decision issued on Tuesday by judge Cynthia Thome at the São Paulo State Court, Companhia do Metropolitano de São Paulo (METRO) must immediately suspend the process to capture and processing of biometric data for facial recognition in the context of the implementation of an electronic surveillance system. Moreover, the company has been ordered to immediately suspend the roll-out of new equipment that promotes data capture and biometrics processing for facial recognition. The decision also sets a daily fine in the event of non-compliance. The decision follows a civil lawsuit initiated by several civil rights organizations calling for a ban on the use of facial recognition technology amid discrimination concerns. According to the latest sentence, the entities argued that despite the fact this was not explicit in the public notice for the system, one of its objectives is implementing a facial recognition system of all subway users, with capacity for data storage and sharing. The claimants argued that the electronic monitoring system would involve facial recognition, with images of all 4 million daily metro users captured by a system called SecurOS. The goal is to store data, and there is a possibility that SecurOS will be integrated with other electronic monitoring systems based on facial recognition. Citing the civil lawsuit, the sentence noted the organizations deem the capture of biometric data from all Metro users as “illegal and disproportionate, since all faces, from all users, will be read, copied, measured and recorded.” In addition, the organizations argued that despite the data processing activities, there are no measures in place for obtaining consent and non-consent to data processing biometric data of subway users. In addition, the sentence noted the entities have argued that there is a lack of transparency around the characteristics and risks related to the treatment of personal data by the company running the São Paulo metro system. The organizations noted that METRO failed to explain which database will be used to train facial recognition models, which prevents evaluating the project efficiency. Furthermore, there is no information about the evaluation and impact measures and risk mitigation in implementing the electronic monitoring system with facial recognition. According to the latest decision, judge Thome noted that METRO has not yet provided precise information about how facial recognition would be used in the subway system and how the information would be processed. The sentence argued that the case presents several technical issues that require additional evidence, but the system’s implementation could impact citizens’ fundamental rights. “On the other hand, it must be considered that the administrative contract is in force and that there was a large investment by METRO. In addition, no doubt suspending the execution of the contract regarding the installation of the system may generate irreversible damages”, the sentence noted. Contacted by ZDNet, METRO said that it had not been notified of the decision. However, the company said it “will appeal and provide all clarifications, since the new monitoring system strictly complies with the General Data Protection Regulations provisions.” Since February, personal data protection is a fundamental right in Brazil.
