I. Introduction
The pursuit of security combined with rapid technological advancement has given rise to a surveillance society frequently described as a digital panopticon.Footnote 1 Facial recognition technologies (FRT), employing artificial intelligence (AI), emerge as a particularly powerful instrument of surveillance in this landscape, with their use expanding rapidly across public and private spaces. In this scenario, the question of how to regulate facial recognition systems has emerged as a difficult legal challenge that liberal democracies have confronted in recent years.Footnote 2
Against this background, this article aims to examine how regulatory frameworks should shape the governance of facial recognition technologies, employing the European Union (EU) and Brazil as contrasting yet relatable case studies. The analysis specifically focuses on the regulation of one particular application of facial recognition technology: real-time remote biometric identification by law enforcement authorities.
The selection of the EU and Brazil as comparative case studies is deliberate. In the EU, the AI Act entered into force in 2024 following several years of public debate.Footnote 3 The AI Act explicitly prohibits the use of AI for real-time remote biometric identification for law enforcement purposes, yet carves out several exceptions.Footnote 4 Law enforcement authorities may still deploy such technology for real-time identification when necessary to achieve three broad categories of objectives, including (i) the search for victims or missing persons, (ii) the prevention of specific serious threat to the life or physical safety of individuals or (iii) the localization or identification of serious criminal offenders.Footnote 5
Meanwhile, in Brazil, the proposed legal framework to regulate AI remains under deliberation in the National Congress.Footnote 6 The proposal, in its current form, establishes that real-time remote identification may be permitted in cases that partially reflect the exceptions provided by the EU AI Act.Footnote 7
In this article, I advance two interrelated claims. First, I argue that legal transplantationFootnote 8 alone is insufficient to address the risks posed by real-time facial recognition technologies. Second, while much of the academic and policy discourse surrounding FRT has centred on threats to privacy,Footnote 9 freedom of expression and assembly,Footnote 10 I contend that the discriminatoryFootnote 11 risks posed by real-time remote biometric identification deserve urgent analytical attention.Footnote 12 This shift in focus becomes particularly relevant when examining jurisdictions marked by structural inequalities.Footnote 13 In such contexts, the deployment of FRT may compound existing patterns of discrimination through technological means that operate at unprecedented scale and with a false sense of objectivity.Footnote 14
Drawing on legal literature, reports from public authorities and non-governmental organisations, and empirical research on policing practices, I advance the normative position that Brazil should not replicate the EU AI Act’s exceptions for law enforcement use of real-time FRT. This argument rests on a critical examination of how algorithmic systems interact with structural inequality.Footnote 15 Even when FRT systems achieve high accuracy rates, their deployment at scale in contexts of unequal policing inevitably produces discriminatory outcomes that disproportionately harm already marginalized communities. The discriminatory effects emerge fundamentally from decisions about where surveillance infrastructure is deployed. These decisions historically track existing patterns of over-policing in areas marked by socioeconomic disadvantage and racialized populations.Footnote 16
To substantiate this argument, this article is structured as follows. Section II sets the scene by examining the expansion of facial recognition technology in the context of public security concerns, the concept of the Brussels Effect and its limitations in the AI regulatory domain, and the vulnerabilities amplified by AI-driven surveillance. Section III explores the human-rights risks arising from AI-driven surveillance, particularly mass surveillance and discriminatory risks. Section IV examines the legal frameworks governing law-enforcement uses of facial recognition in the EU and Brazil, identifying points of convergence and divergence. Section V advances a normative argument against replicating the EU’s exceptions in Brazil, recommending instead a categorical ban on real-time remote biometric identification for law-enforcement purposes grounded in the recognition that some technologies, when deployed within contexts of structural inequality, are fundamentally incompatible with constitutional guarantees of non-discrimination.
II. Setting the scene
The comparative examination of two systems, one already regulated, the EU, and one still under development, Brazil, takes place in a context in which academic scholarship points to the growing influence of legal systems on one another. The concept of the ‘Brussels effect’, for instance, illustrates how the EU shapes global regulatory standards without extending its formal jurisdiction beyond its borders.Footnote 17 It embodies a form of unilateral regulatory globalization propelled by the forces of the capitalist market, wherein the EU exports regulations by imposing higher standards for products and services sold within its jurisdiction. Beyond this, scholars have also identified an emerging ‘AI regulatory race’, whereby jurisdictions that succeed in regulating AI at an early stage possess comparative advantages in defining the contours of the global regulatory order.Footnote 18
The ‘Brussels effect’ and related forms of regulatory influence, in my view, are not uniform across all dimensions of the regulation of AI. In the context of FRT, Bradford’s analytical angle would primarily address aspects of AI design and, for instance, the development of technical measures that may mitigate unlawful discrimination, areas where EU standards may indeed propagate globally through market mechanisms. However, these market mechanisms do not affect as much how national jurisdictions regulate when AI should be implemented or banned. In this regard, how the EU has chosen to regulate AI may exert considerably less influence, as national legal frameworks retain substantial autonomy in determining local implementation policies. Consequently, aspects that fall outside the scope of AI design may differ substantially across jurisdictions, for instance, whether certain practices are prohibited locally, such as the case of real-time biometric identification for law enforcement purposes.
