The grey-zones of public-private surveillance: Policy tendencies of facial recognition for public security in Brazilian cities

Introduction

Digitalisation is among the top priorities for national and local governments around the world. It is common for the technological development – and therefore the economy ouvertures made possible by the “innovation demand” – of public policies to be assumed as a “smart city” programs, although the concept of it is not yet unified in different strategic planning processes for cities (Angelidou, 2015), and does not always include innovative forms of governance. Some cities, like Barcelona, are implementing participatory mechanisms for the technological development and governance by the public sector and civil society (Morozov & Bria, 2018). In other cases, public-private partnerships (PPP) are a model for public services based on new technologies, keeping citizens apart from the decision-making process and affecting the assessment of risks to human rights (Brandusescu, 2021; Reia & Belli, 2021).

Regarding public security in particular, the datafication paradigm (van Dijck, 2014; Majias & Couldry, 2019) has been assuming the form of, for example, crime prediction algorithms and risk assessments in criminal justice systems (Angwin et al., 2016; Bennett Moses & Chan, 2018), as well as surveillance programs (Clarke, 1988; van Dijck, 2014), more specifically when biometric systems are prevalent throughout the public space collecting the bulk of citizens’ personal and sensitive data. Furthermore, the narrative marketing of “smart technologies” companies, by creating discourses where cities are permanently at the threshold of urban crisis, involve increasing insecurity, influencing the conditions for city governments to commission their private solutions, which would supposedly offer more results with less data-driven effort (Sadowski & Bendor, 2018).

At least two conditions compose “grey-zones” of public-private surveillance, illustrated in the deployment of FRTs in Brazilian cities: (i) the nature of public security policies at the city level, broadly based on PPP that, while counting on the legitimacy of the public sector, require limited transparency and accountability from private companies that provide the technology; and (ii) the lack of specific data protection regulation for law enforcement and public security purposes, resulting in uncertainty in the Brazilian legal framework concerning surveillance technologies, such as biometric systems.

First, the private sector takes a leading role in the deployment of emerging technologies in cities, which often leads to the commercial interests overriding the public interest in such areas as education, urban planning and public security (Voorwinden, 2021; Green, 2019). As argued by Sadowski and Pasquale (2015, p. 3), “Getting smart is the handy panacea for overcoming austerity, managing the urban system, and becoming an attractive place for capital to flow into”. This arrangement establishes legal conditions for PPP that serve the interests of businesses’ rather than protecting the privacy and data rights of citizens (Brown, 2019). These public private partnerships challenge traditional mechanisms of democratic accountability, public participation in policy-making processes and influence how cities will be defined in the future (Grossi & Pianezzi, 2017). In Latin America, for instance, public bids for the FRTs often do not require public consultations (Venturini & Garay, 2021), or often push it to the “future” (Santos, 2021).

Second, the Brazilian legal framework regarding data protection has been evolving gradually over the past decade (Data Privacy Brasil, 2023), but still has loopholes in the area of public security. The Brazilian General Data Protection Law (LGPD) has been effectively enforced since 2019 and established a long-expected regulation to private and public entities when processing personal data. Some critical areas were nevertheless left outside of its scope, such as law enforcement investigations and public security. Data protection scholars in Brazil think that the deployment of surveillance systems without a proper data protection regulation in this area could lead to a disruption of the presumption of innocence, essential to the rule of law (Belli & Doneda, 2021). Additionally, civil society has been calling for the ban of the technology in the area of public security (Coalizão Direitos na Rede, 2022).

Regardless of the exception aimed at public security actions, the LGPD itself also defines some limits, stating that the processing of personal data will be governed by specific legislation, which should provide the proportional measures strictly necessary to meet the public interest. Subject to due process, data protection principles and data subject rights are provided for in the LGPD. In addition, the LGPD also provides mechanisms, such as the production of specific reports to the data protection authority, as well as personal data protection impact assessments in order to give more transparency to data processing activities for public security purposes. In this sense, it is worth remembering that PPP are an essential part of smart cities, but many of these agreements are rarely subject to any public oversight or scrutiny on a regular basis.

On the other hand, the country has seen continuous advances in its data protection regime. At the end of 2020, a draft bill was proposed to the Chamber of Deputies by a special commission chaired by a Superior Court of Justice (STJ) judge, Néfi Cordeiro, and composed by renowned legal scholars and data protection experts, in order to regulate data protection in the the field of law enforcement and public security: a “Criminal LGPD” (Superior Tribunal de Justiça, 2020). According to the Brazilian “Coalizão Direitos na Rede” (2020), which is composed of more than fifty civil society organisations and research institutes, the bill offers a fundamental compatibility between law enforcement needs in accessing personal data and safeguards to citizens, as well as legal remedies in cases of abuse by public authorities.

