Brazil

We don’t need no observation: The use and regulation of facial recognition in Brazilian public schools

Introduction

The use of facial recognition technology in schools around the world in countries such as China and the United States has encouraged the similar use of this technology by other countries, including Brazil. However, it has also raised questions and concerns about the privacy of students. Because of this, analyses of the nature and consequences of the use of facial recognition technology in diverse scenarios are necessary.

This report presents a brief reflection on the use of facial recognition technologies in Brazilian public schools, including in the state of Pernambuco, where IP.rec is based, and considers their implications for citizens' rights to privacy, as well as the possibility of the technology being regulated by existing laws.

Background

Artificial intelligence (AI), algorithms, the “internet of things”, smart cities, facial recognition, biometrics, profiling, big data. When one tries to imagine the future of big cities, it is impossible not to think about these terms. But is the desire to make cities “smarter” jeopardising the privacy of Brazilian citizens? Does this desire turn people into mere guinea pigs for experimentation with new technologies in a laboratory of continental proportions?

The use of facial recognition technologies in Brazilian public schools has already been implemented in several cities such as Jaboatão dos Guararapes (in the state of Pernambuco), Cabo de Santo Agostinho (Pernambuco), Arapiraca (Alagoas), Cravinhos (São Paulo), Tarumã (São Paulo), Potia (São Paulo), Paranavaí (Paraná), Guaíra (Paraná), Viana (Espírito Santo), Anápolis (Goiás), Senador Canedo (Goiás) and Vila Bela da Santíssima Trindade (Mato Grosso).[1] Among the features provided by the so-called Ponto iD[2] system is the monitoring of the attendance of students at school without the need to take roll call. The system also aims to help optimise class time, as the time spent on the roll call is saved; help manage school meals, as cooks are notified of the exact number of students in class as soon as the gates close; and decrease the school drop-out rate, as guardians receive, through an app, notifications that their child is in the school. The last is noted as a primary social consequence of using the technology. To implement the system, the city of Jaboatão dos Guararapes, for example, has spent BRL 3,000 (USD 780) per month per school.

The technology provider's webpage states that the solution is designed in an integrated way, linking government departments. Because of this, a diverse range of public institutions can share information with each other. For example, according to the government of the city of Jaboatão dos Guararapes, if a student is absent for more than five days, the Guardianship Council is notified as the system also shares students’ information with that body.[3]

In 2015, the service provider also stated that the system would be connected to the Bolsa Família programme,[4] which is a direct income transfer programme aimed at families living in poverty and extreme poverty throughout the country, and intended to help them out of their vulnerable situation. In Brazil, more than 13.9 million families are served by Bolsa Família.[5] The receipt of the benefits is conditioned, among other duties of a student whose family is a beneficiary of the programme, to a minimum school attendance of 85% for children and adolescents from six to 15 years old and 75% for adolescents 16 and 17 years old.[6]

Privacy? Absent. Risks? Present

As previously observed by several scholars, digital technologies not only make behaviour easier to monitor, but also make behaviour more traceable.[7] Given this potential, a number of critical issues in relation to the application of facial recognition systems in educational contexts were identified.

According to the service provider, the system works off a platform that uses cloud computing capabilities, but it was not possible to identify any information regarding the level of security related to the storage of collected data in the company’s privacy policy available on its official website. Despite this, among the said benefits offered by the technology implemented are not only the monitoring of students’ attendance and their school performance, but the possibility of monitoring students’ personal health data.

The mayor of the city of Jaboatão dos Guararapes[8] states that in addition to facial recognition, the software also offers, through the collection of other information, the possibility of better planning the number of daily school meals. As soon as the school’s gates are closed, the cooks receive via SMS[9] the exact number of students who are in the classrooms. Meanwhile, according to the secretary of education of Jaboatão dos Guararapes, Ivaneide Dantas, at some point even the health problems of students will be identified and parents informed using the system.

However, the lack of information that is included in the company’s privacy policy,[10] or on city halls’ websites, constitutes a critical point in the relationship between students and the education system. The problem becomes all the more obvious since the solution involves sensitive data – biometric data – of minors.