A. The expansion of facial recognition technology in the light of public security
Notwithstanding the existing regulatory framework for FRTs, their increased use for surveillance purposes has been widely documented.
Numerous examples illustrate this surveillance reality across the Global North and South, across developed and developing countries, across private and public facilities. In 2021, the Swedish Authority for Privacy Protection determined, following an investigation into police practices, that the institution had deployed Clearview AI on multiple occasions to identify individuals.Footnote 19 Concurrently, the European Union Agency for Fundamental Rights documented that national authorities were implementing AI-driven recognition systems for crime prevention and crowd control.Footnote 20 Residential buildings in Brazil have gradually and exponentially adopted facial recognition systems for access control.Footnote 21 In commercial settings, enterprises have attempted to implement the technology not merely for access control but equally for analytics, targeted advertising and customer profiling.Footnote 22 In law enforcement and public security, FRT potentially puts 70 million people under surveillance in Brazil.Footnote 23
There is a rich body of research that examines reasons for public acceptance of surveillance.Footnote 24 The debates surrounding the implementation of surveillance instruments are often rooted in appeals to the common good of public security and in the pervasive fear of insecurity.Footnote 25 These perceived and real threats frequently drive public support, even when the cost is the erosion of freedom and, not rarely, oppression as well. The narrative of ensuring public security is too compelling to be easily dismissed. For instance, in São Paulo, where approximately 2500 individuals were arrested with the support of CCTV cameras deployed across public and private spaces,Footnote 26 2517 intentional homicides occurred in 2024, averaging 7 per day.Footnote 27 Similarly, the perceived threat of large-scale terrorist attacks and mass shootings in schools and theatres fuels public opinion in favour of increasingly pervasive surveillance mechanisms.Footnote 28
B. Vulnerabilities
With AI, surveillance has acquired a new dimension, given its considerable capacity to identify individuals within massive data sets, in real time, and often discreetly, particularly when technologies such as facial recognition are embedded in CCTV systems already extensively deployed in the streets of urban agglomerations.Footnote 29 In this context, surveillance extends beyond economic extraction, and transcends what Zuboff articulated as the commodification of personal and behavioural data as the essential raw material that sustains digital economies.Footnote 30 Beyond economic extraction, surveillance, under conditions shaped by AI, amplifies conditions of vulnerability.Footnote 31
In this regard, vulnerabilities can be amplified at least in three principal ways.
First, surveillance can deepen pre-existing asymmetries of power between public authorities and citizens when the latter lack adequate legal safeguards to comprehend how and for what purposes they have been monitored, as well as the legal procedural mechanisms for contesting the legitimacy of state surveillance in specific contexts.Footnote 32
Second, the constant possibility of being observed can induce self-censorship, thereby undermining individual autonomy and the free exercise of rights, such as the right to protest against the surveillance authority itself.Footnote 33
Finally, surveillance mediated by AI can reproduce or even intensify existing biases embedded in data and institutional practices, disproportionately affecting already marginalized groups, as numerous studies and cases have demonstrated.Footnote 34
III. Risks: Enabling mass surveillance and deepening discrimination
The vulnerabilities identified above find concrete expression in risks associated with mass surveillance and discrimination. While these risks may appear autonomous at the surface, they are, in reality, as I argue below, interrelated, given that the same infrastructure that enables extensive monitoring also serves to perpetuate conditions of discrimination.
Mass surveillance refers to practices that involve indiscriminate monitoring of the public.Footnote 35 Such practices are conducted without specific or reasonable suspicion and deprive individuals of adequate opportunities to provide genuine consent or to exercise meaningful choice in opting out of being monitored. This monitoring is not performed in a targeted manner against a specific individual.Footnote 36 Nor does it presuppose prior suspicion that someone has committed any sort of infraction.Footnote 37 The civil society organization European Digital Rights (EDRi) considers that biometric mass surveillance occurs when three criteria are fulfilled: first, indiscriminate or arbitrarily targeted collection, processing or storage of sensitive biometric data; second, deployment on a large scale; third, implementation without the control or knowledge of random passersby.Footnote 38
The implementation of facial recognition technology within the extensive CCTV systems present in urban agglomerations evidently entails substantial risks of mass surveillance, either for real-time or post-event identification.