In a case involving a Presidential Provisional Measure (MP 954/2020) during the pandemic, Brazilian telecom companies were ordered to share personal data of more than 200 million users with a federal government entity – the Brazilian Institute of Geography and Statistics (IBGE) – but a 2020 Federal Supreme Court (STF) decision halted the effects of the MP, considering it disproportionate and ruled that data protection constitutes an autonomous fundamental right (Poder 360, 2020). The decision opened a pathway for the Federal Senate, in 2022, to amend the Federal Constitution (EC nº 115/2022) and add the right to data protection to its scope of fundamental rights (Autoridade Nacional de Proteção de Dados, 2022). This shift in the data protection regime can be interpreted as a new chapter in the federal and local governments’ duties to protect human personality and dignity by promoting proactive data protection policies, not only avoiding unauthorised use of citizens’ data, but also by promoting institutional means to continuously improve the protection of personal data (Ramiro & Canto, 2021; Bioni & Monteiro, 2020).

Despite the aforementioned legislative horizon and the recent Supreme Court ruling, the mentioned grey-zones gain ground in the lack of proper regulation. In this article, we analyse these conditions and offer a mapping of the current human rights organisations’ public responses to the use of FRT for public security. Our aim is to analyse the governance of the biometric surveillance technologies in the Global South by using Brazil as our case study. We also aim to provide some policy recommendations to the municipalities who seek to engage in PPP with technology businesses.

Facial recognition, privacy and the urban experience

The emergence of biometric surveillance systems has been long described as a means for mass identification and social control (Lyon, 2008; Pugliesi, 2010; van der Ploeg, 2005). Technically, it mostly depends on biological – physical and behavioural – metric patterns (Agarwal, n.d. as cited in Finck, 2022) that have their data collected in order to provide, through an algorithmic process, personal identification outputs based on a prior database. In biometric surveillance policies, it is possible to argue that the most prominent application is FRT, which is intended to identify data subjects based on their “measurable” facial features, such as the distance between their eyes and ears, size of cheekbones, shape of jaws and so on (Leslie, 2020). Those mechanisms offer multiple prejudices, as they don’t encompass the variety of nuances bodies have, and experiences they live, which often result in racist, misogynist and transphobic biometric algorithm outputs (Silva, 2022; Herberling, 2022).

In the European Union, the European Data Protection Board has recently published guidelines on the use of FRTs in the area of law enforcement, broadly based on the European Charter of Fundamental Rights, the European Convention on Human Rights and the Law Enforcement Directive (European Data Protection Board, 2022). On the other hand, in the case of FRTs in “public accessible spaces”, the EDPB and the European Data Protection Supervisor (2021) have called for its ban. This position was also promoted by European civil society groups in the region, including the Privacy International, European Digital Rights, Article 19, Bits of Freedom and La Quadrature du Net (Goujard, 2022; Reclaim Your Face, 2023). Despite the heated discussions over its use, the FRTs are still deployed. Recently, the critics pointed out that the proposed AI Act did not establish proper guardrails to sufficiently address the risks to fundamental rights posed by this technology (Mobilio, 2023).

From an international human rights law perspective, the deployment of FRTs for law enforcement and public security purposes needs to be safeguarded by effective impact assessments, as well as on policy tools that further necessity, proportionality and oversight provisions. For instance, the Pact of San José da Costa Rica (American Convention on Human Rights) (Convenção dos Estados Americanos, 1969), and the International Covenant on Civil and Political Rights (United Nations, 1966), from which Brazil is a signatory, bring principles, such as legality and necessity, that must be observed when evaluating restrictions to human rights, such as freedom of expression and opinion. In the case of Brazil, it is not only the legal framework that still doesn’t count on a specific law to address the processing of personal data in such areas, as stated above, but also the National Data Protection Authority (ANPD), effectively created in 2019, still has not established guidelines on the subject.¹

An additional layer to assess impacts on human rights would be to assume that the trade-offs affect not only individuals’ rights, but also collective dimensions of the “right to the city”, which is deeply attached to the exercise of political rights, social participation and transformation (Purcell, 2013; Harvey, 2008, 2013). Especially in cities with a considerable level of technology development within their urban services infrastructure, the rights to privacy and data protection can protect or stifle the freedoms of expression, assembly and association, making the mutual relations between those rights clearer (Doneda, 2022; La Rue, 2013). The United Nations Human Rights Committee’s General Comment nº 37 on the Right to Peaceful Assembly (2020) states that, concerning FRTs identifying people in a crowd, “[t]he mere fact that a particular assembly takes place in public does not mean that participants’ privacy cannot be violated”, which means that personal data disposed in public space is not merely “available” to be processed, but deserves the same protection as in private spaces, even more so when the matter of concern is sensitive. As a result, even in public spaces reasonable expectations of privacy would also have to be assumed under privacy and data protection laws (Edwards, 2016).