The text of the Brazilian General Data Protection Law (LGPD),[11] recently approved unanimously in congress after almost 10 years of discussions and two years of proceedings, has undergone major changes due to the vetoes of former president Michel Temer at the time of its sanction and more recently by President Jair Bolsonaro. The changes to the text of the LGPD through Provisional Measure 869/2018[12] have resulted in the impairment of the effectiveness of the law as well as a series of setbacks. These setbacks have ignored issues considered already decided on in discussions that had popular participation, as well as the input of members of the executive and legislative branches. As argued in a report released by the joint committee set up to investigate the possible impacts caused by the Provisional Measure,[13] the revised act put at risk the effectiveness of the guarantees reached by the previous text.

The public sector, especially the police authorities, are using new technologies to monitor the population without the social consequences being considered or even measured. The adoption of facial recognition systems for public security purposes is already a reality in several Brazilian cities. Recently, the increase in the use of the tool in public and private spheres has led to the establishment of Civil Public Inquiry No. 08190.052289/18-94[14] by the Personal Data Protection Commission of the Public Prosecutor's Office of the Federal District and Territories (MPDFT), as well as a public hearing held on 16 April 2019.[15] The hearing sought not only to promote debates about the use of facial recognition tools by businesses and the government, but also to function as an open space for the participation of NGOs and civil society.

It is important to remember that as systems are being implemented in public schools around the country, much of the peripheral and vulnerable population is being registered in this "experiment" – that is, data is being collected on vulnerable and marginalised groups. As researchers have pointed out, biases are being increasingly incorporated into the variety of new technological tools.[16] These digital tools can act more quickly, on a larger scale, and with actions that can be hidden by a greater complexity, such as, for example, through profiling systems that use biased machine learning algorithms that police, profile and punish minorities. The struggle is still against the perpetuation of the same problem: the deprivation of civil rights of certain groups of society as a result of social inequalities and power relations in society.

It is not uncommon for technology to be used in a way in Brazil that suggests the possibility of a future Orwellian dystopia. The use of facial recognition technology during the Carnival of 2019 in the cities of Rio de Janeiro and Salvador, resulting in a number of arrests, drew the attention of Brazilians.[17] The apparent relativism of fundamental rights and the relaxation of laws that limit surveillance due to the magnitude of events,[18] and the lack of official information on the effectiveness of the new automated measures, as well as on the storage and sharing of biometric data, were just some of the various problems identified.

The need to manage large events with thousands of participants is not the only reason why surveillance technologies are used in Brazilian urban centres. As Marcelo Souza from the Federal University of Rio de Janeiro (UFRJ) explains,[19] the increase in punitive policies and the militarisation of the police are the main reasons behind the increasing use of dystopian and invasive AI devices and technologies, typical of combat zones.[20] Even after a series of changes that have taken place in Brazil since the promulgation of the 1988 Constitution, public security institutions have not been significantly modified. The culture of war against the "internal enemy", for example, remains as present as in the days of the military dictatorship.[21]

Given that the recently approved LGPD does not apply to data processing for public security purposes, it would be possible for authorities to argue that the biometric database from the facial recognition system in schools can be used to identify suspects and improve public security. This would place its use even further outside the remit of current legislation. As the LGPD states, data processing for public security purposes "shall be governed by specific legislation, which shall provide for proportionate and strictly necessary measures to serve the public interest" (Article 4, III, § 1, LGPD).[22]

However, a specific law does not exist so far. According to the Brazilian lawyer and privacy advocate Rafael Zanatta,[23] the civic battle in Brazil will be around the shared definition of "proportional measures" and "public interest”. The solution proposed by some researchers and activists for the time being is the protection offered by the constitution, such as the presumption of innocence, and the general principles of the LGPD itself, which guard against the improper use of collected data. On the other hand, it is believed that a tremendous effort will be needed to consolidate jurisprudence where these principles are applied in cases of state surveillance.

There is also a lack of easy access to public documents and information on the use of surveillance technologies. Often information related to the operation of these technologies depends on ad hoc statements made by public agents or private companies, whistleblowers or, when granted, requests for access to public information made possible by the Access to Information Law (LAI).

The discussion on the regulation of AI systems in Brazil is still very new. According to Brazilian researchers Bruno Bioni and Mariana Rielli,[24] the general debate on data protection around the globe has different degrees of maturity depending on the region and the specific issues faced. In addition, a paradigm shift has been observed through the transition from a focus on the individual's right to self-determination with regards to his or her private information to a model of risk prevention and management with respect to data-processing activities.

