{"id":2215,"date":"2026-07-30T09:00:59","date_gmt":"2026-07-30T12:00:59","guid":{"rendered":"https:\/\/peckadv.com.br\/?p=2215"},"modified":"2026-07-29T17:00:48","modified_gmt":"2026-07-29T20:00:48","slug":"depois-do-amarelo-vem-o-verde-os-caminhos-da-privacidade-na-gestao-de-dados-urbanos-em-sao-paulo","status":"publish","type":"post","link":"https:\/\/peckadv.com.br\/en\/depois-do-amarelo-vem-o-verde-os-caminhos-da-privacidade-na-gestao-de-dados-urbanos-em-sao-paulo\/","title":{"rendered":"After yellow comes green: the paths of privacy in urban data management in S\u00e3o Paulo"},"content":{"rendered":"

<\/p>\n

The advance of metropolises toward the smart city model continually redefines the boundaries between the operational efficiency of public management and the preservation of citizens’ fundamental rights. In the urban environment of S\u00e3o Paulo\/SP, the intersection of cutting-edge technology, infrastructure, and data privacy has gained a new chapter that could trigger a true regulatory warning sign: Project Green Light<\/b>, which involves a partnership between Google, the Traffic Engineering Company (Companhia de Engenharia de Tr\u00e1fego<\/i> \u2013 CET), and the S\u00e3o Paulo Municipal Information Technology Company (Empresa de Tecnologia da Informa\u00e7\u00e3o do Munic\u00edpio de S\u00e3o Paulo<\/i> \u2013 Prodam)[1].<\/p>\n

Before delving into the case at hand, we recall the paradigmatic episode involving the concessionaire ViaQuatro\u2014responsible for managing Metro Line 4-Yellow\u2014which established itself as a watershed moment in the practical application of the General Data Protection Law (Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais<\/i> \u2013 LGPD) in Brazil.<\/p>\n

On that occasion, a public civil action filed by the Brazilian Institute for Consumer Defense (Instituto Brasileiro de Defesa do Consumidor<\/i> \u2013 IDEC), together with the Public Defender\u2019s Office and the Public Prosecutor’s Office of the State of S\u00e3o Paulo, questioned the legality of installing interactive advertising totems equipped with facial detection cameras on boarding platforms. The system performed emotional reaction mapping and demographic profiling of passengers under the pretext of conducting market research.<\/p>\n

The S\u00e3o Paulo Judiciary deemed the practice abusive, given the capture of biometric data\u2014classified as sensitive data under the LGPD:<\/p>\n

\n

\u201cThe rapporteur of the appeal, Reporting Judge Antonio Celso Faria, classified the company’s conduct as blameworthy and offensive to collective morality, emphasizing that it is virtually impossible to calculate the number of passengers using the defendant’s platform daily, a fact that characterizes collective moral damage. Furthermore, the judge highlighted that the concessionaire’s train passengers had their privacy invaded for profit, without authorization and without adequate control over image capture.\u201d[2]<\/p>\n<\/blockquote>\n

The conviction of the concessionaire by the 8th Chamber of Public Law of the Court of Justice of S\u00e3o Paulo (TJSP) resulted in a fine of R$ 500,000 for collective moral damages, allocated to the Diffuse Rights Defense Fund (Fundo de Defesa de Direitos Difusos<\/i> \u2013 FDD). Beyond punishing the absence of a legal basis and the lack of transparency, the ruling highlighted the systemic risk arising from the exposure of vulnerable individuals, given that the tracking included children and adolescents without the proper safeguards required by the Statute of the Child and Adolescent (Estatuto da Crian\u00e7a e do Adolescente<\/i> \u2013 ECA).<\/p>\n

This case marked a regulatory “yellow light,” warning the market that urban development cannot indiscriminately infringe upon and violate privacy rights.<\/p>\n

Having revisited this emblematic case, we enter a new scenario. The capital of S\u00e3o Paulo embarks on a new phase of technological innovation applied to mobility, represented by Project Green Light. This is a technical cooperation agreement established between Google, CET, and Prodam.<\/p>\n

The initiative, formally announced at the annual Google for Brasil<\/i> event, utilizes artificial intelligence to optimize traffic flow at complex intersections in the city, reducing wait times and pollutant emissions without requiring physical structural interventions.<\/p>\n

Similar to the model adopted in Boston, the tool operates by analyzing macroscopic travel patterns obtained through aggregated traffic data from the Google Maps application. Google\u2019s artificial intelligence monitors road dynamics and recurring bottlenecks, focusing particularly on areas where drivers face severe congestion. Based on this diagnosis, algorithms generate traffic signal recalibration proposals, recommending multi-second adjustments to the green light timing during specific “peak” hours[3].<\/p>\n

Unlike the model applied on the Yellow Line, where a direct monitoring mechanism was imposed on individuals, the governance of Project Green Light preserves the autonomy of the public authority. The automated recommendations generated by Google are not directly applied to the city\u2019s traffic lights; instead, they undergo screening, validation, and discretionary approval by CET technicians, who decide whether the recommendations serve the public interest before implementing them in the physical network.<\/p>\n

The project is already yielding measurable results in Brazil and globally, demonstrating that technology can operate in a less intrusive and more collective manner. Indeed, the immediate impact of Project Green Light is believed to translate into practical benefits for citizens’ daily commutes and the environmental quality within urban settings.<\/p>\n

From a legal privacy perspective, Project Green Light is grounded in de-identification and statistical aggregation, as telemetry and location data provided by Google Maps users are consolidated anonymously before being processed by artificial intelligence. Consequently, the project\u2019s workflow does not involve individualized license plate tracking, vehicle owner identification, or facial image capture of drivers.<\/p>\n

This positions the initiative within the scope of legitimate interest and the execution of public policies by municipal authorities, in strict compliance with the guidelines of Article 23 of the LGPD[4]. However, governance over this data sharing must be continuous. Although the information transmitted to CET and Prodam is statistical, the contractual protection of the partnership must prevent any possibility of subsequent re-identification of road users. This ensures that shared data remains strictly limited to traffic engineering purposes, eliminating the risk of secondary use for traffic enforcement or disproportionate state surveillance.<\/p>\n

The “Guidance Guide on Personal Data Processing by the Public Sector” released by the ANPD[5] (National Data Protection Authority), alongside public consultations regarding data-sharing regulations between public and private sectors, demonstrates that state discretion is subject to rigorous boundaries.<\/p>\n

Thus, any agreement or technical cooperation instrument involving the transfer of citizen data to private entities\u2014or vice versa\u2014must be clearly justified administratively. It must demonstrate the appropriateness of the purposes and mandate information security clauses compatible with current regulations, ensuring that technology\u2019s \u201cgreen light\u201d moves forward in full alignment with legality.<\/p>\n

Utilizing technology\u2014and AI in particular\u2014to improve quality of life in major urban centers is inescapable. However, this movement must observe existing legal and social dynamics so that, under the guise of solving a problem, potentially more severe issues\u2014such as mass monitoring lacking an adequate legal basis\u2014are not created.<\/p>\n

Written by:<\/b> Dr. Henrique Rocha, Partner, and Attorneys Mariana Ferreira Figueiredo and Marcella Guida from Peck Advogados.<\/p>\n

Footnotes \/ Citations:<\/h3>\n