Biometrics and Facial Recognition - ANPD Releases Report

On June 24, 2024, the Brazilian Data Protection Authority (ANPD) released the second edition of Radar Tecnológico (Technology Radar). This edition (the “Paper”) focuses on "Biometrics and Facial Recognition." The Paper analyzes the impacts of this technology, particularly the risks and challenges for the protection of personal data, especially in view of the Brazilian General Data Protection Law (LGPD).

Definitions

The Paper first defines what biometric recognition is: a technical analysis, by an automated system, that identifies an individual’s physiological (fingerprint, face, iris, etc.) or behavioral characteristics (voice, facial expression, way of walking, etc.). The Paper then defines a biometric template as the basis for verifying someone's identity through facial recognition. This template is stored as a hash code in the database of the recognition system.

Uses

The Paper focuses on facial recognition, which, in biometric recognition, has three main purposes: (i) to simply detect the presence of people, (ii) to unequivocally identify an individual, and (iii) to classify an individual according to their emotional expressions. The Paper also notes facial recognition’s use in neurotechnology, especially brain-computer interface (BCI) technologies, which are already widely used in healthcare and have made significant progress in recent years.

AI-Related and Other Risks

The ANPD repeatedly notes the use of artificial intelligence (AI), which, through training with large amounts of data, has contributed to the accuracy of biometric identification systems. However, it is essential to note that the European Union's Artificial Intelligence Regulation ("EU AI Act") prohibits, for example, the use of biometric AI systems aimed at inferring an individual's emotions within the workplace or educational institutions. The EU AI Act also bans the use of biometric AI systems for other purposes, such as categorizing natural persons based on their race.

Also on this point, biometric identification and authentication systems for recognizing emotions are considered high-risk—but are not banned—in Article 14, XI of the June 18, 2024, version of the Brazilian Artificial Intelligence Act (Bill No. 2.338/2023).

The Paper also stresses that biometric data is considered sensitive data under the LGPD, which heightens the risk on any processing activity. So identification and possible classification of individuals using neurotechnology, for example, raises notable data protection and privacy risks and other concerns.

The ANPD highlights the possible existence of biases in the training databases of facial recognition systems, which could lead to discrimination against individuals. The ANPD also points out how data breaches of biometric templates could assist in identity theft and financial fraud, for example.

Public Space Controversy

While the Paper outlines the many uses of facial recognition technology to identify individuals—for border control, public security, fraud prevention, among others—the main focus of the Paper is facial recognition’s use in public security, i.e., mass surveillance. The ANPD analyzes several cases, identifying the possible risks and impacts on individuals of this particular use case.

The EU AI Act has banned the use of real-time biometric identification AI systems in public spaces, with some exceptions, such as to identify a person suspected of having committed a criminal offence, or to conduct a criminal investigation. Similarly, Article 13,   Section VII of the June 2024 version of the Brazilian Artificial Intelligence Act bans using real-time biometric identification systems in spaces accessible to the public, with some exceptions, such as searching for victims of crimes or missing persons or in other circumstances involving a serious and imminent threat to the life or physical integrity of natural persons.

The US Federal Trade Commission (FTC)¹ has been investigating facial recognition technology. The FTC ordered a five-year ban on the use of facial recognition technology to monitor the stores of a pharmacy chain because the technology produced false positives of people allegedly stealing or engaging in other wrongdoing at the stores. This technology led to discrimination against certain people, especially because of their color, which led to the FTC's decision.

The use of surveillance technology based on facial biometrics is also controversial at a global level; Amnesty International, Human Rights Watch and 180 other organizations and experts are calling for these systems to be banned.²

Guidance Likely to Come

The Paper does not give any clearer indications of the measures that companies using facial recognition technology could implement. However, the ANPD said that this Paper is just a brief overview of the subject, and we should expect more specific guidance soon.

¹ https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without

² https://edri.org/wp-content/uploads/2023/09/Global-statement-Stop-facial-recognition-now.pdf