Case Summary and Outcome

A Civil Court in São Paulo, Brazil held that the use of facial recognition technology on a subway line was an infringement of the right to privacy of one’s image and to the freedom of information. After the operator of a subway line in São Paulo introduced interactive subway car doors which displayed personalized advertisements to the passengers based on information gathered through facial detection technology, a consumer rights organization approached the Court seeking damages and an order prohibiting the use of the equipment. The Court held that the use of any facial recognition or detection software required the consent of users, and ordered the subway operator to cease using the technology.

Facts

In 2018, ViaQuatro, the operator of one of São Paulo’s subway lines, deployed interactive doors at its stations. It planned to use them to display personalized advertisements to riders, gauging demographics information and emotional reaction through cameras equipped with facial recognition technology. Idec (Instituto Brasileiro de Defesa do Consumidor), a consumer rights organization, and the public defenders’ office filed a class action suit in the 37^th Civil Court, São Paulo, seeking 100 million Brazilian reais in damages and an order against the use of the equipment by ViaQuatro.

Decision Overview

Judge Patrícia Martins Conceição entered the judgement of the Court. The central issue for the Court’s determination was whether the use of facial recognition technology without the subway users’ consent was permissible.

ViaQuatro argued that there was no processing of personal data, because the passengers were never identified individually, and that no actual face recognition was used by the equipment but rather only “face detection”.

The Court held that ViaQuatro bore the onus to demonstrate the proof of their claim and that ViaQuatro had not provided the Court with sufficient evidence. The Court particularly noted the lack of expert evidence. The Court stated that even “face detection”, as ViaQuatro maintained the technology was employing “would seemingly implicate the concept of biometric data” under the General Data Protection Law, and so likely required consent from data subjects.

The Court emphasized the General Data Protection Law’s provisions on the processing of data on children and adolescents.

The Court held that ViaQuatro had “unequivocally violated” the right to the protection of one’s image, data protection requirements for the processing of sensitive data, and consumers’ right to information. It ordered ViaQuatro not to use the interactive doors without securing prior consent from passengers, and awarded 100,000 Brazilian reais in damages for collective harm arising from the unlawful data processing. This was less than the 100 million Brazilian reais Idec had sought. The Court rejected the claim of damages for non-economic harm to riders themselves, holding that this would overlap with the damages for collective harm.