The effects of FRTs on political freedoms are evident in the stifling of protests around the globe. For example, in the anonymity struggles in Hong Kong that manifested in 2019 and 2020 (Millet, 2020), and in the 2021 peaceful protests in Moscow (Bacchi, 2021) (in both instances protesters used means to disguise their identity with masks, face paintings, and umbrellas); also recently, the use of FRTs to track Black Lives Matter activists in the United States (Vincent, 2020); and in Colombia during the 21N protests, which were pushed by a variety of social sectors such as student movements and trade unions, helicopters were used to track manifestants (Dejusticia, 2021). The chilling effects of FRTs are easily perceived and, as a result, unproportional surveillance can compromise potential social justice transformations.

This is the case not only with regard to political dimensions of the city space; a lack of privacy impacts the citizens’ involvement when experiencing the city. In “The Death and Life of Great American Cities”, Jane Jacobs has already called attention to how excessive identification might jeopardise individual’s quality of life when interacting with the city:

Privacy is precious in cities. It is indispensable. Perhaps it is precious and indispensable everywhere, but most places you cannot get it. In small settlements everyone knows your affairs. In the city everyone does not-only those you choose to tell will know much about you. This is one of the attributes of cities that is precious to most city people, whether their incomes are high or their incomes are low, whether they are white or colored. [...] A good city street neighborhood achieves a marvel of balance between its people's determination to have essential privacy and their simultaneous wishes for differing degrees of contact (Jacobs, 1961, pp. 58-59).

Investigating the role of smart cities in the functioning of city administrations, while also considering sociopolitical factors that affect them, can reveal citizens’ perceptions of freedom when experiencing the city and interacting with other people and places – to Jacobs, this is the “sidewalk life” (1961). In the contemporary Brazilian cases of urban management, what is seen is the expansion of surveillance-based public security programs founded on models of privatisation. Bruno Firmino (2018) has analysed the “Center of Operations” (COR) in the city of Rio de Janeiro, which was once the locus, for example, of IBM’s Smart Cities project investments, in order to monitor the daily routine of the city, including traffic, climate and social media interactions, in order to “respond effectively” to emergency situations – “a synoptic, war room-style overview” (Greenfield, 2015). The COR used to share data with the “Integrated Centers for Command and Control” (CICC), which were specific government entities for public security. The CICC’s model has been expanded to several capitals in Brazil (Firmino, 2018; de Vasconcelos Cardos, 2019) and it now increasingly relies on FRT (Centro de Análise da Liberdade e do Autoritarismo [LAUT], 2021; Nascimento, 2022; Sampaio, 2022).

Those “perceptions of freedom” in Brazil necessarily deal with the racial aspect of the urban experience, also illustrated in recent statistics about the odds of a black person being arrested because of facial recognition. In the country, 56,1% of the population is black or brown-skinned (74,5% in the Northeastern region, for instance) according to recent survey by the Brazilian Institute of Geography and Statistics (Ferrari, 2022), and 8 out 10 black citizens already were approached by the Military Police in States as São Paulo and Rio de Janeiro, as shown in research conducted by the Instituto de Defesa do Direito de Defesa and Data_Labe (2022). Other research from 2019 has shown that when it comes to arrests assisted by FRT, 90% of the people were black, according to the Rede de Observatórios da Segurança (Nunes, 2019). Pablo Nunes, researcher of the Centro de Estudos em Segurança e Cidadania (CESeC), has stated that to young black people, FRT “is the certainty that they will continue to be approached by the police arbitrarily” (2019, para. 5).

Lila Lee-Morrison (2019) argues that the “automation of the visual sense” ideal, once applied to the controlled environments of industrial factories in order to sort and inspect manufacturing flows, has resulted in surveillance systems that monitor, inspect and target the flow of people in society. In association with the inequalities that already characterise the urban space in places such as Brazil, this automation breeds structural racism at the algorithmic level,² especially when considering the sociopolitical history of public institutions that have been understood as instruments of segregation (Costa & Kremer, 2022; Silva, 2022).