First, there is indiscriminate collection, processing and storage of biometric data (e.g., facial features) given that FRT for identifying specific individuals is only possible through constant video surveillance of all individuals that pass in a certain area. In this sense, the technology targets everyone without distinction.Footnote 39
Second, the determination of what constitutes large-scale deployment in configuring mass surveillance remains a subject of debate. How many cameras should be integrated with FRT to be deemed a project of mass surveillance? The figures are often substantial, in absolute terms, when it comes to CCTV systems. In the European Union, the Greens and EFA parliamentary groups published a report mapping how different FRT were being tested and implemented across the EU.Footnote 40 According to this report, for instance, in Hungary, the Dragonfly project saw 35,000 CCTV cameras integrated into a single, searchable network connected to biometric databases, enabling police and secret services to identify individuals by their faces, resulting in thousands of matches, hundreds of stop-and-searches, and a few arrests. In Brazil, a research and civil society organization reported that law enforcement had 264 projects involving the implementation of facial recognition technologies for surveillance.Footnote 41 This potentially places around 75 million citizens under surveillance. In São Paulo, the most populous city in South America, 25,000 cameras are deployed in public spaces, many of them equipped with facial recognition technology. According to the official website of the police, in the first half of 2025, 2,486 individuals were arrested with the support of FRT-linked cameras.Footnote 42 This amounts to an average of 414 arrests per month involving the use of FRT. Academia and civil society organizations have voiced against the risks that these surveillance mechanisms pose to the population.Footnote 43
Third, the implementation of FRT and, consequently, the processing of personal data, may occur with the knowledge of citizens, at least in theory, if they are informed or if the cameras are explicitly positioned within public view. Yet, in this case, the fact they are equipped with FRT should be explicitly communicated, as FRT is software and not hardware visible to the general public. The matter of control proves far more complicated to verify in this case. What capacity does an individual possess to control their monitoring by the technology itself? When this control translates to the matter of consent, Personal Data Protection Authorities have established that the consent must be explicit and articulated by the data subject.Footnote 44 In cases of untargeted surveillance, this requirement proves, in practice, impossible to fulfil. If the use of FRT is, however, used for law enforcement purposes, consent is not required and is replaced by considerations of public interest, provided that three fundamental requirements are satisfied: specific legal foundation, necessity, proportionality.Footnote 45
The consequences for the respect of private life and freedom of expression can be profound when such mass surveillance systems are implemented. The first ruling of the European Court of Human Rights, rendered in 2023, concerning the compatibility of FRT with human rights compellingly illustrates these consequences.Footnote 46 The case involved Mr. Glukhin, who travelled on the Moscow subway with a life-size cardboard representation of Mr. Kotov, a political activist who had been detained several days prior. While Mr. Glukhin held the cardboard in the subway during a solo and peaceful demonstration, he was not intercepted by the police. Seven days following his demonstration, Mr. Glukhin was arrested at a subway station and charged with an offense for violating regulations governing the conduct of public events. The Russian police anti-extremist unit was able to locate and identify him through facial recognition technology, which they deployed on at least two occasions. First, the police extracted screenshots from a public Telegram channel displaying videos of Mr. Glukhin holding the cardboard. The police, then, secured access to video recordings from CCTV cameras installed at subway stations. The police employed FRT to identify Mr. Glukhin in both of these video sources. Second, the police allegedly deployed real-time FRT to track Mr. Glukhin’s location within the Moscow subway system, leading to his arrest. He was ultimately convicted.
This case illustrates privacy violations but also how institutional capacity to deploy FRT creates asymmetries in who gets monitored and for what purposes. While framed as ‘mass’ surveillance, the technology’s deployment and use reflect specific enforcement priorities. Although mass surveillance is often described as ‘indiscriminate’, this characterization is misleading from an equality perspective. Often, mass surveillance technologies are placed in specific urban areas or institutional settings already associated with heightened security concerns, such as neighbourhoods marked by socioeconomic disadvantage, racialised populations or prior intensive policing. In Brazil, for instance, ostensive policing focuses on property crimes and drug trafficking, while white-collar crimes, often related to people from higher social classes, are not a priority of ostensive policing.Footnote 47 As a result, even when data collection is formally broad, surveillance is unevenly distributed, disproportionately affecting groups that are already subject to suspicion. There is a selective aspect in the implementation of mass surveillance technologies that should not be disregarded.
