Data protection agency orders Paraná to suspend facial recognition of students in schools

According to data reported by the government itself, the treatment covered, in 2021, 2,136 educational institutions, around 1 million students and more than 100 thousand employees. The ANPD states, however, that it did not receive updated figures on the system's reach. The agency concluded that there was no adequate legal hypothesis for the processing of biometric data, considered sensitive by the General Data Protection Law. According to the technical note, the Department of Education presented more than one legal justification for the same purpose, which makes it difficult for holders to exercise their rights. The ANPD also considered facial recognition unnecessary and disproportionate, as it understood that the frequency could be recorded using less invasive methods. The document cites, for example, “a nominal call made in a computerized environment”. For the agency, the practicality of the system is not enough to justify the processing of sensitive data. “Convenience based on practicality is not capable of sustaining the need required” by the LGPD, states the note. The document also points out that the government did not demonstrate sufficient controls over access and sharing of images, supervision of contracted companies, the accuracy of algorithms and the adoption of less invasive alternatives. The ANPD also states that no evidence was presented that the use of technology served the best interests of children and adolescents. Another point raised was the storage period. As the information would be kept as long as the student remained enrolled, the system could store “the equivalent of 14 years of biometric data for each student”. The note highlights that biometric characteristics have a low possibility of replacement and that a possible compromise of these identifiers can produce “lasting consequences”, greater than those caused by the leakage of conventional passwords. The ANPD also pointed out obstruction to inspection, due to “the continued failure to provide copies of documents and information necessary” for the analysis of the system. The government will have ten working days, counting from the subpoena, to demonstrate that it has stopped processing the data in all systems, schools and companies involved. The process will be forwarded to the ANPD's sanctions area, which will evaluate the opening of administrative proceedings against the Department of Education. The decision may be appealed. The Paraná Department of Education, Celepar and Valid were contacted, but did not respond until the publication of this text. The space remains open.