Public-private characteristics and regulatory grey-zones

Marketing discourse precedes public-private FRT deals to frame it as the ultimate efficiency and optimisation of public services. This business-led, optimistic rhetoric has been subject of criticism in the growing body of literature that examines how corporate visions have prevailed in smart cities projects (Reia & Cruz, 2023; Grossi & Pianezzi, 2017; Hollands, 2015; Greenfield, 2013). In the last twenty years, major technology companies such as Alphabet (Google), IBM and CISCO have been selling their products to the public sector in order to collect data and provide “urban solutions” (Sadowski & Bendor, 2018), helping create a widespread model of city administration that values privatisation of the city services as unavoidable process (Wiig, 2015). Cities have been serving as terrestrial spaces where neoliberal initiatives continue to establish their roots (Brenner & Theodore, 2002) and portray urban problems as crises that can be addressed through PPP.

These narratives mobilised by the private sector to sell smart city technologies contribute to the expansion of sociotechnical imaginaries (Jasanoff, 2015) that see cities existing on the cliff of an urban crisis that can and must be solved through new technologies – what Morozov would describe as techno-solutionism (2013). In terms of public security, the mobilised discourses meet, for example, with how city mayors address urban violence as an issue that must take advantage of “the latest in technology” (New York City, 2022) – without qualifying results provisions or providing risk assessments – and take the opportunity to pitch FRT private providers as a means to “revolutionize” the security model of public events (Burt, 2022). In France, the Mayor of Nice has supported start-up providers of FRTs while calling public oversight entities, like the Commission Nationale de l'Informatique et des Libertés (CNIL), the French national data protection agency, as “dusty institutions” because of their criticism over the unregulated use of the technology (Rees, 2022). As a result, a solutionist narrative portrays the rights guarantees enforced by oversight authorities as outdated.

As noticed by Alcides Eduardo dos Reis Peron (2019, 2021), security programs in the State of São Paulo, such as the “Detecta”, “City Câmeras” and “São Paulo Inteligente”, have been impacted by the notion of “smart cities” and increasingly count on partnerships between the government, national private companies and also on the international industry of security. He argues that this model of governmentality explores a broader surveillance digital apparatus, such as FRTs, and presupposes a permanent administration of fear to create a permanent atmosphere that would be “saved” by PPP and technology solutions.

The impact of FRTs on the work of law enforcement in Brazil, a developing country that historically struggles with socioeconomic inequalities that manifest in the level of urban violence (Adorno, 2002) and racial bias in the work of police, is insurmountable. Notably, the promotion of FRT for public security is not even about achieving better crime statistics, but about how contracts with FRT vendors help create a positive image of a particular city administration. An example of this would be the creation of new job opportunities, or even a larger municipal budget as a result of private investments (a trend similar to the United States and Europe, see Green, 2019; Hollands, 2015). In Salvador, the deployment of FRT is seen as necessary to, beyond preventing criminal activities, to help create new jobs and income for citizens, as well as tourism opportunities in the city (A Tarde, 2021). In Recife, the arrangement of the public private partnerships (PPP) is framed as a possibility of economic success for the City Hall: the vendor will have to actually pay to install “totems” in the public space – with a range of “smart” gadgets such FRT, as well as led screens for advertising and Wi-Fi – and, in exchange, the company will be able to rent the led screens to other businesses (Tenório, 2022). The public discourse on economic development, fueled by private sector marketing, appeals to the underdeveloped conditions of Brazilian cities, and creates workarounds that deviate from the privacy and data protection debate, as well as from the very possible inefficiency of FRTs regarding tackling crime rates. While social and political issues could remain unaddressed, such as transparency and algorithm accountability requirements, PPPs have framed public services as a for-profit area that benefits public and private economic discourses (Voorwinden, 2021).

When it comes to applying regulatory models concerning privacy, the big challenge is to find an ex ante framework to enforce strict data protection provisions. In the case of Brazilian PPP-based biometric surveillance policies at the city level, as argued by Malgieri and Pasquale (2022), it is necessary to assume that artificial intelligence systems are “unlawful by default”, thus developers have the burden of proving that they are not discriminatory, unfair or inaccurate prior to deployment, not after a rights violation happens. There are at least three challenges in this respect: first, the lack of transparency in algorithmic solutions due to the imposed intellectual property protections (such as trade secret rights), or because of the inscrutability of automated decisions to the public; second, these same vendors succeed in deploying their technologies with the city administration as a legitimate proxy to offer public services (Colleta et al., 2017), while the same administration takes advantage of the opacity of the algorithms to deflect the attention of the civic services from the decisions they make; and third, if the national data protection regulation has exception loopholes to its enforcement when it comes to public security ends, such as the Brazilian LGPD, the lack of legal contemporary tools to call for transparency and accountability in such systems can pave the way for a regulatory grey-zone that facilitates opaque public-private mass surveillance policies in the cities.

