The lawsuit stems from the suspected commercialization of metro-user data
At the beginning of March 2022, this group filed a civil public lawsuit against the São Paulo State Metro, demanding that they interrupt this data collection and pay compensation for collective moral damages of at least BRL 42 million (around USD 8.5 million).
But the group aspires to have a larger impact beyond the tracks of the São Paulo subway system. They strive to play a part in forming jurisprudence about facial recognition technologies in a country whose legal framework says little to nothing about such systems.
Carvalho explained that the core aim of the lawsuit is to spark the debate on how to handle personal data, the need for consent, and the discriminatory impact and social prejudices of these data collection methods.
“This lawsuit [including the arguments in it] opens the way for us to establish more protective parameters in regards to the use of personal data,” the lawyer told Global Voices during a video interview.
Two years later, that question has been answered. According to the organizations behind the lawsuit, the system repeatedly violates the LGPD and goes against other legal mechanisms, such as the Federal Constitution, the Statute for Children and Teenagers, and the Code for Consumer Rights.
The lawsuit claims that the São Paulo Metro company is using facial recognition technology on passengers and using their personal data without consent, without due transparency, and is not making information about the data available to users, such as what it will be used for and how it will be treated.
They also point that the company did not assess the risk of the program or mitigate the issues inherent to facial recognition technologies, as required by law. Moreover, its facial recognition practices violate fundamental human and consumer rights, which harms all public transportation users, particularly marginalized social groups, who would be affected by incorporated racial biases.
Despite having little evidence that such a system is successful for public security purposes, in July 2021, Bahia's government decided to expand the program by piloting a new system in the state's capital, Salvador.
Valued at BRL 18 million (USD 3.56 million), the new system is provided by Spanish firm Iecisa in partnership with Huawei. Cameras spread across the city will collect faces id and archive them in a system, grouping together images of the same person. The system, according to the Intercept, also uses artificial intelligence to cross the collected images with faces that are in the State Public Security Secretary's database for wanted individuals.
According to civil society actors, Brazil still lacks a legal framework that establishes limits and parameters for the use of facial recognition technologies.
The fact that Brazil does not have a consolidated legal framework, however, is not a hall pass for abuse and violations. The civil society groups who filed the lawsuit against the São Paulo Metro argue that the data being collected in subway stations and trains is illegally being commercialized.
At the time, the judge wrote that she had no doubts that passengers’ images were being captured without their consent for commercial purposes that benefit the company and other third-party firms involved.
“We are importing technology in a very non-conscious manner, simply reproducing what was being applied. And even a flawed reproduction, considering that most of these countries have abandoned these technologies. But these countries they need to sell this technology, which is extremely expensive, and use countries with a high inequality rate,” explained Carvalho.
She adds that Brazil operates under a logic of mass incarceration, of criminalization, without being able to use the criminal law parsimoniously for conflicts that truly require it.
“We use it as a first resource and not the last. So it is more permissive for mechanisms like these, which violate rights, to find space to bloom inside our country.”