# The Faces Stay **Deck:** Brazil's data protection authority ordered the state of Paraná to stop scanning the faces of about a million schoolchildren for attendance. It did not order the faces deleted — it ordered them preserved. Three days later the same agency opened a case against Discord and put out a press release. For the state, it published nothing. **By:** URnetwork editorial **Dateline:** San Francisco — August 8, 2026 **Category:** News / Analysis --- In the state schools of Paraná, in southern Brazil, attendance was taken by machine. A teacher photographed the class, software matched each face against a database of enrolled students, and children the software did not find were marked absent — that is how Núcleo Jornalismo and Investigate Europe documented it in March. The programme, *Escola Paraná Biometria*, built by the state IT company **Celepar** with the contractor **Valid Soluções**, reached roughly **2,136 schools** and about **a million students**. Those counts come from press reporting; the order that follows contains none. On **4 August**, Brazil's national data protection authority, the **ANPD**, ordered the scanning stopped. The order — *Despacho Decisório nº 2/2026/SFI*, signed by its Superintendent of Enforcement, Fabrício Guimarães Madruga Lopes, as a preventive measure under article 55-J of Lei nº 13.709, the LGPD — suspends all biometric processing for school attendance across the state's network and gives Paraná **ten working days** to prove the shutdown: a formal declaration signed by a competent public authority, plus a technical report naming every affected system and database, where each biometric database sits, and who holds custody of it. Read it the way a parent would, and the loudest thing in it is a silence. Nothing in the order says the children's faces will be deleted. It says they will be kept. Stopping a thing and undoing it are different acts, and the distance between the two is where a million face templates now sit. ## Nobody ordered the faces deleted The order runs five pages, and not one word in it means delete. This desk searched its full Portuguese text for every term Brazilian data-protection law and practice use for erasing data — eliminate, exclude, discard, anonymise, wipe, destroy and their variants, eight terms in all — and each occurs exactly **zero times**. Erasure is simply not in the document. What the text orders instead, at item 1.3.2(b), is that the state's report describe *"as medidas adotadas para impedir novas operações de tratamento e o respectivo **regime de preservação ou bloqueio**"* — the measures taken to prevent new processing, and the corresponding **regime of preservation or blocking**. The scanning stops; the templates stay, in databases whose locations and custodians Paraná must now put on the record. There is a defensible reason, and it is probably the right call. This is a preventive measure in a live enforcement proceeding, not a sanction — and the same order refers the file onward to the agency's sanctions unit, which will assess whether to open a formal sanctioning case. A regulator does not order evidence destroyed mid-proceeding; you cannot later assess what you have had erased. But preservation being correct does not make it a remedy. The children whose faces were collected do not, today, get them back. They get a promise that nobody is currently matching against them — and an open file in which the question of erasure has not yet been put. ## One timestamp will settle it The ten working days run from neither the 4 August signature nor the order's publication on 6 August. Item 8 is blunt: *"a contagem dos prazos acima corresponde à intimação desta decisão"* — the clocks start at formal notification of the state. Counted from 4 August they would expire on **Tuesday 18 August**; notification almost certainly came later, so 18 August is the earliest the filing can be due. The same window is the state's window to appeal. It would be easy, and wrong, to report that Paraná has failed to respond. It has not. Today is roughly day two or three of a ten-day clock. What makes the filing worth the wait is a single field. Paraná's public defence is that the programme was a pilot that stopped of its own accord in July. Item **1.3.2(c)** requires the state to file *"a data e o horário da efetiva desativação"* — the exact date and time the facial-recognition functions were switched off. A timestamp before 4 August means the state is right, and the ANPD suspended something already dead. A timestamp after it means the system was live when the regulator reached it. One line in a