The result is a model of technology governance applied to public services that sidelines the civil society concerns. It offers greater social repercussions when the focus of such policies are areas and segments of society historically surveilled and targeted based on race and socioeconomic conditions (Browne, 2015). That is especially important in the context of public security in Brazil, where the suspension of human rights not only regarding privacy, freedom of expression and manifestation, but the very liberty and life of black people, is a massive issue. This model defines how the power plays in Internet and new technologies governance (Carr, 2015), gives legitimacy to private companies that develop digital infrastructure for public services and helps state actors obscure the violations of the public interest in their work. This equation creates dangerous grey-zones in which citizens’ rights are sidelined, which paves the way to undemocratic city policies, even more so in territories where racial and socioeconomic pre-conditions are already extremely biassed and exclusionary.

The privatisation of public security services at the city level echoes the trend of privatisation of prisons – a market tendency for private companies that profit by providing infrastructure, such as surveillance technologies. Prisons serve as “both the laboratory and first market” (Gow, 1997) for surveillance technologies, which has now been expanded to outdoor spaces as a result of the securitisation processes in the city spaces (Williams, 2003).

The human rights organisations’ responses to the use of FRT for public security

In recent years, there is a widespread deployment of surveillance technologies, such as facial recognition, throughout the Global South. For instance, in Latin America, a number of civil society organisations have begun to submit requests for access to information to public administrations, in order to understand the details of the use of facial recognition in public spaces (Venturini & Garay, 2021). For these organisations, in their words, it was essential to ask appropriate questions about measures that interfere with the full enjoyment and exercise of fundamental rights, especially considering the region’s background of the implementation of surveillance technologies in a non-transparent way and without due public debate (Ucciferri, 2019).

Such actions have been the starting point for more robust actions in an attempt to block the implementation of FRTs, and some have been successful, while others not so much. For example, in Argentina, Brazil and Peru, public agencies have been fined and/or forced to suspend the implementation of such systems because it was found – after the aforementioned requests for information – that in all cases a series of regulations related to the personal data protection had not been respected (Vida, 2022). In Paraguay, it was not even possible to access the information. When faced with successive denials of access to information on the operation of the facial recognition system implemented in the city of Asuncion, in 2019 the digital rights defence organisation TEDIC filed an action of unconstitutionality, questioning the allegation that it was reserved national security information (Venturini, 2020).

While in Latin America the implementation of FRTs is increasing, in recent years, some US cities and states, and European countries, have achieved advancements in establishing constraints regarding FRT based on the understanding that they violate privacy and the presumption of innocence, and that the technology boosts discrimination against marginalised groups, among many other problems (Kak, 2020; Laperruque, 2022; Mobilio, 2023). With this dual scenario – increasing impetus for restrictions in the global north and lack of regulation in the global south – in mind, in an initiative promoted by Brazilian civil society called #SaiDaMinhaCara (Get Off My Face), more than fifty lawmakers from different parties acting in the municipal or state legislature have introduced bills to ban facial recognition in public spaces (Coding Rights, 2022).

In addition to strategic litigation³ and legislative efforts against the FRT implementations mentioned above, organisations have created broad campaigns for the banning of FRTs: Argentinian #ConMiCaraNo (Asociación por los Derechos Civiles, 2019), Mexican #NoNosVeanLaCara (Red en Defensa de los Derechos Digitales, 2020) and Brazilian #TireMeuRostoDaSuaMira (2022). By understanding that there are sufficient reasons to completely restrict the use of facial recognition, for surveillance purposes, by security and intelligence forces, various organisations that are building such campaigns are (i) monitoring the situation in their countries to report when a government implements such technology; (ii) writing open letters addressed to various actors and; (iii) producing materials for the general public regarding the implementation of biometric technologies in Latin America.

More specifically, Brazilian civil society has influenced and been influenced by all these neighbouring movements, and its performance on this issue has been an example that deserves further debate, and this is what we intend to do in the following section.

The countervailing movements towards facial recognition technologies in Brazil

Facial recognition has been in use in Brazil since 2011, but it became especially popular in 2019 (Lobato et al., 2020), and the advancement of the technology in the country has led to movements for the regulation of facial recognition and, in some cases, its partial or complete ban.