In this line of reasoning, FRT also presents serious risks to the right to non-discrimination. Facial recognition employed by the police can, and has, discriminated against individuals through two interrelated reasons. First, because the systems themselves have performed differently across demographic groups.Footnote 48 Second, and more fundamentally, because they are deployed within already unequal policing systems.Footnote 49
Concerning the first reason, in the past, numerous FRT models were uniformly less accurate for women and darker-skinned individuals. This resulted in higher false-positive rates for particular groups. Past studies have documented error rates as high as 34.7 per cent for darker-skinned women compared to 0.8 per cent for lighter-skinned men in commercial classification systems.Footnote 50 Issues of accuracy, and therefore bias, occurred for several factors, including biased data training with overrepresentation of images of persons belonging to certain groups.Footnote 51 Bias related to accuracy occurs due to the algorithm’s intrinsic capability to extract and compare biometric features, but also the quality of the image and the deployment context. To a great extent, bias related to algorithmic intrinsic capabilities has been remarkably reduced due to improvements in the algorithms. Large-scale evaluations by the National Institute of Standards and Technology (NIST) show that facial recognition systems are no longer uniformly less accurate at such high rates for particular demographic groups.Footnote 52 Nevertheless, according to these same evaluations, performance issues related to accuracy may still arise depending on the task and conditions of deployment. While demographic gaps have substantially narrowed when algorithmic capabilities are looked at in isolation, higher-positive rates may persist in the identification under degraded capture conditions, for instance. These disparities, in some contexts, carry serious consequences. They have a direct impact on who is stopped, arrested, or subjected to further investigations through long and burdensome administrative or even criminal procedures.Footnote 53
In principle, public authorities could rely on the reduction of accuracy-related bias resulting from improved algorithmic capabilities as a legitimate reason to deploy FRT in surveillance contexts. However, bias and discrimination result from a complex combination of factors that are not limited to the algorithm’s ability to accurately identify individuals, as also highlighted in NIST evaluations. The conditions under which the technology is deployed, therefore, constitute a relevant factor in producing unequal treatment.
Deploying FRTs within the context of already unequal policing systems can produce discriminatory effects for several structural reasons. For instance, targeted deployment in specific neighbourhoods, often justified by a high incidence of past crimes in those areas, results in increased surveillance of those populations, thereby amplifying the likelihood that system errors will disproportionately harm them.Footnote 54 This dynamic creates self-fulfilling or feedback loops of surveillance and enforcement. Such effects are particularly problematic in cities characterized by spatial segregation and concentrations of residents with particular ethnic or national origins in certain areas.Footnote 55 In this context, facial recognition technologies can generate discriminatory outcomes even when systems are equally accurate across groups, due to the ways in which they are deployed by law enforcement. Over-policed areas will generate more data related to crimes and, thus, more justification for the implementation of policing, and thus, more stops and arrests compared to areas that have less policing. Facial recognition systems may perform uniformly at a technical level while producing deeply unequal legal consequences due to asymmetric deployment.
In Brazil, for instance, empirical research has pointed out that efforts to reduce drug trafficking have led to considerably more policing of low-income areas.Footnote 56 In addition, research on police stop-and-search practices indicates that black individuals, especially young, poor black men living in peripheral areas, are significantly more likely to be subjected to police approaches and coercive interventions.Footnote 57 Qualitative and quantitative studies conducted in urban areas demonstrate that police suspicion is commonly structured around a hierarchy of social markers, with skin colour operating as the primary criterion, followed by socioeconomic status and place of residence.Footnote 58 Phenotypical characteristics associated with blackness, combined with indicators of poverty or presence in ‘out-of-place’ environments, are routinely treated as proxies for criminality.
From the perspective of those subjected to police controls, these practices amount to a systematic pattern of differential treatment, in which black, poor residents of peripheral neighbourhoods are more frequently stopped, and are also more likely to experience abusive forms of policing.Footnote 59 As scholars have argued, the aggregation of these practices produces a structural outcome indicative of institutional racism, understood beyond restricted access to goods, services or opportunities for certain demographic groups, but as a perpetuation of a condition of inequality that is structurally embedded in social and institutional arrangements.Footnote 60 When facial recognition systems are introduced into this context, they risk reinforcing and scaling these existing patterns. By concentrating technological surveillance in certain areas of the cities, FRTs are likely to intensify racialized patterns of suspicion, mainly by producing racialized data and, thereby, embedding even further institutional racism into data-driven policing technologies.
IV. How is the deployment of facial recognition technology regulated? Is it allowed?
Given that FRT in publicly accessible spaces allows biometric surveillance, capable of uniquely identifying individuals, often without their knowledge, and in contexts where they have not attracted any specific suspicion, their deployment should be strictly regulated.
How does it happen in practice? Can FRT technologies be placed in surveillance cameras in the EU and Brazil?