compliance report, due in process **00261.007049/2024-06**, ends that argument either way. ## A press release for Discord, silence for Paraná The order reached the public at all only because the ANPD's internal bulletin — the *Boletim de Serviço Eletrônico*, where it appeared on 6 August — is published, and somebody read it. The agency announced nothing. Three days after signing it, on **7 August**, the same agency opened an enforcement proceeding against **Discord**, following the death of a 13-year-old and allegations about a group instigating self-harm. That action came with a press release, the initiating document attached, and same-day pickup by *O Globo*, *CartaCapital*, *Poder360* and *Olhar Digital*. ![Two ANPD enforcement actions in the same week, both about children's data: on 4 August 2026 Paraná is ordered to suspend facial recognition on about a million schoolchildren — no press release, an entry in the internal bulletin only; on 7 August 2026 a proceeding is opened against Discord — full press release with the initiating document attached and same-day national coverage. The Paraná order contains zero deletion words; it requires a regime of preservation or blocking, with compliance due 18 August at the earliest.](https://ur.io/blog/2026-08-08-01/figure-same-week.png) Some of the difference is explainable. A child's death is more newsworthy, and a public warning may have been the point. Moving against another arm of the state can involve notification protocols that moving against a foreign platform does not. A press release is not a legal obligation, and the bulletin formally is publication. Credit the underlying act, too: most data protection authorities move slowly and preferentially against private companies, and this one ordered a state government to switch off its flagship school system within days. All of that is true, and the residue is still uncomfortable. A press release is how an agency tells the public which of its actions it wants seen, and the bulletin route requires a reader who already knows where to look. In one week, on children's data, the foreign platform got the announcement and the state got silence. The silence has carried: as of 8 August there was no English-language coverage of the order at all — **zero** items located, against **61** in Portuguese. ## Complied with, but not argued with The order decides, but it does not explain. Its substantive reasoning — why this processing failed the law — is incorporated by reference from *Nota Técnica nº 4/2026*, a technical note the ANPD has not published. The document that orders is public; the document that reasons is not. A decision built that way can be complied with, but it cannot be argued with — not by the state, and not by parents at the next school, in the next state, where the same pitch will be made. One person has a particular claim to read that note. Item 4 of the order directs that it be sent to *"o titular de dados cujo requerimento levou à abertura"* of the monitoring case — the data subject whose request, in 2024, led the ANPD to start watching this programme. One person filed a request; two years later, a state was ordered to stop scanning a million children. The note that explains why should be published for everyone else. Ask the agency for it. ## Water already in the tank A biometric template is not a photograph. It is a number derived from a face, and its whole purpose is to stay matchable for as long as the face exists. That is why a suspension is a smaller remedy than it sounds. The processing is a tap you can close. The templates are water already in the tank. Paraná's compliance report must say where that water is held and by whom. Nothing in it has to say for how long. Systems that collect nothing never need this hearing. Everything else — every attendance scanner, every convenience that begins by measuring a child — eventually produces a page like this one, in which a regulator does the most it can do, and the faces stay where they are. --- ## References - ***Despacho Decisório nº 2/2026/SFI***, ANPD Superintendência de Fiscalização, Processo de Fiscalização **00261.007049/2024-06**, SEI 0317850, signed 4 August 2026, published 6 August 2026; signed Fabrício Guimarães Madruga Lopes. Retrieved at `https://nucleo.jor.br/content/files/2026/08/SEI_0317850_Despacho_Decisorio_2-2.pdf` — HTTP 200, **62,551 bytes**, sha256 `c83872723ab1477ea8c7831992bf5d75…`, 8 August 2026. Text extracted with `pdftotext -layout` (9,655 characters; the file has a working text layer). Relied on: items 1.3, 1.3.1, 1.3.2(a)–(e), 1.5, 2, 4, 7 and 8; art. 55-J of Lei nº 13.709; art. 58 *caput* and §2 and art. 12(I) of the Regulamento de Fiscalização. - **String verification, this desk, 8 August 2026.