Brazil’s regulator shuts down biometric matching for classroom attendance

Brazil’s National Data Protection Authority (ANPD) has ordered the school system in the southern state of Paraná to immediately stop collecting the biometric data of children and adolescents to take attendance in its public school system using facial recognition software.

The biometrics deployment is a pilot project of the Paraná State Department of Education, which says the pilot ended in July 2026.

According to a translated report from Portal Verdade, the ANPD’s decision says the state government “failed to demonstrate an adequate legal basis for processing students’ biometric data, considered sensitive under the General Data Protection Law (LGPD), nor did it provide sufficient guarantees of security, information governance, and that the measure served the best interests of children and adolescents.”

A technical note also says the Department of Education also “presented more than one legal justification for the same purpose, which hinders the exercise of the rights of the data subjects.”

The technology and infrastructure powering the project spanned government and private vendors. The Paraná State Information and Communication Technology Company (Celepar) contracted Brazilian company Valid to provide identity verification services; Valid subcontracted Slovakia-based Innovatrics for facial recognition software. The tool functioned through the Escola Paraná Biometria app: a teacher would photograph the class, and send the image to Celepar’s cloud servers, wherein student faces were extracted and compared against a database of enrolled students’ biometric profiles.

Just call out their names: teacher’s union

Government estimates say the data processing operation covered 2,136 educational institutions, approximately 1 million students, and over 100,000 employees.

Portal Verdade quotes Walkiria Mazeto, president of APP-Sindicato (the Union of Teachers and School Employees of Paraná), who says “schools have always monitored attendance and can continue to do so by calling names, including using digital systems. Therefore, it has never been demonstrated to the school community why it would be necessary to use biometric data.”

The ANPD agrees. In calling on Paraná to suspend biometric collection, it says facial recognition is unnecessary and disproportionate, and notes many options that are less invasive, even if they require an old fashioned roll call. “Convenience based on practicality is not sufficient to support the need required” by the LGPD (Brazilian General Data Protection Law), says the regulator’s statement.

Specific issues include a lack of controls over image sharing and privacy, and the matter of retention: “since the information would be kept as long as the student remained enrolled, the system could store ‘the equivalent of 14 years of biometric data for each student’.”

ANPD wants confirmation; union wants deeper investigation

The ANPD has given the government of Paraná ten days from the date of notification to “demonstrate that it has stopped processing the data in all systems, schools, and companies involved.” Since the pilot is closed, this should theoretically not be difficult.

But for Walkiria Mazeto and the teachers’ union, “it’s not enough to say that the contract ended or that the system stopped being used.” There must be accountability, and disclosures on where data was stored and which companies participated in the processing.

“We are talking about biometric data that has been collected for years,” she says. “Innovation does not mean that the State can collect any data, in any way, simply because a technology is available.”

Article Topics

ANPD  |  biometrics  |  Brazil  |  data protection  |  face biometrics  |  Innovatrics  |  schools  |  time and attendance  |  Valid