A. European Union
In the European Union, FRT for surveillance purposes is subject to a very complex thread of laws, with distinct legal regimes applying depending on who uses the technology: law enforcement authorities or private actors in the scope of their business, such as stores and shopping malls.Footnote 61 This article focuses only on the former, and it should be noted that the regulatory frameworks vary considerably depending on the use case of FRTs.Footnote 62
When FRT technologies are implemented in cameras positioned in public streets and public areas and are controlled by law enforcement authorities for the purposes of prevention, investigation, detection, or prosecution of criminal offenses, they operate within a multi-layered regulatory framework. This framework encompasses both horizontal human rights protections and specialized sectoral regulations. At the foundational level, the Charter of Fundamental Rights of the European Union (EU Charter) and the European Convention on Human Rights (ECHR) establish the fundamental rights parameters that any deployment of FRT must respect. These are complemented by the Law Enforcement Directive (LED), which provides specific data protection rules for the law enforcement sector, and the Member States’ national laws transposing the LED, which adapt these principles to domestic legal systems. More recently, the Artificial Intelligence Act has introduced an additional layer of regulation specifically addressing the risks posed by AI systems, including biometric identification technologies. Notably, in this law enforcement context, the General Data Protection Regulation is explicitly not applicable.Footnote 63
1. The foundational framework
The EU Charter and the ECHR establish the constitutional boundaries within which law enforcement authorities must operate when deploying FRT as a surveillance instrument. The EU Charter, as primary EU law, is directly applicable to EU institutions and to Member States when they implement EU law. This means that when Member States implement the Law Enforcement Directive or deploy FRT systems under national law, they must comply with the fundamental rights guaranteed by the Charter. The ECHR exerts significant influence through Article 6(3) of the Treaty on European Union, which recognizes fundamental rights as guaranteed by the ECHR as general principles of Union law. Moreover, according to Article 52(3) of the EU Charter, where Charter rights correspond to rights guaranteed by the ECHR, their meaning and scope shall be the same as those laid down by the Convention. This constitutional architecture establishes a dual layer of human rights protection that constrains Member State action in the deployment of FRT.
FRT deployment in public spaces engages multiple fundamental rights protected by both instruments, including the protection for privacy and family life,Footnote 64 protection of personal data,Footnote 65 protection of freedom of expression,Footnote 66 protection of assembly,Footnote 67 protection against discrimination.Footnote 68
Any limitations to these rights are only allowed if provided by lawFootnote 69 and respecting the essence of these rights and freedoms. These limitations, provided by the law, are to be allowed if they are subjected to the principle of proportionality, meaning that any limitation to these rights must be necessary and genuinely meet the general interest or the need to protect the rights and freedoms of others. The European Data Protection Supervisor has elaborated a proportionality toolkit to support the assessment of measures that limit the fundamental right to privacy and the protection of personal data.Footnote 70
In practice, if a Member State decides to implement FRT in CCTV on public streets, it will need a specific legal basis.Footnote 71 According to the case law of the European Court of Human Rights, this legal basis must be clear about the conditions and circumstances in which this technology will be used.Footnote 72 A precise law, in this case, is required describing the FRT application and the conditions for its use. For instance, if the purpose is to investigate a particular type of crime, the severity of this crime should be taken into account, and petty crimes should be excluded.Footnote 73
The requirement of necessity implies that there is no less intrusive way available to achieve the main purpose of putting in place FRT in cameras in public streets. For instance, other alternatives should also be reflected upon, including more frequent policing or additional street lighting.Footnote 74
The general interest requirement should be looked at in relation to its necessity. Of course, a clause of general interest of public security could give a lot of space to Member States to put in place all sorts of surveillance technologies. General interest for public security should not be used for the justification of surveillance technologies indiscriminately and in huge amounts.Footnote 75 Case law of the European Court of Justice has decided that an objective of general interest alone is not a sufficient legal ground to justify a limitation to a fundamental right.Footnote 76
The Law Enforcement Directive more specifically repeats the requirements of the EU Charter. First, it provides that processing special categories of data such as biometric data, which FRT does, should only be allowed where strictly necessary and subject to appropriate safeguards for the rights and freedoms of the data subject.Footnote 77 In addition, when there is a legal basis to process such data, Member State law, the legal basis or legislative measure should be clear and precise.Footnote 78 Member State law regulating the processing of personal data within the scope of this Directive should specify at least the objectives, the personal data to be processed, the purposes of the processing and procedures for preserving the integrity and confidentiality of personal data and procedures for its destruction.
2. The AI Act: Prohibition with exceptions
The Artificial Intelligence Act introduces limitations on FRT deployment. In general terms, the AI Act prohibits the use by law enforcement of real-time remote identification systems in publicly accessible spaces.Footnote 79 However, the Act establishes several exceptions to this general prohibition.Footnote 80 Real-time FRT is permitted when strictly necessary for the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons.Footnote 81 Additionally, it admits real-time FRT identification when it is strictly necessary for the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack.Footnote 82 Finally, the Act admits real-time FRT for the localization or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecuting or executing a criminal penalty.Footnote 83
The Act establishes safeguards for these exceptions. First, the Act specifies that when the use of real-time FRT identification is employed by law enforcement, it should be only to confirm the identity of the specifically targeted individual.Footnote 84 Probably this requirement aims to prevent broad, random and non-specific recognition of individuals. Second, law enforcement putting in place this exception should take into account the seriousness of the situation giving rise to the use of the technology, the scale of harm it may cause and the consequences of its use for the rights and freedoms of all persons concerned. This should mandatorily be assessed and documented in a fundamental rights impact assessment.Footnote 85 Third, such a system should be mandatorily registered in the EU database.Footnote 86 Fourth, the use of real-time FRT identification must be subject to a prior authorization given by a judicial authority or an independent administrative authority. The Act provides limited flexibility regarding this provision, stating that in cases of duly justified situations of urgency, the use of the system may commence without authorization provided that law enforcement requests such authorization at the latest within 24 hours. If such authorization is rejected, the use must cease with immediate effect, and all the data, as well as the results and outputs of that use, shall be immediately discarded or deleted.
