Brazil ANPD pauses facial recognition in schools

Brazil’s ANPD has provisionally suspended facial recognition used to track attendance in public schools in Paraná and opened an administrative sanctioning process over a security incident that may have compromised personal and sensitive data belonging to about 500,000 patients. In both cases, the Brazilian authority kept the focus on biometric data processing and the protection of sensitive information.

What did the ANPD do about facial recognition in Paraná?

Brazil’s ANPD provisionally suspended facial recognition used to monitor attendance in public schools in Paraná and gave 10 business days to demonstrate compliance. The measure is tied to the processing of biometric data from children and teenagers in the state public school system, and the system cannot resume until the authority issues a new decision.

Secondary coverage of the case said the decision covered facial recognition use across Paraná’s state public school network, with a focus on public school students. The key point was not a final penalty, but a preventive suspension, along with a short deadline to show that the requirements set by the ANPD have been met.

Another report emphasized that the central issue was the processing of biometric data from children and teenagers. It also said the system could not return to operation until the ANPD makes a new ruling. That leaves the matter open, but with an immediate restriction on the attendance-control scheme.

What other sanctioning front did the ANPD open?

The ANPD opened an administrative sanctioning process over a security incident that may have compromised personal data and sensitive data belonging to about 500,000 patients. The material available in this window does not identify the responsible party or provide further details about the episode, but it does confirm that the authority has launched a formal sanctioning track.

At the same time, a legal newsletter reported that the ANPD opened an administrative sanctioning process over a security incident that may have compromised personal data and sensitive data belonging to about 500,000 patients. The material available in this window does not identify the responsible party or provide further details about the episode, but it does confirm that the authority has launched a formal sanctioning track.

Taken together, the two moves point to a recent ANPD agenda centered on sensitive data and biometric uses, especially when they involve minors or security incidents affecting a large number of records.

What signs of regulatory activity appear in the material?

One commercial source also said that in June 2026 the ANPD opened 19 sanctioning cases, and that the violations observed were concentrated on the failure to appoint a data protection officer and the lack of a data subject contact channel. That information appears in the material as unverified, so it should be read as an attribution to that source rather than as an official confirmation.

In the same period, the available sources include references to the LGPD, the review of the Dosimetry Regulation to align it with the Digital ECA and the Marco Civil da Internet, and rules on data protection that are still under discussion. This part of the material does not show a new confirmed enforcement action by the ANPD, but it does point to a sequence of regulatory moves and debates that keep Brazil’s data protection agenda active.