Contributors: Janaina Costa, Teresa Perosa
Organization: International Union for the Scientific Study of Population, Surveillance Resistance Lab
Last update:
Chapeau
Brazil has a new Digital ID framework which has the goal to be fully rolled out by 2032. It currently is in 12 states and citizens can either downloaded on GOV.BR or receive a physical copy. This card is for citizenship and contains biometric information. When legislation was being passed there was very little civil society and civilian participation with only one group speaking a singular time. According to Decree 10,977/2022, the CIN is valid throughout the national territory and constitutes a valid identity document for all legal purposes. Data subjects have a range of rights, including the right to access, correct, and delete their data, among others. Individuals can exercise these rights directly with the organization (data controller) that is processing their data. Data subjects can also seek judicial remedies if they believe their rights have been infringed upon. Brazil’s Constitution and other legal statutes protect the right to privacy, which could provide avenues for legal recourse in cases related to digital ID and data protection violations.
1.1 Which are the specific laws creating and regulating Digital ID and what is their hierarchy (constitutional, organic laws, regional/sub-state laws, regulations, procedures)?
- Brazil’s Information Map – How do Government stores and process citizen’s identification information
- LAW No. 7,116/1983. – Ensures national validity of Identity Documents (Carteiras de Identidade), regulates their issuance and provides other measures. It is the foundational legislation that Decree 10,977 came to regulate with the adoption of the new digital standard made possible by the law that creates the National Civil Identification System.
- LAW No. 13,444/2017 – Provides for the National Civil Identification System (ICN or Identificação Civil Nacional) and creates the National Identity Document (DNI or Documento Nacional de Identidade) .
- Decree Nº 9.278/2018 – This Decree contained multiple drafting and procedural errors and therefore the states of the federation were having difficulty implementing it. It was revoked and replaced by Decree 10,977/2022. The latter, in turn, regulates the new identity card but makes no mention of the other DNI initiative
- Decree No. 10,332/2020 – Establishes the Digital Government Strategy, whose original period of validity (2020-2022) was extended until 2023 by Decree 11,260/2022, provides that the objectives to be achieved through the Digital Government Strategy include making digital identification available for citizens.
- LAW No. 14,063, OF SEPTEMBER 23, 2020 – Provides for the use of electronic signatures in interactions with public entities, in acts of legal entities and in health matters and on software licenses developed by public entities;
- Decree nº 10.900/2021 – Provides for the “Citizen Identification Service (SIC) and the governance of the identification of natural persons within the scope of direct, autonomous and foundational federal public administration”
- Law No. 14,129/2021– Provides principles, rules and instruments for Digital Government and increasing public efficiency. Article 28 stipulates that the CPF (individual taxpayer registry) serves as the primary identifier for citizens in public service databases, with all registration and updates being free. The CPF number is required on various official documents and databases, like birth certificates, identity documents, and driver’s licenses. The number’s inclusion is contingent upon institutions accessing and validating it with the database overseen by the Special Secretariat of the Federal Revenue of Brazil. If someone doesn’t have a CPF when applying for an identity card, they’ll be registered if the processing agency interfaces with this central database.
- DECREE No. 10,977/2022 – Regulates Law No. 7,116/1983, to establish the procedures and requirements for issuing the Identity Card by identification bodies of the states and the Federal District, and Law No. 9,454/1997 , to establish the Citizen Identification Service as the National Civil Identification Registration System. Introduces the National Identity Document (CIN or Carteira de Identidade Nacional) launched by the Federal Government by giving a new format to the identity document created by Law No. 7,116/1983. States that the CIN will have a digital credential and features (as per showcased at the end of this text), to be issued in the same process of identification and generated after delivery of the document in physical format. Because it provides for a digital credential, it is considered a digital identity.
- DECREE Nº 11.430/2023 – Amends Decree No. 10,900/2021, to update the bodies that operate in the Citizen Identification Service, and Decree No. 10,977/2022, to extend the deadline for adapting to the new CNI standard from 06th of April 2023 to the 9th of November 2023.
