São Paulo subway operator gets sued for collecting passenger data

Gathering data on public transport users is illegal as it's unauthorized and people have no choice in the matter, says local consumer rights institute.

The Brazilian Institute of Consumer Protection (IDEC) has launched a civil lawsuit against São Paulo subway operator ViaQuatro around the collection of passenger data.

The marketing technology launched in April consists of four sets of doors with screens where customer information is displayed as well as advertisements, with sensors collecting data on passengers standing in front of the doors such as emotions, approximate age and gender.

History repeating: How the Internet of Things is failing to learn the security lessons of the past

The massive cyberattacks which took down some of the most popular websites on the internet show that device manufacturers are not learning from the mistakes of the past.

Read More

In the civil lawsuit, it is argued that the initiative is illegal, given that public transport users did not authorize the collection of data - and had no choice in the matter, given the sensors are placed on the train doors.

"The case is of overwhelming magnitude. Users have no right to choose: either they accept the collection of their data, or they have to look for another way of getting around in the city," says IDEC lawyer and digital rights expert, Rafael Zanatta.

Zanatta adds the initiative is abusive, since public transport is an essential service and also violates the Constitution in addition to various federal laws.

IDEC is calling for the immediate removal of the equipment and a halt in the data collection activities, as well as 100 million reais ($24 million) in damages to the public. If ViaQuatro is proven guilty, the money will go towards a fund run by the Ministry of Justice that concentrates resources from public lawsuits linked to purposes including defense of consumer rights.

The Institute plans on using the cash in educational projects related to consumer rights under the new Data Protection Law, which will be enforced in Brazil in 2020.