Respect de la vie privée, protection des données et rétention
NM c. Smith
Afrique du Sud
On Appeal Expands Expression
A Civil Court in São Paulo, Brazil held that the use of facial recognition technology on a subway line was an infringement of the right to privacy of one’s image and to the freedom of information. After the operator of a subway line in São Paulo introduced interactive subway car doors which displayed personalized advertisements to the passengers based on information gathered through facial detection technology, a consumer rights organization approached the Court seeking damages and an order prohibiting the use of the equipment. The Court held that the use of any facial recognition or detection software required the consent of users, and ordered the subway operator to cease using the technology.
In 2018, ViaQuatro, the operator of one of São Paulo’s subway lines, deployed interactive doors at its stations. It planned to use them to display personalized advertisements to riders, gauging demographics information and emotional reaction through cameras equipped with facial recognition technology. Idec (Instituto Brasileiro de Defesa do Consumidor), a consumer rights organization, and the public defenders’ office filed a class action suit in the 37th Civil Court, São Paulo, seeking 100 million Brazilian reais in damages and an order against the use of the equipment by ViaQuatro.
Judge Patrícia Martins Conceição entered the judgement of the Court. The central issue for the Court’s determination was whether the use of facial recognition technology without the subway users’ consent was permissible.
ViaQuatro argued that there was no processing of personal data, because the passengers were never identified individually, and that no actual face recognition was used by the equipment but rather only “face detection”.
The Court held that ViaQuatro bore the onus to demonstrate the proof of their claim and that ViaQuatro had not provided the Court with sufficient evidence. The Court particularly noted the lack of expert evidence. The Court stated that even “face detection”, as ViaQuatro maintained the technology was employing “would seemingly implicate the concept of biometric data” under the General Data Protection Law, and so likely required consent from data subjects.
The Court emphasized the General Data Protection Law’s provisions on the processing of data on children and adolescents.
The Court held that ViaQuatro had “unequivocally violated” the right to the protection of one’s image, data protection requirements for the processing of sensitive data, and consumers’ right to information. It ordered ViaQuatro not to use the interactive doors without securing prior consent from passengers, and awarded 100,000 Brazilian reais in damages for collective harm arising from the unlawful data processing. This was less than the 100 million Brazilian reais Idec had sought. The Court rejected the claim of damages for non-economic harm to riders themselves, holding that this would overlap with the damages for collective harm.
La direction de la décision indique si la décision élargit ou réduit l'expression sur la base d'une analyse de l'affaire.
In the first case involving facial recognition on public transportation, the Court expanded the protection given by the rights to privacy and prohibited the use of facial recognition technology which has repeatedly been described as having a chilling effect on freedom of speech by rejecting the claim that “face detection” technology did not require data protection.
La perspective globale montre comment la décision de la Cour a été influencée par les normes d'une ou de plusieurs régions.
L'importance du cas fait référence à l'influence du cas et à la manière dont son importance évolue dans le temps.
Faites-nous savoir si vous remarquez des erreurs ou si l'analyse de cas doit être révisée.