- Law No. 14,534/2023 – Amends Laws No. 7,116/1983, 9,454 /1997, 13,444/2017, and 13,460/2017, to adopt a single number for the documents it specifies and to establish the Individual Taxpayer Registry (CPF) as the unique identifier number to identify citizens in public service databases.
1.2 What is the definition of Digital Identity brought by the Law or regulation, if any?
There is no definition of digital identity brought by law or regulation at this point. However, the decree nº 10,977/2022, that regulates the new National Identity Document (CIN or Carteira de Identidade Nacional) launched by the Federal Government by giving a new format to the identity card created by Law No. 7,116/1983, states that the CIN will have a digital credential and features (as per showcased at the end of this text), to be issued in the same process of identification and generated after delivery of the document in physical format. Because it provides for a digital credential, it is considered a digital identity.
1.3 Which are the corresponding Data Protection laws, if existing?
LAW No. 13,709/2018 ( Brazilian data protection law – LGPD)
For more details about the Brazilian data protection law approval context, see: https://www.observatorioprivacidade.com.br/en/memory/.
For an English version of Brazilian General Data Protection Law: https://iapp.org/resources/article/brazilian-data–protection-law-lgpd-english-translation/.
1.4 What are the main elements of the Digital ID framework (scope, eligibility criteria, remedies)?
According to Decree 10,977/2022, the CIN is valid throughout the national territory and constitutes a valid identity document for all legal purposes. Are eligible to obtain the CIN: i) all native Brazilians (birth or marriage certificate in physical or digital format required); naturalized Brazilians (an officially recognized naturalization certificate is required); as well as Portuguese people with permanent residence in the country (they will prove their condition by presenting the officially recognized act of granting equality of civil rights and obligations, with or without enjoyment of the rights politicians in the country). The renewal process ensures the update of the cardholder’s registered and biometric data. When renewing, it’s seen as a continuation of the initial issuance of the document. Additionally, if the CNI can be reissued due to changes or additions in the biographical or biometric data at the request of the cardholder, being treated as a second copy of the document.
1.5 Are there specific complaint mechanisms foreseen in the Digital ID and Data Protection laws?
The LGPD provides data subjects with a range of rights, including the right to access, correct, and delete their data, among others. Individuals can exercise these rights directly with the organization (data controller) that is processing their data. Data subjects can also seek judicial remedies if they believe their rights have been infringed upon. Brazil’s Constitution and other legal statutes protect the right to privacy, which could provide avenues for legal recourse in cases related to digital ID and data protection violations.
1.6 Was public participation ensured when these were drafted and enacted? How?
During the draft bill n. 1,775 from 2015 discussion process, that led to the approval and enactment of Law 13,444 from 2017, several public hearings were held by the Chamber of Deputies. The public participation in those hearings was very homogeneous, if we consider that almost all of the participants were linked to the public sector—most of them representatives of the Legislative Branch. Civil society’s participation in these debates was not expressive, as only one civil society representative spoke during the course of all public hearings.
The new National Identity Card (CIN) was debated on August 30, 2023 in a public hearing in the Chamber of Deputies. The guest list included members of the government and civil servants but only one civil society organization, the InterID.
1.7 Was there a Human Rights Impact Assessment prior to the enactment of the laws?
No.
1.8 Does the country’s Digital ID framework reflect any particular digital ID model existing elsewhere (e.g., similar/comparable to X country)?
The electronic signature law follows the European standard of three security levels (simple, advanced and qualified signature). I’m not sure about the DID framework.
1.9 What is the interrelation of these Digital ID laws with existing nationality laws (does Digital ID reflect nationality status, is nationality an eligibility criterion or only legal residence)?)
Foreigners can register within the CPF register, which is the only unique identifier number elected by the Law nº 13, 444/2017. However, they cannot obtain the CNI, but another type of document: the National Migration Registration Card (CRNM)
1.10 Court cases: Is there litigation going on? Has there been prior litigation? What are the specifics of those cases (list and summarize)?