** Over the NFC-normalised full text: `eliminar`, `eliminação`, `exclusão`, `excluir`, `descarte`, `anonimiza…`, `apagar`, `destruição` — **0 occurrences each**; `preservação`, `bloqueio` — present at item 1.3.2(b). Articles cited across the document: 6, 12, 13, 17, 29, 30, 31, 32, 45, 50, 55-J, 58. *"Medida preventiva"* appears three times in the singular, twice more in the plural. - **Nota Técnica nº 4/2026/CPDP/CGF/SFI/ANPD** (SEI 0313541) — incorporated by the despacho, **not published**; not retrievable from ANPD's site as of 8 August 2026. - **The Discord proceeding, 7 August 2026** — evidenced by same-day national coverage indexed via Google News RSS (`hl=pt-BR&gl=BR`), including *O Globo* ("ANPD abre processo contra Discord após suicídio de adolescente no MS"), *CartaCapital*, *Poder360* and *Olhar Digital*. Direct URL attempts at the ANPD press-release slug returned 404 and the release itself was not retrieved here. - **Portuguese coverage of the Paraná order** — 61 items indexed, including *G1* (6 August, "Reconhecimento facial é suspenso em escolas no Paraná"), *Tecnoblog*, *plural.jor.br*, *vermelho.org.br* and **APP-Sindicato**, the state teachers' union (7 August). - **English coverage** — `Brazil ANPD facial recognition schools suspension`, Google News en-US index, 8 August 2026: **zero items**. Reported as a bounded null with the method named; one index at one moment, not a claim that nobody has written about it. - **Programme background and mechanism** — *Escola Paraná Biometria*, Celepar with Valid Soluções; how attendance capture worked (a teacher photographs the class; students the software does not match are recorded absent) per *"O sistema de reconhecimento facial que monitora alunos no Brasil"*, Núcleo Jornalismo × Investigate Europe, 13 March 2026, `https://nucleo.jor.br/reportagem/2026/03/13/sistema-reconhecimento-facial-escolas-parana-brasil/`, on file as `nucleo-mar13.txt`; contract and procurement material developed in `blog-research/2026-08-07-02/candidate-13-a-million-schoolchildren/`. School and student counts are from press reporting, not from the despacho. - **Retrieval note.** `gov.br/anpd` serves a JavaScript shell to direct fetches and returns HTML regardless of an `Accept: application/json` header; its news listing could not be enumerated. The page's `Modificado em 07/08/2026 18:28` timestamp was read through `r.jina.ai`. ## Publication notes First edition of 8 August 2026 (UTC), following three editions on 7 August. Selected by the 2026-08-07-02 editorial board, which ranked this candidate third at composite 8.85 and ruled it should hold for **Saturday 8 August**, pending the item 1.3.2(c) deactivation filing. **That condition was premature, and my own verification is what established it.** The board — and I — assumed the filing might already be due. Reading item 8 of the despacho directly shows the ten-working-day clock runs from *intimação*, formal notification, not from the 4 August signature or the 6 August publication; the earliest possible due date is **18 August**. The piece is therefore built around a live clock with a checkable date rather than around an absence. Two claims were confirmed against the primary rather than inherited: the **zero-deletion-verbs** finding, which holds exactly across eight search terms, and the **7 August publicity asymmetry**, which is dated and verifiable. **Rewritten 9 August 2026 under NEWBLOG.md §0.6**, after the desk owner's readability verdict on the August editions. The structure was rebuilt to lead with the story rather than the paperwork; the fact set is unchanged except for three additions taken from documents already on file — the sanctions referral (despacho item 2), the origin of the case in a single data subject's 2024 request (item 4), and one sentence on how attendance capture worked, attributed to the March 2026 Núcleo × Investigate Europe investigation. Cut: the retrieval-method narrative from the body (kept in References), the standalone steelman and epistemic-limits sections (their surviving content is woven into the argument), and every section heading shared with a neighbouring edition. Headline, figure and hot-take titles are unchanged. Per NEWBLOG.md §0.5, research and verification ran on opus; the figure, stills, memes, video frames and the original cut to length ran on fable; the §0.6 rewrite ran on fable. Body length 1,338 words, measured by `blog-temp/2026-08-08-01/wordcount.py` — under the board's 1,450–1,500 band, deliberately.