Facial recognition in residential buildings: technology with responsibility
Facial recognition makes access control easier — and calls for proportionate care. Good practices on purpose, transparency, retention and security.
Facial recognition has arrived at the front desk. In many residential buildings and companies, it replaces cards and key fobs, shortens queues and makes access simpler for the people who live or work there. It is a useful technology — and, precisely because it deals with people’s data, it calls for care in proportion to the benefit it brings.
This article brings together general good practices for anyone implementing or reviewing a facial recognition access system. It is not a legal roadmap: it is a starting point for a well-informed conversation.
Why biometric data deserves special attention
Brazil’s General Personal Data Protection Law — LGPD, Law No. 13,709/2018 (Lei nº 13.709/2018) — classifies biometric data, when linked to a natural person, as sensitive personal data (art. 5, item II). This does not mean the technology is prohibited, but it does indicate that processing this kind of data should be planned with greater care. More broadly, images and registration records are personal data when they identify, or make it possible to identify, a natural person (art. 5, item I).
Brazil’s data protection authority (ANPD) has run a call for input on biometric data (in Portuguese); according to the official source, specific rules are still being drafted.
It is important to say this clearly: the legal basis and the applicable rules depend on each case — the type of environment, who the data subjects are, how the system was designed — and should be defined with legal advice. What follows are common-sense practices that usually accompany well-run projects.
Good practices for a responsible project
1. A clear purpose
Before choosing equipment, define what facial recognition will be used for. Access control to common areas? Staff entry? A well-described purpose guides every other decision — and helps prevent the data from being used for something other than what was agreed.
2. Informing data subjects
Residents, staff and visitors should know that the system exists, what it is for, who is responsible for it and how they can ask questions. Notices, on-site signage and easily accessible documents serve this purpose. Transparency also tends to reduce resistance.
3. Controlled access to the enrollment database
The database of enrolled people should not be open to just anyone. Define who can add, change, view and delete records — and limit these permissions to the minimum the operation needs.
4. Defined retention and disposal
Data should not be kept “forever, just in case”. Set how long each piece of information is kept — for example, what happens to the record of a resident who has moved out or a contractor whose engagement has ended — and how it is disposed of.
5. Logs and audit
A good system records who did what: enrollments, changes, look-ups and deletions. These records make it possible to review how the system works, answer questions and fix problems based on facts.
6. Contracts that define roles
A facial recognition project usually involves several parties — the building or company, the property manager, the technology provider, the monitoring provider. The LGPD works with the roles of controller and processor (controlador and operador; art. 5, items VI and VII), and contracts should make clear who takes on each role and what each party is responsible for.
7. Information security
Encryption, up-to-date equipment, strong passwords, network segmentation and backups are not details. An access system is also an information system, and it deserves the same care.
Technology and trust go together
None of these practices prevents the adoption of facial recognition. On the contrary: they tend to make the project more robust, easier to explain at a residents’ meeting and simpler to maintain over time. Technology works best when people trust it.
At CIA, we treat privacy and regulatory alignment as part of the project from the very start, within an ongoing alignment program. You will find more on this topic on our Compliance page.
Notice. This content is informational and does not constitute a legal opinion. The legal basis, retention periods and rules for each project should be defined with legal advice.
If your building or company is considering facial recognition and you would like to discuss the project design, get in touch with our team.