Originally posted at Privacy International’s website.

Julia Drummond, Mariana Valente, Natália Neris e Nathalie Fragoso

Over the last months, the organisation InternetLab has researched privacy, data protection, gender, and social protection, focusing on the beneficiaries of the Bolsa Familia Program (PBF). The PBF is the most extensive Brazilian cash transfer program, and its functioning is linked to CadÚnico, a database that comprises 40% of the country’s population. Moreover, it is a program whose beneficiaries are mostly women (approximately 90%) due to the policy’s own design, and which, in the last years, has been one of the most disputed issues in Brazil, both in terms of politics and public debate. The (lack of) privacy experienced by this segment of the population deserves special attention due to their vulnerable socioeconomic condition and also to the gender aspect involved in the privacy-related harms or losses.

Focalized, conditional, 20% of Brazilian population: what we already know about PBF

Bolsa Familia is a conditional cash transfer program that currently reaches 13.1 million families or 40.8 million people. The main selection criterium is the family income, and the eligibility is defined in two lines: the extreme poverty, characterized by the monthly per capita income of up to R$ 89 ($ 17,55), and the poverty, characterized by the household income per capita between R$89,01 and R$ 178 ($ 35,10) .

The program’s purpose is the immediate relief of extreme poverty and the provision of conditions to overcome socioeconomic vulnerability, as well as to break the intergenerational transmission of poverty. In addition to the direct cash transfer and the monitoring of health and education conditionalities, the program relies on the coordination with other policies to achieve these goals.

Data, what for?

The main database used for selecting beneficiaries and managing the program is called CadÚnico (Unified Registry for Social Programs of the Federal Government). Created in 2001 and connected to the management of PBF in 2003, CadÚnico is an instrument of identification and socioeconomic characterization of low-income Brazilian families. It serves not just PBF, but more than thirty public policies.

CadÚnico contains information such as housing conditions, personal identification, level of literacy and education, work situation and income and whether the family belongs to traditional and specific groups. Together, they form a set of referential data about the most impoverished population in Brazil: 76.417.354 people, according to data of December 2019. It is through CadÚnico that the automated selection of the beneficiaries is processed.

In addition to the registration and selection process, PBF deploys informatized systems that make it possible to manage the program at different levels of the federation and allow for the collection and integration of data related to the monitoring of conditionalities. The conditionalities are requirements assumed by the beneficiaries in order to be granted the benefits, and they consist of school attendance as well as immunization, prenatal care, and nutritional monitoring of children. A great amount of personal data, including sensitive ones, informs, thus, PBF. The execution of crucial policy processes depends on the intensive processing of personal data: the examination of eligibility criteria, the implementation of targeting mechanisms, the granting and payment of benefits, and the monitoring of conditionalities.

The program also comprises periodic evaluation of permanence conditions through a continuous update and cadastral verification. The families are required to update their registers annually or in case of any changes in their data. The cadastral verification is carried out by cross-checking CadÚnico with other federal databases.

According to interviews with members of the Office of the Comptroller General and records of the Monitoring and Evaluation Committee for Federal Public Policies (CMAP),  the frequency of these crossings has increased lately. “Until 2016, the action was annual (…); since 2017, the procedure started to be performed during the fiscal year, on a routine basis, distributing the new information all over the year to be addressed by the municipal managers, thereby facilitating their dynamics” (Miranda Alves Pereira, 2018).

Besides, the selection, which formerly depended on self-declared information, has been automatically filtered – for instance, the impediment of qualifying families with a member who, not having declared income to CadÚnico, is listed in the RAIS/CAGED  base (Miranda Alves Pereira, 2018). The intensification of these control proceedings finds relation to budgetary and financial restrictions resulting from the New Fiscal Regime, approved in 2016 (EC 95/2016).  The new regime established a cap on public spending. Consequently, it imposed cost savings, the reduction in the number and rigid controls on individuals benefiting from government welfare or public pension systems.

Under scrutiny: public resources, vulnerable beneficiaries

The information that feeds CadÚnico is declared by the primary person responsible for the family unit, who must be over 16 years and preferably female. The family representative is also the priority benefit holder. The female priority is upheld by law and, according to policy analysts, direct transfer to women favours the use of cash transfers within families (Bartolo, Fountoura, Passos, 2017). Official data indicates that currently 88.5% households are represented by women (Senarc, set. De 2019).

Many scholars seek to understand the effects of prioritising women as a way of ensuring the effectiveness of public policies. Some of them point out that, regardless of the adequacy of such decisions, gender stereotypes manifest themselves in the respective inspection and social control mechanisms.

The complaints presented by citizens to the Ombudsman’s Offices allow for a fruitful investigation of these conceptions. Although not so frequent and not very expressive in terms of effectively leading to the cancelling of benefits, they reflect in a very particular way some perceptions on the beneficiaries of the program. They are therefore crucial for the understanding of control dynamics that may be imperceptible through the analysis of the policy design itself. To analyse these complaints (obtained via a request to access information, according to Access to Information Act proceeding), we have built a dialogue with other research efforts. An expressive body of literature has focused on the effects of public policies on the sociability of beneficiaries, as well as on the morals constructed either socially or in the face of state bureaucracy (Marins, 2017; Milanezi, 2019).

