Processes biometric data, in Brazil

Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) · Read the law's page

• Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
• Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.
• Do not treat anonymized data as personal data unless the anonymization process can be reversed using your own means or with reasonable effort, and treat data used to build an identifiable behavioral profile as personal data again.
• Give a public-health research body access to personal data only within a controlled and secure environment, anonymized or pseudonymized where possible, and never transfer that data to a third party.
• Do not share sensitive health data between controllers for economic advantage, except for the data subject's requested portability or the listed health-service, pharmaceutical, or health-assistance transactions.

Projeto de Lei nº 2.338/2023, art. 13, IV e § 1º a 2º, e art. 23, § 1º (aprovado pelo Senado Federal em 10 de dezembro de 2024) · Read the law's page

• This bill has not been enacted and binds no one yet; as the Senate approved it, developing, implementing or using an AI system for remote biometric identification in real time in spaces accessible to the public would be prohibited, except for a criminal investigation or proceeding under prior reasoned judicial authorization, the search for crime victims and missing persons or a grave and imminent threat to life or physical integrity, flagrante delicto of crimes punishable by more than two years of imprisonment, and the recapture of escaped defendants and execution of warrants ordered by the Judiciary.
• If the bill is enacted as approved, adopt measures to curb the use of your AI system for the prohibited cases, and keep any excepted use proportional and strictly necessary to the public interest, with due process of law and judicial control.
• If the bill is enacted as approved and you are a public body or a company running a public service, follow the bill's principles and governance measures, and carry out an algorithmic impact assessment, before using a biometric system for identification.