The practical message for IT administrators is unusually clear. A regulator has treated an attendance system as a full biometric data-processing chain, rather than a simple mobile application feature. Paraná must show that the shutdown reaches the schools, its applications and databases, and every outside operator involved. The ANPD’s decision, signed on August 4 and published on August 6, gives the state 10 business days from notification to document compliance. The public decision does not state when Paraná was formally notified or whether it has submitted that proof.
SC Media summarized the suspension on August 20, while the ANPD’s published decision and technical analysis supply a fuller picture: this was not a ruling that facial recognition is categorically forbidden in Brazilian schools. It was a finding that Paraná failed to establish a valid legal basis, necessity, proportionality, effective safeguards, and a child-first justification for processing biometric identifiers at this scale.
The Shutdown Includes the Entire Data Path
ANPD’s Despacho Decisório No. 2/2026/SFI requires Paraná’s State Secretariat of Education, known as SEED/PR, to stop facial-recognition processing for attendance under the state’s 2023 biometric-attendance resolution. Crucially, the regulator explicitly says the suspension applies regardless of the technology environment or infrastructure used.
That wording matters. An organization cannot comply merely by disabling the recognition button in Escola Paraná Biometria, Escola Paraná Professores, or the browser-based Registro de Classe Online system. The order requires Paraná to account for affected systems and applications, biometric databases, their locations and custodians, the measures preventing further processing, the date and time recognition functions were disabled, the schools covered, and the operators and suboperators told to stop.
The state also must provide formal communications instructing those outside parties to suspend processing, preferably with confirmations that they received and complied with the order. This is the basic evidence trail many organizations discover they lack only after a regulator asks for it: a vendor-management record connecting contract clauses, access revocations, application changes, cloud controls, data-store status, and verification.
The decision does not order immediate deletion of biometric records. It calls for documentation of the relevant databases and the applicable preservation or blocking regime. That distinction is significant. Shutting down future processing and deciding whether existing sensitive data can be retained, blocked, or must eventually be erased are separate governance questions. Paraná’s task now is to demonstrate a complete operational freeze, not simply assert that the cameras have stopped.
A Million-Student Deployment Without a Sufficient Case
The scale of the program made ANPD’s scrutiny harder to dismiss as a narrow dispute over a single school or opt-in trial. In its technical note, the authority says Paraná reported that the operation covered 2,136 educational institutions, roughly one million students in basic education, and more than 100,000 workers in 2021. It also noted that the state did not provide current figures for 2023 or later, nor adequately explain the transition from pilot activity to the operating model under review.
Paraná’s own 2023 resolution required schools to enroll students through the Escola Paraná Biometria application and directed attendance to be registered using biometric facial recognition. State technology company Celepar had promoted the system as an efficiency measure, saying a teacher could photograph a class and receive an attendance list much faster than by taking roll manually.
But the ANPD found that speed alone did not demonstrate that collecting sensitive biometric data from minors was necessary. According to the technical note, SEED/PR argued that the system supported education management, attendance accuracy, public policy, and protection of children and adolescents. The authority concluded that these explanations did not establish the required legal ground for sensitive-data processing, and that the state had cited provisions that either did not apply or did not independently authorize the processing.
In particular, the ANPD found that the special child-protection provision in Brazil’s General Data Protection Law is not a standalone authorization to collect biometric data. It adds a higher threshold: any processing must first rest on an appropriate legal basis and must demonstrably serve the child’s best interests.
That is more than a technical legal distinction. In deployments involving minors, a government agency cannot turn “we believe this is useful” into “we are authorized to collect a permanent identifier.” The regulator found that Paraná had not completed that bridge.
Attendance Photos Created a Broader Biometric System
The public discussion of the program often used the benign language of automated roll call. The regulator’s record shows why that framing was incomplete.
SEED/PR told ANPD that each student was enrolled using three photographs and that attendance involved daily classroom images captured by teachers. Celepar could access student enrollment identifiers, attendance information, individual photos, classroom images, and school and class details. ANPD’s note also identifies Valid as a contracted processor with access to individual student images, the enrollment code in Paraná’s education registry, and class-attendance data.
