LGPD and biometrics in condominiums: what building managers need to know

Why biometric data is different

Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018), known as the LGPD, classifies biometric data, among other types, as sensitive personal data. A photo used for facial recognition falls into this category when it serves to identify the person, which is exactly what the terminal does at the door.

Sensitive data comes with stricter rules. The legal grounds that allow it to be processed are narrower, and a leak has more serious consequences for the people exposed: a leaked password can be changed, a face can't. In practice, that means treating face records with more care than a phone list: keeping only what's necessary, protecting it well and being able to explain what it's for.

Who's who: controller and processor

The LGPD distinguishes whoever decides about the data from whoever processes it on someone else's behalf. The controller makes the decisions: what to collect, for what purpose and for how long. The processor handles the data following the controller's instructions.

In access control, the condominium is usually the controller of the data of residents, staff members and visitors, and the company that provides the system usually acts as the processor. This split should be spelled out in the contract, along with each party's responsibilities for security, for incidents and for what happens to the data when the contract ends.

The law also provides for the encarregado (roughly, a data protection officer): the person who serves as the point of contact for data subjects and for the ANPD, Brazil's National Data Protection Authority. It's worth checking with your legal advisers whether and how this requirement applies to your condominium.

Legal basis: why the condominium may process this data

Any processing of personal data needs a legal basis. For sensitive data, the options are set out in Article 11 of the LGPD. They include the data subject's consent, given in a specific and highlighted manner, and ensuring fraud prevention and the data subject's safety in identification and authentication processes for registration in electronic systems.

Which basis to rely on in your condominium is a decision to make with legal guidance and to record in writing. One practical precaution is usually recommended in any scenario: offer an alternative to anyone who doesn't want to enroll their face, such as a card or a PIN, when the equipment allows it.

Keep only what's necessary, and only for as long as necessary

Some LGPD principles become very concrete rules in the day-to-day life of the front desk:

• Purpose: the face is there to unlock the door, not for other uses that residents weren't told about.
• Necessity: enroll only the data that access control needs to work.
• Retention: anyone who has moved out or no longer works at the condominium should be removed from the system and from the terminals. Visitors shouldn't stay enrolled after their visit.
• Security: protected photos and credentials, system access with individual usernames and passwords, and permissions that match each person's role.
• Accountability: knowing who viewed or changed the data, and when.

Put in writing, ideally with the board's approval, how long the access history is kept and who can look at it. A simple rule that everyone knows is worth more than a long policy nobody reads.

Residents' rights

Data subjects have rights guaranteed by Article 18 of the LGPD, such as confirming whether their data is being processed, accessing their own data, correcting anything that is wrong and requesting deletion when the law allows it. The condominium needs a simple way to receive and answer these requests, and the system it chooses should make it easy to find, correct or remove a person's record.

Transparency counts too. A visible notice at the entrance and a message to residents explaining what is collected, for what purpose, who has access and for how long head off mistrust and tough questions at the owners' meeting.

Questions to ask the vendor

Before you sign, ask for written answers on these points:

• Where are the records, photos and access history stored?
• Is the biometric data encrypted? What about the backups?
• Who inside the company can see the condominium's data, and in what situations?
• Is there a log of who changed records and who opened doors through the system?
• How can the data be exported or returned if the contract ends?

How Abriu handles it

At Abriu, the records, photos and access history are kept on the Abriu hub installed in the condominium itself, not on a server shared with other customers. Photos, fingerprints and terminal PINs are stored encrypted, and the backup leaves the condominium already encrypted. Our monitoring center receives only health indicators and counts, never names, photos or documents.

In the dashboard, each user has permissions by area, deactivating a user cuts off their access immediately, and sensitive actions, such as opening doors or changing photos and fingerprints, go into the audit trail. Anyone who is deactivated or deleted is removed from the terminals, invitations expire on their own and the backup can be downloaded from the dashboard. Decisions about legal basis, retention and notices remain with the condominium, as the controller; Abriu processes the data on its behalf.