A NEW BILL BRINGS RESTRICTIONS ON THE PROCESSING OF PERSONAL DATA COLLECTED THROUGH THE RECOGNITION OF FACIAL BIOMETRICS
Congressman Guigo Peixoto presented in the House of Representatives Bill No. 2392/22 which provides for the use of facial recognition technologies in the public and private sectors, conditioning the collection of personal data biometric data to the prior elaboration of impact report to privacy, in accordance with the General Personal Data Protection Law (LGPD in Portuguese), Law No. 13,709 of 2018.
LGPD has in its art. 5, XVII that the impact report on personal data protection corresponds to the document that must be prepared by the controller (the one who has decision-making power over the processing of personal data) with the description of the processes that may generate the holder risks to their civil freedoms and their fundamental rights.
The impact report on personal data protection shall define safeguards and mechanisms for mitigating such risks and will be available for any audit of the National Data Protection Authority (ANPD in Portuguese). The same document needs to demonstrate the effective need to use facial biometrics, as well as the impossibility of using another type of identification that does not use biometric data.
The biometric data is considered personal data sensitive by the LGPD and, therefore, should observe a special rule and greater caution regarding its treatment, since the use of the data may result in some kind of discrimination against its holder.
In this sense, in one of the justifications for the proposal, the deputy points out that: “The consequence of misuse of these data can be extremely harmful to citizens. Imagine the hypothesis that a person is arrested by errors in the identification or the embarrassment of having denied access to a certain establishment from which he is a partner. These situations are not as rare as they may seem. According to research by MIT Media Lab, while white men are recognized in up to 99% of cases by some of the commercial software, the error in identifying black women can rise to 35%, clearly unacceptable percentage.”
The bill also provides for the prohibition of sharing the collected biometric data, regardless of the consent of the holder, which if it occurs, will be considered void. The only exception provided for sharing these data will be to transfer to the government, in exclusive cases of public security, national defense, investigation activities, and repression of criminal offenses.
Regarding the enjoyment of services provided by the government, biometric data from facial recognition technologies may not be used as the sole way of identifying the holders, and it is mandatory, therefore, to be immediately available, in case of non-recognition facial, alternative means of identifying the holder of the personal data.
The bill has its proposition subject to the conclusive appreciation for the working, administration, and public service committees, and constitution and justice and citizenship to continue the legislative process.
Source: https://bit.ly/3EXhAjf