The complaints are mostly motivated by citizens’ perceptions that some people should not receive the benefit as a result of their income. Complainants refer to beneficiaries having cars, properties, or even a salary (for the most part, by the way, close to the national minimum). Other frequent causes for complaints are related to the family structure (custody and domicile of the children, for example), and pattern of expenditure (complainants describe in detail how the beneficiaries fail to direct the resources to their children or spend it in a way considered superfluous). These complaints express an evaluation on the “legitimate beneficiaries”, which involves gender stereotypes. For example, the judgment on who the “good” and “bad” mothers are, and the strengthening of the bond between female identity and the ethos of motherhood (for conclusions in the same direction, see studies by Marins, 2017, and Bartolo, Fountoura, Passos, 2017).

From a data protection perspective, it is relevant to note that about 60% of the complaints contained personal information from the beneficiaries, including taxpayer registry number (CPF), mother’s name and the social security identification number (known as NIS).

Even if the beneficiary’s name, the social security identification number, and the benefit value are, in fact, considered public data by the Brazilian government, how are citizens other than the beneficiaries able to grasp access to these data? We have identified at least four paths.

The social security identification number of any citizen can be accessed on the “Citizen Space – CadÚnico”, a government’s official website, by inserting the name, birth date, mother’s name, and the beneficiary’s city. It is also possible, in possession of the name, NIS and CPF, to access the benefit status on the Caixa Econômica Federal’s website. In the Transparency Portal, it is also possible to find, sorting by the municipality, the name of the beneficiary, social security identification number, and the benefit value. In addition to those, there is an extra-official public application through which some of these data can be accessed: the BolsaFamilia.Info. Through this portal, built by a private party aiming “to eliminate the fraudsters from the program”, it is possible to access the full name, social security identification number, benefits’ values, merely by defining the state and municipality of the beneficiary.

Given the above, several questions can be raised about the legal basis and the proportionality of the exposure to which beneficiaries of the PBF are subjected.

The Bolsa Familia Act, in fact, establishes that the “list of beneficiaries and the respective benefit value shall be publicly accessible”. The decree that regulates it provides that the Social Control Council must have access to PBF data and information and also that the list of beneficiaries of the PBF should be widely disclosed by the Municipal and Federal District governments.

The Access to Information Act is, furthermore, another instrument that, in terms of active transparency, establishes that information of public interest must be disclosed regardless of requests (art. 3, II). It also determines that personal information can be released by the government, when consented (art. 31, II), by overriding public interest (art. 31, §3º, V), or, yet, when irregularities are at stake.

In the case of the PBF payroll, the disclosure of personal data seems to be taken as a measure of active transparency, according to the Bolsa Família Act and its Decree. These measures, although legal, are under possible tension with the General Data Protection Act (enacted in 2018, coming into force later this year), exceed the specific obligations established in the Access to Information Act, and fail to meet requirements of necessity and proportionality.

After all, a broad disclosure of these data involves risks already materialised. Last year, a scam spread through Whatsapp messages installed viruses on devices of beneficiaries, by offering a link that promised an additional benefit, the 13th month-pay. Something similar occurred in 2018: During the last presidential elections, it was found out that a candidate was sending propaganda directed specifically to the program beneficiaries, by WhatsApp as well.

Although the management of PBF involves several agencies at different levels of the federation, its functioning provides generous sharing and control strategies, which calls into question the necessity for a frequent, active and general disclosure of this information to the public.

Alerts and Developments

The study is still in the research and writing phase. Some alerts are already in place, however.

Advances in technology and the increased data processing capabilities allow for more constant collection, validation, and sharing of information among government bodies. The accounts from our interviewees also point to an expectation of efficiency increase, and the improvement in the focalization of the policy – which, although frequently questioned, is an essential feature of PBF since its inception.

Especially in the face of the imminent coming to force of the Brazilian General Data Protection Act, we seek to address some of the eventual systemic problems that may arise in such a context. For instance, the excessive data collection; the opacity of systems and infrastructure; the lack of openness, inclusiveness, and transparency in the decision-making process; flawed accountability mechanisms and security. The latter is exacerbated by the number of agents and bodies processing these data (be it to render services, to implement policies, or to inspect activities), by inadequate data protection safeguards, and the vulnerable position in which beneficiaries encounter themselves. Issues about data sharing and its use for non-specific, unforeseen and uninformed purposes also arise, such as we have discussed at the time of publication of the Decree on the Base Registry.

The interdependent nature of human rights and the necessity to embody privacy protection on social protection systems is, in this context, particularly important. We base our next step on this premise. Women on situations of poverty and extreme poverty, possibly relatively more threatened by more on and offline surveillance and data exploitation, should not have to choose between privacy and social protection, food security, or a benefit that after all alleviates, but does not eliminate poverty (Souza et al; 2019:10).