In short, in the EU, law enforcement authorities may deploy FRT in public surveillance where multiple stringent conditions are cumulatively satisfied. A specific legal basis must define the scope and conditions of use. The measure must be strictly necessary and proportionate. Fundamental rights must be safeguarded through ex ante assessments, including data protection impact assessments and fundamental rights impact assessments, and through oversight mechanisms. Moreover, the use of FRT for real-time remote biometric identification is generally prohibited under the AI Act, with exceptions existing under the above circumscribed conditions. These exceptions are coupled with obligations for prior judicial or independent administrative authorization and registration in the EU database. In any case, these exceptions provided by the AI Act allow the necessary structure for surveillance to be put in place.
B. Brazil
The Brazilian Constitution establishes the fundamental rights framework that governs the deployment of surveillance technologies, including FRT. Article 5, X of the Constitution guarantees that the ‘privacy, private life, honour and image of persons are inviolable’. This provision has been interpreted by the Constitutional Court as encompassing a negative dimension, protecting individuals from arbitrary state interference.Footnote 87
In 2022, the constitutional status of personal data protection in Brazil underwent significant evolution. Through a Constitutional amendment, it was formally recognized as a fundamental right.Footnote 88 This constitutional protection applies to all forms of personal data, including biometric data processing through FTR systems. Yet, the Constitution does not provide detailed rules governing the specific circumstances under which surveillance technologies may be deployed. This matter has been left to ordinary law.Footnote 89
1. The General Data Protection Law and the public security exemption
Beyond the Federal Constitution, the regulation of FRT is shaped primarily by the General Data Protection Law (LGPD), which entered into force in September 2020.Footnote 90 The LGPD establishes comprehensive rules for the processing of personal data, including sensitive personal data such as biometric data. The processing of biometric data is subject to stricter requirements under Article 11 of the LGPD, including more restrictive legal bases for lawful processing.Footnote 91 Notwithstanding these provisions, a significant gap exists in relation to law enforcement use of FRT.Footnote 92 Article 4, III of the LGPD expressly excludes from its scope any processing of personal data carried out ‘exclusively’ for purposes of public safety, national defence, state security, or criminal investigation and prosecution activities.
As a result, FRT systems deployed by police forces and other public security authorities for the purpose of ensuring public safety, investigating crimes, or identifying suspects do not fall under LGPD requirements.Footnote 93
This exemption has significant practical implications. It has enabled extensive deployment of FRT systems for policing and surveillance across Brazilian cities without explicit subjection to the procedural requirements, transparency obligations, or oversight mechanisms established by the LGPD.Footnote 94 Multiple Brazilian states and municipalities have implemented FRT in public CCTV networks without conducting data protection impact assessments, without establishing clear legal bases defining the scope and limits of use, and without implementing mechanisms for individual rights protection.Footnote 95
Recognizing this regulatory void, in June 2022, a legislative proposal was presented, which aims to establish a framework specifically governing the processing of personal data for purposes exclusively related to state security, national defence, public security, and the investigation and repression of criminal offenses.Footnote 96 The bill aims to establish principles, legal bases and data subject rights applicable to the processing of personal data in the context of public security.
2. The emerging AI regulatory framework
Brazil is in the process of adopting a specific AI regulatory framework.Footnote 97 In December 2024, the Senate approved proposed law 2338/2023, which aims to regulate AI at the federal level in the country.Footnote 98 After its approval in the Senate, the text was sent to the Chamber of Deputies, where it is currently under review by a special committee, before being put to a plenary vote. The legislative process is still ongoing, and the content of the proposal may still be amended before it is definitively enacted (if ever).
The structure of the proposed law is similar to the AI Act currently in force in the European Union. It similarly defines AI and introduces stricter regulatory requirements, including explicability and human oversight, based on the risk level of the AI system.Footnote 99 It also establishes prohibited practices. Among the prohibited practices, there is also the prohibition to implement ‘real-time biometric identification, at a distance, in public spaces’.Footnote 100
Similar to the EU AI Act, the Brazilian AI regulatory proposal provides exceptions to the ban on real-time biometric identification.Footnote 101 The Brazilian proposal establishes that real-time remote identification may be permitted in the following cases:
-
(a) the conduct of a criminal investigation or prosecution, subject to prior and reasoned judicial authorization, where there are reasonable grounds to believe in the authorship of or participation in a criminal offense, the evidence cannot be obtained by other available means, and the act under investigation does not constitute a minor offense.