It is important to mention that this is not a completely new debate. In 2009, the Madrid Declaration, signed by Brazilian organisations such as the Brazilian Institute for Consumer Protection (Idec) and the Nupef Institute, already called for a moratorium on FRTs for surveillance purposes:

Civil Society takes the occasion of the 31st annual meeting of the International Conference of Privacy and Data Protection Commissioners to: […] Call for a moratorium on the development or implementation of new systems of mass surveillance, including facial recognition, whole body imaging, biometric identifiers, and embedded RFID tags, subject to a full and transparent evaluation by independent authorities and democratic debate (The Public Voice, 2009)

Almost ten years later, in August 2018, Idec went to court against ViaQuatro, the concession holder of São Paulo's metro's yellow line, a privately-run line, for processing emotion data from passengers (Columbia Global Freedom of Expression, 2021). The camera system recognised human presence and performed the identification of emotion, gender and age from the people positioned in front of advertisements billboards with the intention of capturing their reactions.

The lawsuit was the result of collaborative work between Idec, the Latin American Network of Surveillance, Technology and Society Studies (Lavits) and the Tutorial Education Program (PET) of the Law School of the University of São Paulo. In addition, the Public Defender's Office of São Paulo participated in the lawsuit as a co-plaintiff and the Alana Institute as amicus curiae (friend of the court). The Institute for Research on Internet and Society (IRIS) and Access Now also produced technical opinions on the case (Teofilo et al., 2019; Arroyo & Leufer, 2020).

With the country lacking a data protection law at the time, the lawsuit was based on the violation of basic consumer rights, such as consenting to the collection of their data and being informed about what will be done with it. In addition, it highlighted the illegality of the non-consented use of FRTs, supported by the fact that ViaQuatro's cameras were not intended to improve the transportation service, but to analyse people's emotions when facing advertisements. In 2021, the company was ordered to pay a fine of 100,000 Brazilian reais and is prohibited from reactivating its 2018 initiative. The decision was the first of its kind in the country and emphasised the need to obtain users' prior consent for their data to be collected and, further, that the validity of consent is conditioned on the provision of clear and specific information about the collection and processing of data.

Since the lawsuit filed against ViaQuatro, civil society has been acting on other fronts to prevent the collection of facial recognition data without citizens' consent. In February 2019, Idec notified Hering, a Brazilian clothing franchise, about the use of facial recognition for targeted advertising purposes without permission (Mari, 2019). Following this, Senacon (the National Consumer Secretariat) convicted the company of violating citizens' right to information and their personality rights, ordering them to pay a fine of 58,767 Brazilian reais.

Public agencies, related to law enforcement and social security, and other businesses, such as supermarkets, credit bureaus and ride-hailing apps, have also begun to be warned by civil society due to their attempts to implement FRTs, and were questioned about how they obtained consent from citizens to use biometric data, how they handle the information and whether they foresee sharing the databases with third parties or the government (Soprana, 2019). The complaints did not assume that the companies had committed an infringement, but asked for evidence to analyse whether there was sufficient transparency in their data processing. The questions were based on the Consumer Code, the Marco Civil da Internet, and the General Data Protection Law (LGPD).

In March 2022, another lawsuit – this time against the Companhia do Metropolitano de São Paulo (Metrô), the public company running the São Paulo metro system – was initiated and generated great repercussions, contesting FRT use for public security purposes. The class action lawsuit filed by Idec, the Public Defender's Office of the State of São Paulo, the Federal Public Defender's Office, Intervozes, Article 19 Brazil and South America and CADHu (Human Rights Lawyers Collective) was the result of analysis of the documents presented by Metrô in a previous lawsuit that demanded information about the implementation of the project, which cost more than 50 million BRL, and that, among other measures, involved the forecast of facial recognition in whoever used the public transportation system.

An injunction ordered the São Paulo Subway to halt the implementation of the facial recognition system, which reaches about 4 million daily users of public transportation in the state capital (Mari, 2022). According to the Court's decision, no evidence was presented that the Subway system was used only for public safety actions, which affects the fundamental rights of citizens and goes against the General Data Protection Law (LGPD).

The Brazilian backlash against facial recognition beyond the courts

The court victories are definitely being duly celebrated and recognised as important milestones in the fight against the increasing use of technology to track Brazilian citizens (Souza & Zanatta, 2021), however, the expansion of FRTs continue, and likewise, other battlegrounds also continue to be fought over. Here we highlight a few relevant cases.

