Brazil, São Paulo Justice Tribunal, 10 May 2023, IDEC v. Via Quatro

Case Summary

In 2018, ViaQuatro, the private operator of one of the subway lines in the city of São Paulo, installed interactive doors at some stations it operates. The plan was to use them to broadcast personalized ads to passengers, measuring demographic information and emotional reaction through cameras equipped with facial recognition technology. The Brazilian Institute of Consumer Protection (IDEC) proposed a Public Civil Action to the 37th Civil Court of São Paulo, requiring: a) the termination of data collection from interactive doors; b) implementation of an information tool and collection of the user’s express consent for the collection of biometric data; and c) payment of compensation for collective and moral damages in an amount not less than R$ 100,000,000.00 (one hundred million reais, roughly twenty million US dollars in 2018), considering the turnover and net profit of the defendant. The defendant argued that “the digital doors do not capture defined images attributed to identified people, but only detect faces and expressions”. It explained that the technology used does not relate to facial recognition, “only detection of faces classifiable in categories of expressions, gender and biotypes”. Furthermore, ViaQuatro argued in favor of the legality of its system, stating that there was no data storage or even data processing, only data collection for statistical purposes was carried out. The first instance civil court partially granted the request. The seating judge, Patrícia Martins Conceição decided that the defendant failed to “demonstrate concretely (…) the real destination given to the information indisputably collected by the company holding the equipment installed in the premises of the stations administered” [p. 2289].

Furthermore, Conceição pointed out that although Law No. 13.709/2018 ( the Brazilian General Data Protection Law- LGPD) was not in force during the implementation of the system, its normative provisions do provide the legal framework for the sentencing considering the future effects and ongoing administration of the subway line by the company. In view of this, the magistrate highlighted some normative requirements from that the legislation, such as the special protection conferred on sensitive personal data, which can only be treated after clear, informed, and specific consent of its holder. Furthermore, the law ties data governance through the principle of purpose, which provides that the treatment must have legitimate and specific aim, with explicit purposes informed to the holder. The legislation, does not allow subsequent data treatment that does not align with these initial conveyed purposes. In addition, Judge Conceição highlighted that the transport users “were not warned or communicated prior or subsequently about the use or capture of their image”, which constitutes a violation of the right to clear and adequate information about products and services, provided for in the Brazilian Consumer Protection Code. As such, the first instance civil court decided that the use of any facial recognition or detection software requires the consent of all possible users of the metro system, defining an obligation for the defendant to obtain prior consent if it decides to implement the facial recognition and advertising system in the future, and condemning the defendant to pay an award of R$ 100,000.00 (a hundred thousand reais).

Following the sentence, all parts appealed, including Public Prosecutor’s Office of the State of São Paulo (MP-SP). IDEC argued, among other considerations, that the sentence did not explicitly recognised the collective moral damage related to the use of facial recognition technologies in the public service provided by the company, arguing that the restitution awarded should not be inferior to 10% of the R$ 100,000,000.00 initially asked. The MP-SP appealed on similar grounds. On the other hand, ViaQuatro appealed arguing that the Brazilian General Data Protection Law- LGPD should not be applied to the case and that the technology installed on “digital doors” at various metro stations do not involve the treatment of general, nor sensitive, personal data. In May 2023, the São Paulo Justice Tribunal (state court of appeals) decided in favour of the appeals from IDEC and the Public Prosecutor’s Office of the State of São Paulo, recognising the collective moral damage related to the capture, storage, and processing of personal images in systems of facial recognition installed in metro stations administered by the defendant Via Quatro and majoring the award for the Fund for the Protection of Diffusive Rights from R$ 100.000,00 (a hundred thousand reais) to R$ 500.000,000 (five hundred thousand reais, roughly a hundred thousand US dollars).

Author of the case note

Lucas Muniz Conceição