-
(b) the search for crime victims or missing persons, or in circumstances involving a serious and imminent threat to the life or physical integrity of natural persons.
-
(c) situations of arrest in flagrante delicto for crimes punishable by a custodial sentence exceeding two years, with immediate communication to the competent judicial authority.
-
(d) the recapture of escaped defendants and the execution of arrest warrants and other restrictive measures ordered by the Judiciary.
One of the main differences from the EU AI Act is that the latter explicitly bans real-time remote identification by specifying that the prohibition applies to law enforcement, thereby leaving room for other uses. By contrast, the heading of Article 13(IV) of the Brazilian proposal is more generic and does not mention ‘law enforcement’, which suggests that it establishes a broader, general ban on real-time remote identification, apart from the exceptions laid down in points (a) to (d).
V. Normative suggestion: Ban on real-time remote identification for law enforcement purposes
In 2024, when the EU was taking the lead in regulating AI, it had the opportunity to entirely ban real-time remote biometric identification for law enforcement purposes. It did so, but only partially.Footnote 102 Despite multiple calls from public bodies, including the European Data Protection Supervisor and the European Data Protection Board,Footnote 103 as well as from civil society organisationsFootnote 104 and academia,Footnote 105 urging a full and unconditional ban, the EU left room for exceptions and concessions.
These calls were grounded in the undeniable fact that such technologies pose serious threats to several foundational human rights, including the right to privacy and the right not to be discriminated against.Footnote 106 They also have a chilling effect on other equally important rights, such as freedom of association. All of these rights are enshrined in legal frameworks of EU Member States, including the European Convention on Human Rights, the EU Charter of Fundamental Rights, and their national constitutional provisions.
When given the opportunity to take a clear stance in Glukhin v. Russia, the European Court of Human Rights did not determine whether facial recognition technology is irreconcilable with the right to privacy under Article 8 ECHR.Footnote 107 This avoidance was consistent with previous decisions in which the Court refrained from determining whether the processing of biometric data through FRT could ever be justified under the Convention.Footnote 108 Instead, the Court limited its reasoning to the specific question of whether the processing of the applicant’s personal data was justified under the right to privacy in the particular circumstances of the case.
One of the main normative objections to real-time remote identification by law enforcement is its intrinsic connection to mass surveillance practices.Footnote 109 For such technology to operate, it requires access to vast amounts of biometric personal data, images, videos, and CCTV footage. In other words, mass surveillance infrastructures are the very foundation upon which facial recognition technology rests. Consider, for example, that Mr. Glukhin was only found because hundreds of thousands of cameras are deployed across the streets of Moscow.
Yet, the term ‘mass surveillance’ obscures a crucial dimension of how these systems operate in practice. While surveillance infrastructure may cover extensive areas, its density and intensity vary significantly across urban spaces. This spatial selectivity means that some populations live under constant monitoring while others less often encounter it. The question of who will be most harshly affected by FRT deployment, thus, depends fundamentally on decisions about where to concentrate surveillance resources, decisions that often track existing patterns of suspicion and enforcement. These placement choices risk transforming formal surveillance capacity into targeted monitoring of already marginalized communities.
Given this reality, my primary objection from a normative standpoint to replicating in Brazil the exceptions for real-time remote biometric identification by law enforcement, as laid down in the EU AI Act, concerns the perpetuation and deepening of structural discrimination that such exceptions could entail if implemented. The Brazilian constitutional framework affords equality and non-discrimination the status of a fundamental right.Footnote 110 Yet, the social reality remains marked by structural inequalities that permeate institutions, including police practices.Footnote 111
According to the National Secretariat of Criminal Policies, Brazil’s prison population, in 2024, stood at nearly one million people.Footnote 112 While statistics on the ethnic origin of this population have limitations, largely due to reliance on self-declaration and incomplete statistics, studies estimate that approximately seventy percent of the prison population is non-white.Footnote 113 Other data show that in the municipality of São Paulo alone, the proportion of black people arrested was 8.7 per 100.000, compared to 3.5 for the non-black population.Footnote 114 Empirical research based on interviews reveals divergent explanations for these disparities.Footnote 115 From one perspective, police officers attribute these disparities to higher crime rates among black people, which they link to greater exposure to poverty and adverse living conditions. However, this same research points out that this explanation overlooks that, in this case, police-generated crime data inherently reflected enforcement priorities and deployment patterns focused on certain areas. These figures reflect the state of structural inequality within Brazil’s criminal system.