However, the use of AI for the collection and processing of sensitive personal data, such as the biometric data in question, makes these risks difficult to measure. In part this is because the general population does not have sufficient knowledge of the technology to recognise the extent of its impact on their personal lives.

In this way, an imbalance of power with regard to public awareness and the use of the technology has been created in Brazil.

The need for impact reports on the protection of personal data is an important requirement that has been gaining prominence in legislation, such as European legislation and the recently approved LGPD. However, Bioni and Rielli draw attention to the few requirements placed on developers of AI technologies in Brazil, as well as on the consumer who buys and implements the technology. In particular, there is no law in relation to the purchase and use of facial recognition devices for public service and public safety purposes in Brazil, unlike similar public projects elsewhere that seek an informed public debate and the inclusion of citizens' interests in decision-making processes (e.g. the ordinance on the acquisition of surveillance technology recently adopted in San Francisco, in the United States).[25]

Conclusion

A decrease in school drop-out rates: this is the main advantage of facial recognition technology in schools, according to the company that has developed the technology. But are we assigning to technology something that would be the responsibility of society and the state?

As the Brazilian educator and philosopher Paulo Freire[26] showed, many of the most common practices in the Brazilian educational system are dictated by the Brazilian elite. This includes the use of educational content that does not correspond to the reality of students from lower classes, but instead inhibits their ability to think critically of their reality, and in the end discourages them from attending school.

Easy and safe access to school is also an important consideration impacting on the student's educational performance. The Brazilian Statute of the Child and Adolescent, in chapter IV, art. 53, inc. V,[27] states that one of the rights of the child and adolescent is access to public and free schools near his or her home. However, when distance is not an impediment to school attendance, issues related to the safety of the student's route to school should also be considered. For example, in some communities in Rio de Janeiro,[28] there are frequent incidents of armed confrontation between police and drug traffickers, visible abuses of power by the authorities, stray bullets and other incidents endangering the lives of passers-by, and even street executions, all of which are daily threats to residents. In addition, the reality faced by marginalised populations in Brazil raises another important question: the need for children and adolescents from low-income families to leave school in order to work and help support the household.

The problem of the school drop-out rate in Brazil is neither a new issue nor something that can be solved only with the implementation of a new school attendance system using AI. It is necessary for society to seek more meaningful ways to mitigate the present crisis facing the educational system.

In addition to projects that raise public awareness about issues related to new technologies in Brazilian urban centres, there is also a need to strengthen legislation that governs how sensitive data is shared and used in public projects in order to maintain the quality of public services. When the fundamental rights and guarantees of citizens are understood and respected, a relationship of trust is established.

Cities in Brazil should strengthen privacy protection instruments and create legal certainty through the establishment of fundamental principles, rights and duties for the operation of an ever-changing array of technologies in society. Regulating the use of personal data in the public sphere has the power to promote the conscious, transparent and legitimate use of this information.

Action steps

The following advocacy priorities are suggested for Brazil:

• Formulate regional policies and strategies for the use of AI in Latin America and the Caribbean.
• Develop legally enforceable safeguards, including robust transparency and accountability measures, before any facial recognition technology is deployed.
• Promote national campaigns and public debate over surveillance technology given the impact such technologies may have on civil rights and civil liberties.
• Include a social, cultural and political understanding of the needs of vulnerable groups in the country's education strategies to make the learning environment more attractive for these groups.
• Develop open source AI systems that enable wider community use, with appropriate privacy protections.

Footnotes

[1] www.pontoid.com.br/home

[2] https://www.youtube.com/watch?v=YRMihVh0cew&t=24s

[3] Folha de Pernambuco. (2017, 19 April). Tecnologia para registrar presença nas escolas de Jaboatão. Folha de Pernambuco Folha de Pernambuco. https://www.folhape.com.br/noticias/noticias/cotidiano/2017/04/19/NWS,24738,70,449,NOTICIAS,2190-TECNOLOGIA-PARA-REGISTRAR-PRESENCA-NAS-ESCOLAS-JABOATAO.aspx

[4] https://www.youtube.com/watch?v=YRMihVh0cew&t=24s

[5] https://en.wikipedia.org/wiki/Bolsa_Fam%C3%ADlia

[6] https://www.caixa.gov.br/programas-sociais/bolsa-familia/Paginas/default.aspx

[7] Lessig, L. (2006). Code: Version 2.0. New York: Basic Books. Monitoring is mostly related to observation in real time and tracking can be done afterwards based on certain information.

