Brazil’s Expanding Surveillance System: Security at the Cost of Privacy?

Brazil is moving quickly to expand surveillance in the name of public safety; however, protective measures are not keeping pace. Three initiatives working their way through Brazilian institutions right now show just how far that expansion has gone: a bill that would authorize facial recognition across public transit and government buildings nationwide, another that would let stores and private security firms publish images of alleged criminals on their own authority, and an app that turns ordinary citizens into an extension of the municipal surveillance system. Data Privacy Brasil has raised concerns about all three, arguing that Brazil is racing ahead with surveillance technology without settling the basic questions of transparency, accountability, and fairness that should come first.

A national facial recognition law takes shape

The most sweeping of the three is Bill No.1,828/2023, which the Chamber of Deputies passed on August 12, 2026. It now moves to the Federal Senate. If enacted, the bill would authorize the use of facial recognition technology in metro and bus stations, on public transit vehicles, on public roads, and inside government buildings nationwide.

To its credit, Data Privacy Brasil acknowledges that the version approved by lawmakers is a significant improvement over the original proposal. It prohibits the processing of biometric data belonging to children and teenagers, restricts mass or indiscriminate surveillance, bans discriminatory uses, and requires human oversight before the system can trigger any measure that restricts an individual’s rights.

Even so, the organization doesn’t think that’s enough. Its core objection is that the bill still greenlights broad biometric surveillance of public spaces, and it worries that public money could end up buying facial recognition systems without rigorous vetting, despite well-documented evidence that these systems misidentify Black people at higher rates than others. Unchecked facial recognition tends to deepen existing exclusion, leads to people being stopped or restricted without real justification, and hands the state more surveillance power without addressing what is actually driving public security problems in the first place. As the bill heads to the Senate, the organization is pushing for real limits on how these systems can be used, more transparency around government contracts with private vendors, and stronger protection against biometric monitoring becoming the default rather than the exception.

Giving businesses the power to identify their own suspects

The second bill takes a very different approach to surveillance. Instead of focusing on government cameras, it addresses what private companies can do with footage captured by closed-circuit television (CCTV) systems. Bill No. 3,630/2025 was approved by the Chamber of Deputies in March 2026 and is now before the Senate, where it has been advancing through the Senate committees with a favourable recommendation from the rapporteur.

The bill would create a new legal basis under Brazil’s data protection law, the Brazilian General Data Protection Law (LGPD), allowing stores and private security companies to process and publish images and audio of individuals captured during an incident the business believes to be a crime on its premises. This could be done to identify the person, warn the public, or provide the information to the police.

Data Privacy Brasil has been sharply critical of this idea. Publishing someone’s face as a “suspect” before any investigation or court ruling, the organization argues, sidesteps due process, undermines the right to a defence, and can permanently damage a person’s reputation over an accusation that was never tested. It also points out that the harm wouldn’t fall evenly: given the structural racism already documented in Brazilian policing and society, broadly circulating images of people labelled as suspects is likely to hit Black Brazilians hardest.

Data Privacy Brasil doesn’t think there’s actually a legal gap here that needs filling. Brazil’s Constitution, the LGPD itself, the Civil Code, and existing legal procedures already give people tools to challenge the unlawful use of their image. Carving out a brand-new exception, the organization argues, risks creating overlapping, inconsistent rules that end up weakening the very protections the LGPD was built to provide.

São Paulo city app turns citizens into spies

The third initiative shows surveillance expanding in a quieter, more grassroots way. Smart Sampa Cidadão is a São Paulo city app that lets residents photograph vehicle license plates, tag the location, and send both straight to the Municipal Civil Guard. To operate, it also collects the user’s name, email, CPF number, address, phone number, and a timestamped record of each submission. 

The privacy policy for the Smart Sampa Cidadão app has significant shortcomings. A photo taken to capture a license plate will often also capture the driver’s face, a passenger’s face, or a bystander’s face. Under Brazilian law, facial images are considered sensitive biometric data. Yet the app’s privacy policy does not explain whether these faces are blurred or anonymized, or whether they are subject to any specific privacy safeguards. There is no retention deadline either. The policy simply says submitted data may be kept by the service center, without saying for how long, under what justification, or how it will eventually be deleted. On top of that, individual users are left to decide which vehicles or people appear suspicious enough to photograph and report, with no auditing process and no way for the person who was photographed to push back or even find out that their image was submitted. The policy spells out rights for the app users but says nothing about the rights of third parties who happen to appear in the background of someone else’s photo. This practice is described in the academic literature as “participatory surveillance,” in which ordinary citizens perform tasks that were traditionally carried out by public authorities, while the associated risks and responsibilities are shifted onto them without adequate safeguards.

The pattern underneath all three

These three initiatives don’t look alike on the surface — one is a national facial recognition bill, one is a carve-out for private businesses, one is a city app — but Data Privacy Brasil sees the same problem running through all of them: surveillance is expanding faster than the safeguards meant to keep it in check.

Before biometric monitoring, private image-sharing, and citizen-driven surveillance become just another normal part of everyday life, Brazil needs to settle how transparent these systems will be, who’s accountable when they go wrong, what limits exist on how the data gets used, how discrimination gets prevented, who provides independent oversight, and how the people affected can actually exercise their rights.