Not that I’m aware of.
1.11 How has Digital ID been rolled out?
It has been slowly adopted but seems to be gaining momentum since the 2023 second semester. By August 2023, the document was issued in only 12 of the 27 Federation Units (26 states and the Federal District).The federal government’s goal is for all entities in the federation to be able to issue the CIN by November 2023, as established by Decree 10,977/22, which regulates Law 7,116 /83. By August 2023 around 1.5 million CINs had been issued.[1] In April 2023, this number was 460 thousand physical CINs issued, and more than 330 thousand downloaded from GOV.BR.[2]
The DNI project is still ongoing but its adoption is uncertain now that the CIN initiative has been gaining more momentum.
[1] “Audiência Pública Debate Implantação Da Nova Carteira de Identidade Nacional.” Ministério da Gestão e da Inovação em Serviços Públicos. Accessed September 14, 2023. https://www.gov.br/gestao/pt-br/assuntos/noticias/2023/agosto/audiencia-publica-debate-implantacao-da-nova-carteira-de-identidade-nacional.
[2] “Nova Carteira de Identidade Pode Ser Solicitada Em 12 Estados.” Agência Brasil, April 29, 2023. https://agenciabrasil.ebc.com.br/geral/noticia/2023-04/nova-carteira-de-identidade-pode-ser-solicitada-em-12%20estados.
1.12 Has there been any special measures to ensure access for vulnerable and isolated communities (e.g., for PwD, minorities, elderly) such as mobile offices or free legal aid? Are those measures provided for in law?
The CIN has two versions: the physical identity document (on paper or polycarbonate – the latter optional), and then you can also download the digital document in the GOV.BR application, as is already the case with the National Driving License (CNH).
CIN is free. In Brazil, the mandatory and free model was adopted in the first ID copy on paper and in digital format through the GOV.BR application. Furthermore, the exchange for a new National Identity Card as well as future renewals are free too. The first copy of the CIN and renewals are free, in accordance with Law 7,116/83. The second copies, however, are state taxes; each federated entity has its own charging table. Furthermore, if the citizen wants the polycarbonate (plastic) option, there will be a charge from the issuing state.
The validity period of the CIN is established according to the age of the holder at the time the document is issued. 5 years for children aged zero to 12; 10 years for people aged 12 to 60; and Indefinite validity for those over 60 years old.
The old identity card has not lost its validity. Identity documents in the old models are valid until February 28, 2032.
On May 24, 2023, the Mixed Parliamentary Front for Upholding the Right to Identity (FrenID) was established. Its primary mission is to ensure and facilitate the implementation of the new identification system, as stated in its foundational document:
“The Front will work to contribute to the Brazilian legislature with initiatives aimed at guaranteeing the Right to Identity, promoting broad debate and integration with public institutions, the private sector, international organizations, civil society organizations , researchers, in addition to affected individuals on issues related to the topic in a comprehensive manner. Thus, making it possible to recognize demands arising from the modernization of public policies and society’s needs; resolving them through legislative proposals. With the creation of this Parliamentary Front, we hope to contribute to the modernization of the Brazilian Identification System and assist in meeting goal 16.9 of the UN 2030 Agenda, ensuring citizens have universal access to an inclusive, safe, reliable, digital and modern identity.” This front is composed of parliamentarians from both Brazilian legislative houses (Senate and Chamber of Deputies) and has the support of some organizations focused on identification in Brazil.
Changes to the CIN for better representation are still to be deployed. The Ministry of Management and Innovation in Public Services (MGI), at the request of the Ministry of Human Rights and Citizenship (MDH), announced that it will make changes to the CIN with the aim of making the document more inclusive and representative. The new document will be printed without the field referring to gender and will only contain NAME (which the person declares at the time of issuance), with there no longer being a distinction between social name and civil registry name. However, until 09/15/2023 these changes are not yet reflected in Decree No. 10,977/22.