[8] Santos, N. (2017, 18 April). Jaboatão inicia reconhecimento facial nas escolas. LeiaJá. https://m.leiaja.com/carreiras/2017/04/18/jaboatao-inicia-reconhecimento-facial-nas-escolas

[9] https://www.youtube.com/watch?v=YRMihVh0cew&t=24s

[10] www.pontoid.com.br/politica_privacidade_education.jsp

[11] IAPP. (2018). Brazil's General Data Protection Law (English translation). https://iapp.org/resources/article/brazils-general-data-protection-law-english-translation

[12] Medida Provisória nº 869, de 27 de dezembro de 2018. www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/Mpv/mpv869.htm

[13] https://legis.senado.leg.br/sdleg-getter/documento?dm=7945369&ts=1556207205600&disposition=inline

[14] Inquérito Civil Público n.08190.052289/18-94 Reconhecimento Facial. www.mpdft.mp.br/portal/pdf/noticias/março_2019/Despacho_Audiencia_Publica_2.pdf

[15] https://www.youtube.com/watch?v=pmzvXcevJr4

[16] Eubanks, V. (2018). Automating Inequality: How High-Tech Tools Profile, Police and Punish the Poor. New York: St Martin’s Press.

[17] Távora, F., Araújo, G., & Sousa, J. (2019, 11 March). Scanner facial abre alas e ninguém mais se perde no Carnaval (e fora dele). Agência Data Labe. https://tab.uol.com.br/noticias/redacao/2019/03/11/carnaval-abre-alas-para-o-escaner-facial-reconhece-milhoes-e-prende-seis.html

[18] Graham, S. (2011). Cities Under Siege: The New Military Urbanism. New York: Verso Books.

[19] Souza, M. (2008). Fobópole. Rio de Janeiro: Bertrand Brasil

[20] Kayyali, D. (2016, 13 June). The Olympics Are Turning Rio into a Military State. Vice. https://www.vice.com/en_us/article/wnxgpw/the-olympics-are-turning-rio-into-a-military-state

[21] Machado, R. (2019, 19 February). Militarização no Brasil: a perpetuação da guerra ao inimigo interno. Entrevista especial com Maria Alice Rezende de Carvalho. Instituto Humanitas Unisinos. www.ihu.unisinos.br/159-noticias/entrevistas/586763-militarizacao-no-brasil-a-perpetuacao-da-guerra-ao-inimigo-interno-entrevista-especial-com-maria-alice-rezende-de-carvalho

[22] IAPP. (2018). Op. cit. 

[23] https://twitter.com/rafa_zanatta/status/1085583399186767875

[24] Bioni, B., & Rielli, M. (2019). Audiência Pública: uso de ferramentas de reconhecimento facial por parte de empresas e governos. Data Privacy Brasil. https://dataprivacy.com.br/wp-content/uploads/2019/04/Contribui%C3%A7%C3%A3o-AP-reconhecimento-facial-final.pdf

[25] Johnson, K. (2019, 14 May). San Francisco supervisors vote to ban facial recognition software. VentureBeat. https://venturebeat.com/2019/05/14/san-francisco-first-in-nation-to-ban-facial-recognition-software

[26] Freire, P. (1976). Education: The Practice of Freedom. London: Writers and Readers Publishing Cooperative.

[27] www.planalto.gov.br/ccivil_03/leis/l8069.htm 

[28] Brito, R. (2017, 2 October). Rio’s kids are dying in the crossfire of a wave of violence. AP News. https://www.apnews.com/efeeaed43c7b47a0ae4a6cfaa8b871e2

Notes:
This report was originally published as part of a larger compilation: “Global Information Society Watch 2019: Artificial intelligence: Human rights, social justice and development"
Creative Commons Attribution 4.0 International (CC BY 4.0) - Some rights reserved.
ISBN 978-92-95113-12-1
APC Serial: APC-201910-CIPP-R-EN-P-301
978-92-95113-13-8
ISBN APC Serial: APC-201910-CIPP-R-EN-DIGITAL-302