For instance, in March 2021, a state bill in São Paulo sought to authorise the use of FRTs in subway and train stations. Thus, more than 20 civil society organisations released an open letter about Bill 865/2019, which had recently been approved in the Legislative Assembly of the State of São Paulo (Instituto Ethos, 2021). According to the letter, the text of the bill, which was pending sanction by pro-FRT Governor João Dória, was approved in haste, without transparency or any dialogue with the society and sectors that work with this issue. As drafted, the legal provisions were unable to mitigate the risks involved and ensure the fundamental rights of the nearly 8 million passengers who use the system daily. Weeks after the demonstrations against the bill, the governor vetoed the bill, arguing that the project unduly interfered in the competencies of the companies that manage the passenger rail transportation system in the São Paulo metropolitan region, that is, the bill was rejected on procedural rather than human rights grounds (Vicentin, 2021).

On an international level, in June 2021, an open letter was published calling for a global ban on biometric recognition technologies that enable mass and discriminatory surveillance (Access Now, 2021). The open letter prepared by Access Now, Amnesty International, European Digital Rights (EDRi), Human Rights Watch, Internet Freedom Foundation (IFF) and Idec argued that the ban was necessary because, although a moratorium could temporarily halt the development and use of these technologies, the deployment of the tool in places accessible to the public was incompatible with human rights and civil liberties. The letter defined its scope and the risks potentially caused by the use of the technology, as well as requests and recommendations for legislators, administrative agencies, judicial bodies and private entities.

Several civil society organisations, activists, technologists and other experts around Brazil joined together to sign this worldwide open letter; such a movement helped spur the creation of a national open letter and a new campaign. Thus, in late May 2022, during the 12th edition of the Brazilian Internet Governance Forum, which took place in Natal, Rio Grande do Norte, more than 30 civil society organisations launched the campaign #TireMeuRostoDaSuaMira (2022) to call for a total ban on the use of FRTs in Brazilian public security.

In addition to the traditional digital rights organisations, this movement differs from other national campaigns as it includes a series of other social organisations from the black movement, sex workers' rights movement and informal street vendors movement, among others. Moreover, the organisations involved in the campaign have not only restricted themselves to publishing their manifesto, but are full steam ahead with various actions. In addition to the open letter, the campaign has mapped all the bills that attempt to induce the implementation of FRTs by Brazilian states, identifying the justifications and authors of the proposals. In order to exchange strategies to learn more about successes and mistakes, the campaign has also met with other campaigns fighting for the same goal in different parts of the world: United States (American Civil Liberties Union), Mexico (Red en Defensa de los Derechos Digitales), European Union (Reclaim Your Face), Argentina (Asociación por los Derechos Civiles) and India (Internet Freedom Foundation).

In terms of practical actions, some organisations that are part of the national campaign have been articulating with city councillors and state legislators for them to send access to information requests to law enforcement agencies, promote public hearings and draft laws to ban the implementation of facial recognition in public spaces. They are also mobilising public bodies, such as the Public Defender’s Office, the Public Prosecutor’s Office and the National Data Protection Authority, urging them to conduct proceedings to take legal action against companies and governments.

Although the fight against facial recognition is not only a privacy issue, it is interesting to see how the Brazilian actions materialise what Colin J. Bennett (2010) has described as the strategies used by activists to raise awareness about complex and abstract privacy issues, and to build support for their cause. In addition to the "insider" strategy, when civil society organisations engage with the government to advance their privacy goals, such ban campaigns also bring some "outsider" strategies, that is, through public campaigns and direct action. According to Bennett, a combination of both insider and outsider strategies is most effective in advancing privacy goals, and this is what we are seeing in this new Brazilian movement, which combines litigation, legislative proposals, meetings with activists, make-up art contests and podcasts, among many other relevant strategies.

The battle against the rampant implementation of FRTs throughout Brazil seems an inglorious task, especially given the fact that all regions in Brazil use and continue to implement the technology, and civil society efforts still cannot cope with the more than 5000 Brazilian municipalities and 26 states, most of them eager to solve their structural problems with surveillance technologies. Despite this, the strategies and arguments used by the Brazilian civil society have been an example that even in adverse scenarios it is possible to counterattack in every way available, whether through legal actions, complaints to government agencies, open letters, FRT deployment mapping, or awareness raising,and using the most diverse reasoning of rights and principles, which will be explored in detail further in the subsequent session.

