Facial Recognition Program in São Paulo Metro Stations Suspended for Illegal and Disproportionate Violation of Citizens’ Right to Privacy

A facial recognition program rolled out by São Paulo Metro Stations was suspended following a court ruling in response to a lawsuit by civil society organizations, who cited fear of it being integrated with other electronic surveillance entities without consent, and lack of transparency about the biometric data collection process of metro users.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident centers on the unauthorized and disproportionate collection of biometric data from 4 million metro users, which directly threatens citizens' fundamental right to privacy.

Additional risk subdomains

• 1.1 Unfair discrimination and misrepresentation: Civil rights groups initiated the lawsuit partly due to discrimination concerns regarding the facial recognition technology.
• 7.4 Lack of transparency or interpretability: The court and civil groups highlighted a severe lack of transparency regarding the system's training data, risk assessments, and data processing methods.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The deployment of the facial recognition system was an intentional decision by human operators (METRO and ViaQuatro) post-deployment, which led to legal challenges over privacy violations.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is a facial recognition platform used for public transit surveillance, which falls under law enforcement and public security applications of biometric identification.

AI system and alleged parties

• AI system: SecurOS (ISS)
• AI purpose: Face Recognition; Smart Surveillance
• Behaviour type: Autonomous
• Alleged developer: SecurOS
• Alleged deployer: Companhia do Metropolitano de São Paulo
• Alleged harmed parties: São Paulo Metro users, São Paulo citizens

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Severe, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report explicitly describes violations of civil rights, specifically the right to privacy and data protection, caused directly by the unauthorized biometric collection.

Directly caused: The unauthorized capture and processing of biometric data from 4 million daily metro users violated their fundamental rights to privacy and personal data protection under Brazilian law.

Privacy

Reported: The report explicitly describes privacy violations caused directly by the unauthorized collection of biometric data.

Directly caused: The system captured and processed the biometric facial data of approximately 4 million daily metro users without obtaining their consent, violating their right to privacy.

People affected

• Occurrences reported: 1
• People reportedly harmed: 4000000
• People reportedly exposed: 4000000

Potential causes

Management

• Inadequate Project Governance: Deploying system without clarifying data processing and operational details.

Technology

• Unverified Model Training: METRO failed to disclose the database used to train facial recognition models.
• Uncontrolled Integration Risk: Fears that SecurOS could integrate with other facial surveillance systems.

Data Inputs

• Mass Biometric Capture: Biometric data of 4 million daily users captured without proportionality.
• Lack of Consent Mechanisms: No measures in place for obtaining user consent for biometric processing.

Process and Methods

• No Risk or Impact Assessment: The system was implemented without proper risk or impact evaluation.
• Lack of Public Transparency: Failure to communicate the nature and risks of biometric data processing.

Regulatory Environment

• Privacy Rights Violations: The system violated citizens' fundamental right to privacy under local laws.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple sources consistently detail the court ruling, the parties involved (METRO, ViaQuatro, ISS), the specific AI system (SecurOS), and the legal basis of the suspension (privacy violations and lack of transparency). There is high agreement on the core facts of the incident.
• Ambiguities identified: The exact technical specifications of how SecurOS processes and stores data, and the specific database intended for training, are not fully detailed in the reports.
• Alternative interpretations: None. The incident is clearly a legal suspension of a public facial recognition deployment due to privacy and civil rights concerns.

A Sao Paulo court suspended a mass facial recognition transit surveillance system (SecurOS) over civil rights and privacy concerns affecting 4 million daily users. This highlights growing domestic legal scrutiny over public AI surveillance but carries negligible direct national security risk.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Brazil
• Alleged perpetrator: METRO and ViaQuatro

Threat characteristics

• Imminence: Long-term. The system has been suspended by court order, making any active privacy threat a long-term regulatory concern.
• Autonomy: Human-supervised. The facial recognition system automatically captures and processes biometric data, but operates under transit authority supervision.
• Novelty: Established threat. Legal challenges and privacy disputes over public facial recognition systems are well-established globally.

Impact by dimension

• Physical security: Negligible. No physical threat, kinetic attack, or disruption of critical infrastructure operations occurred.
• Information security: Negligible. No information warfare, deepfake campaigns, or compromise of national intelligence databases reported.
• Sovereignty: Negligible. Standard domestic legal and judicial processes functioned as intended, with no threat to state sovereignty.
• Economic security: Negligible. Localized financial risk from contract suspension and potential fines, with negligible impact on national economic security.
• Societal stability: Minor. Mass biometric collection of 4 million users raised civil liberties and privacy concerns, but was halted by domestic courts.