Earlier reporting by Núcleo Jornalismo and Investigate Europe identified the technology supplier behind Valid’s offering as Slovak facial-recognition company Innovatrics. Their investigation reported that classroom images were sent for cloud processing, where faces were detected and compared against biometric profiles. Innovatrics’ own published case material describes cloud-based processing for Paraná’s project.
The ANPD did not base its suspension on the nationality of the vendor or the mere use of cloud infrastructure. Its criticism was more fundamental: Paraná had not demonstrated effective controls over access and sharing, vendor oversight, algorithm reliability and non-discrimination, security measures, or a meaningful assessment of less invasive alternatives.
For organizations using identity technology, that is the important precedent. Encryption, a government data center, and a contracted provider may all be relevant controls, but none of them establishes necessity. Security controls answer whether a system is protected; proportionality asks whether it should collect that category of data in the first place.
The Retention Problem Was Hiding in Plain Sight
ANPD also questioned the state’s stated retention policy. Paraná told the authority that biometric data could remain stored while a student remained enrolled in the state network. The technical note points out that compulsory education in Brazil can span 14 years, from ages four through 17.
The authority’s conclusion was direct: retaining academic records may be necessary for legal and institutional purposes, but retaining biometric data for the duration of a child’s schooling creates a separate and potentially unnecessary rights risk. A face template or a persistent biometric profile is not interchangeable with an attendance entry in an electronic gradebook.
This is a familiar systems-design failure. Programs often define a deletion schedule around the lifecycle of the application or the customer relationship, rather than the minimum period required for each data type. In a school setting, the difference between retaining a historical attendance record and retaining the data needed to recognize a student’s face should have been central to the design review.
The technical note also found problems with transparency. Paraná reportedly asked parents or guardians to sign a consent form while asserting other legal grounds for the processing. ANPD said that approach risked misleading families by blurring the difference between consent, notice, and the government’s claimed authority to process sensitive data. A consent screen does not repair an invalid processing rationale, especially where attendance procedures make refusal difficult in practice.
The Efficiency Claim Was Never Properly Verified
Paraná had promoted facial attendance as a way to recover classroom time. Celepar claimed the system could reduce roll call to roughly 30 seconds and free meaningful instructional time across the school year. That was the program’s central operational benefit.
ANPD found that SEED/PR had not supplied evidence from post-deployment studies showing that the promised benefit had actually materialized. The regulator said the state relied on the objective of reducing time spent on attendance without demonstrating that the objective was achieved after implementation.
That gap is especially damaging because manual attendance remained available under the 2023 resolution for connectivity failures and technical exceptions. The state therefore had a known fallback workflow, and the regulator concluded that less intrusive alternatives existed for the stated purpose.
Investigate Europe and Núcleo Jornalismo had reported a similar practical issue before the ANPD decision. Their investigation cited interviews with teachers who described recognition errors and delays, as well as a 2025 academic evaluation that reportedly measured average accuracy below the procurement target and attendance checks taking longer than the state’s advertised 30 seconds. Those observations do not alone decide the legal case, but they cut directly against the claim that invasive biometric processing was indispensable for routine attendance.
What Paraná Must Prove Now
The suspension is a preventive measure, and ANPD’s decision allows Paraná to appeal within 10 business days after notification. The authority has also sent the case for review by its sanctions unit, which will assess whether to open an administrative sanction proceeding, and directed that the technical analysis be forwarded to Paraná’s public prosecutor.
For the immediate response, Paraná needs to produce evidence, not a policy statement:
- The state must identify every facial-recognition function that has been disabled, with the date and time of deactivation.
- The state must map the biometric data stores, their custodians, and controls preventing collection, lookup, matching, sharing, or other continuing use.
- The state must show that schools, internal IT teams, Celepar, Valid, and any other downstream providers have received and implemented suspension instructions.
- The state must establish how attendance will be recorded without returning to biometric processing.
The episode is a warning for school districts, employers, healthcare organizations, and enterprise IT teams evaluating face-based authentication or monitoring. A vendor’s accuracy score, a cloud architecture diagram, and an efficiency projection do not substitute for a lawful purpose, documented necessity, limited retention, tested alternatives, and an auditable stop mechanism.
Paraná’s facial-attendance system now faces exactly the test it should have been designed to survive: whether its operators can prove that one million children’s biometric data has actually stopped moving through every system in the chain.