Colouring the surveillance grey-zones: National horizons on data protection and international principles

The challenging actions mentioned in the previous sections fall both within a new wave of personal data protection legislations, as well as in the more traditional fields of non-discrimination and the abuse of rights in the provision of public services. In other words, it is not only relevant to violations of personal data protection laws, but data subjects who have their rights violated and are also users of public services, protected by specific laws such as the Public Service User Defense Code (Federal Law No. 13.460/2017), and are covered under consumer legislation, whether in relation to their data, the processing of such data and the information that must be made available, even more so when the provision of such surveillance structures are made by the private sector.

Under Brazilian law, protection and security against dangerous and harmful services is a basic consumer right​,⁴ and equally, security is a principle and right of the public service user. This legal framework imposes a corresponding series of duties on those who process or intend to process data, as governments and companies⁵ do when implementing FRTs. In practice, these principles translate into precautions in database governance; system reliability features; anonymization of data subjects; impact assessment and risk mitigation plans in case of breaches or other violations to the data subjects' rights. With the way these facial recognition systems have been installed around Brazil – promoting the capture of biometric data of all passers-by in the city without any visual or audible warnings, experts and activists claim that they disproportionately violate indiscriminately the privacy and autonomous right to data protection of people on a daily basis, without any consent from the data subjects and without any clarity on how such data will be treated under the justification of public safety (Martins, 2022). Thus, according to this group of critics, the implementation of FRTs violate consumer rights, due to its abusiveness, lack of proportionality, disrespect for the right to information, self-determination, violation of the principle of vulnerability and hypo-sufficiency⁶ and the right to free and informed consent provided for in the national consumer legislation.

Brazilian consumer law, with code in effect since 1990, also brings an important procedural tool, a collective redress mechanism called “public civil action”. Therefore, the public civil action became the most modern and democratic instrument to defend the interests of consumers as a social group, interests that could never be solved if their protection was pursued by some of its members, including in discussions about data protection and the offering of transparent digital products and services, where there is a clear asymmetrical power relationship (van de Waerdt, 2020). Such a reference is relatively important in the European context as the European Parliament has recently approved a new law that will allow consumer groups to join forces and launch class actions in the European Union (BEUC, 2020). The new rules introduce a harmonised model for collective action in all Member States, ensuring consumers are adequately protected against large-scale harm and guaranteeing adequate safeguards to prevent abusive lawsuits.

The sentencing of ViaQuatro, cited above, was the result of a public civil action, for example.⁷ Other public civil actions have been used to handle cases based on different situations involving privacy and data protection issues, regarding credit bureaus, data brokers, telecommunications companies and other data-driven sectors.

With robust infra-constitutional legislation in material terms, especially when it comes to consumer and public service user protection, and important procedural instruments for the defence of collective rights, the legal system is also supported by a number of other human rights principles that can be mobilised to deal with the rampant use of FRT. Here we can name a few of these: proportionality and necessity, accountability and transparency, due process and fair trial, the best interests of children and the right to equality and non-discrimination.

Conclusion

Conceptual and practical tensions follow the development of “smart cities” models in different territories, whether in Latin American metropolises or major Silicon Valley cities. The particularities of how city administrations choose to establish those models tend to vary even more when comparing, for example, European and Latin American city capitals. On the one hand, the broadening of surveillance technologies such as FRTs is a tendency in public security policies worldwide and comes as a synonym for “urban planning modernity”. In Brazil, the adoption of FRTs within public security policies comes mostly with PPPs that often appeals to economic narratives that could benefit local populations that historically live under socioeconomic inequalities. Therefore, the shift in the discourse brings together the will of social control under the façade of economic development.

The perceived political arrangement gives form to grey-zones of public-private surveillance, making it challenging to demand for transparency due to the intellectual property protection of such systems, as provided by the private sector and deployed under the legitimacy of the city administration to pursue public security policies. Even so, the huge privacy and data protection impact of such policies has brought together several civil society reactions in Brazil, including public campaigns nation and local wide, litigating together with public bodies such as the Public Defenders and Prosecutors, as well as the National Data Protection Authority. The legislative and judicial branches have also been activated and have already produced crucial results to qualify the debate around FRTs, such as several city level bills that aim to ban the use of the technology for public security. This would apply to judicial decisions that recognised the illegality in using FRTs, for example, to map people’s emotions.

These precedents, together with civil society reactions, the Supreme Court decisions and legislative horizons in Brazil, suggest that the narratives from PPPs are suffering a shift in the public debate, something that happens as data protection culture gradually shows results in the country. Even though the sociotechnical imaginaries over technological modernity are still in dispute, and suffer from new rounds of marketing and fascination in every new public administration that wants to hit the brand of “smart cities” in every stage of urban public policies, power plays over privacy and data protection will continue to count on the city space as territory to define the limits of surveillance policies.