Agency suspends use of facial recognition for school calls in Paraná

The agency considered that the law does not establish an adequate rule for the processing of sensitive data and identified risks to data security and governance.

The biometric identification of students began to be used in 2023 by the government of Ratinho Junior (PSD) to make school calls on the public network through photographs of the class taken by teachers.

According to the agency's decision, the suspension must lead to the interruption of collection, capture, recording, consultation, comparison, authentication, use, sharing and other operations related to the control of school attendance through facial recognition. The use of the technology is prohibited until further deliberation by the agency.

The technologies were offered by the company Valid, which was hired after a tender from the Paraná Department of Education to manage the data from Celepar (Companhia Paranaense de Informática).

To Folha, the ministry said that "the facial recognition calling service was used as a pilot project" and "never exposed student data". According to the entity, the program stopped being used in July 2026 with the end of the contract with Valid, and schools have already resumed calling in the traditional model.

In a note, the ANPD states that the information shared by the government during the process was not sufficient to "demonstrate that the systems used to process students' biometric data were structured in order to meet security requirements, standards of good practice and governance, and general principles of personal data protection".

According to the agency, it has not been proven, for example, how access controls work on student photos captured by teachers with their own cell phones.

Furthermore, the ANPD says that the secretariat omitted information and documents necessary to evaluate the activities investigated.

"The questions asked by the Agency were only partially answered, and the documents sent were not sufficient to prove the need for biometric processing of children and adolescents for the purpose of recording school attendance (a measure disproportionate to the purpose)", he states.

The secretariat will have 10 working days to prove compliance with the order. Now, the case goes to the General Coordination of Sanctions, which will decide on opening a procedure to punish the state government.

This new process has as its maximum punishment a warning and a definitive ban on the use of technologies, because the LGPD (General Data Protection Law) prohibits the application of financial sanctions to public bodies.

For Rafael Zanatta, executive director of Data Privacy Brasil, this is "one of the most important cases in Brazil to draw the line between what can and cannot be done in the school context."

He explains that biometric data is considered sensitive by the LGPD, which increases the level of protection to which it must be subject.

Zanatta also points out that the evolution of technologies facilitates the creation of deepfake content, which creates the risk that even photographs of children and adolescents in the classroom are used to produce sexual content by actors with bad intentions.

In addition to the ongoing administrative process at the ANPD, the state is responding to a legal process at the TJPR (Paraná Court of Justice). The MPPR (Public Ministry of the State of Paraná) asks that the government be ordered to pay R$15 million in moral damages. There has been no decision yet.