Here, I draw on Atrey’s concept of structural racism to define structural inequality.Footnote 116 Building on this concept, structural inequality refers to the systematic patterns of disadvantage that are embedded within the social, economic and political structures of a society. These inequalities do not result from individual actions or isolated incidents but arise from the organization of social systems, including laws and policies, that consistently disadvantage some groups in comparison to others.
As Atrey observes, racial states are not necessarily overtly racist states such as Nazi Germany or apartheid South Africa.Footnote 117 Rather, modern states, in the way they are imagined and ideated, the way they govern, and the way the effects of their governance are experienced, are implicated in producing and reproducing discriminatory outcomes.
In light of this reasoning, law is not a neutral entity. Like other tools at the disposal of the State, law too is implicated in reproducing or deepening discrimination. This can also be true in the implementation of real-time FRT used by law enforcement. The discriminatory effects of deploying FRT in law enforcement emerge from two compounding dimensions that include the technical characteristics of the systems themselves and, more fundamentally, the unequal policing structures within which they operate. While algorithmic bias and accuracy issues have garnered significant attention, the structural context of deployment proves equally, if not more, determinative of discriminatory outcomes.Footnote 118 When FRT systems are introduced into policing contexts already characterized by racially and socioeconomically unequal enforcement patterns, they risk amplifying and entrenching existing disparities through several mechanisms.
First, the targeted deployment of FRT may result in increased technological surveillance of already over-policed populations. This creates self-reinforcing feedback loops. In Brazil, where empirical research demonstrates that efforts to combat drug trafficking have led to considerably more policing of low-income areas, and where black individuals, especially young, poor black men living in peripheral neighbourhoods, are significantly more likely to be subjected to police approaches, the introduction of FRT threatens to scale and automate these existing patterns of racial disparity.
Second, determining the necessary level of accuracy for facial recognition systems is inherently challenging.Footnote 119 There are different possibilities to evaluate and assess accuracy, depending on the context of use. In any case, no matter how high the accuracy rate is, when applying the technology in places frequented by millions of people, such as public streets, even a relatively small error rate (e.g., 0.01 per cent) means that hundreds of people are wrongly flagged.Footnote 120 This is even more problematic when people with certain demographic traits are more likely to be put under scrutiny given their historical stigmatization based on socioeconomic status and other marginalized demographic characteristics or, as scholars note, those ‘who correspond to the imagined potential criminal – in the native language, the suspect type’.Footnote 121
One could argue that human police officers likely present worse levels of reliability when identifying individuals. The main difference, however, lies in two factors, namely scale and contestability. How many police officers are physically present in the streets to identify individuals? And how many of them could we challenge, question, or confront in real time? In addition, the supposed objectivity of AI may create a false sense of truth even when its outcomes are overseen by actual human beings.Footnote 122 When discrimination operates at scale, this false sense of truth becomes particularly dangerous. The Netherlands was confronted with precisely this issue in the SyRI case,Footnote 123 where an automated system disproportionately targeted vulnerable groups under the guise of objective risk assessment.
VI. Conclusions
This article has offered a critical lens through which to examine the regulation of FRT, by centring the right to non-discrimination as the primary analytical framework, rather than treating it as ancillary to privacy concerns. While existing scholarship and policy debates have extensively focused on FRT’s threats to privacy, personal data protection, and freedom of expression, this article points out that the discriminatory harms deserve special attention, particularly when FRT is deployed by law enforcement in contexts marked by structural inequality.
The article connects three analytical threads. The technical limitations and risks of FRT systems (even if algorithmic capabilities have substantially improved, they are not perfect), the structural inequalities embedded within law enforcement institutions, and the implications of uncritical legal transplantation in AI regulation. By bringing these elements together, the analysis reveals why even high technical accuracy standards become insufficient when applied at scale, in a context in which policing practices are racialized. For these reasons, uncritically implementing the range of exceptions for real-time remote identification by law enforcement can be problematic for non-discrimination rights.
The normative argument advanced in this article, that Brazil should adopt an unconditional prohibition on real-time remote biometric identification for law enforcement purposes, emerges from this multi-layered analysis. It represents a recognition that some technologies, when deployed within contexts of structural inequality, are fundamentally incompatible with constitutional guarantees of non-discrimination. The mass surveillance infrastructure required to make FRT operational cannot be rendered non-discriminatory through technical improvements or procedural safeguards when its very deployment reflects and reinforces existing patterns of racialized enforcement.
The unconditional ban argued in this article opens space for future research into alternative approaches to public safety that do not rely on mass surveillance infrastructure based on FRT. Such research would need to examine interventions that address safety concerns, taking into account how the deployment of such technologies interacts with the context of structural inequalities.
Acknowledgements
I would like to warmly thank Elora Fernandes and Abdullah Elbi for giving me their time and for reading and commenting on this paper. Any errors remain my own.
Competing interests
I have no conflicts of interest.
Open access
