On March 10th, Bill No. 18.118-07 was introduced in the Congress. It proposes amendments to Law No. 21.719—scheduled to enter into force in December 2026—and to Law No. 17.336 on Intellectual Property, addressing matters related to digital identity and synthetic representation.
The initiative aims to strengthen the protection of digital identity in the context of the use of technologies such as biometrics and artificial intelligence, specifying their range of application without altering the regulatory framework already established. It introduces specific provisions to reaffirm the voluntary use of biometric data, regulate the identifiable digital reproduction of personal traits through automated systems, and clarify that the use of personal data in the training of artificial intelligence systems constitutes data processing for all legal purposes.
Recognition of digital identity
The bill introduces the right to digital identity, understood as the right of the data subject to protection and control over the use of their biometric data and the identifiable digital reproduction of their personal traits, such as facial features or voice.
Synthetic representations and commercial use
Synthetic representation is defined as the digital recreation, generation, or simulation of biometric traits or personal attributes that allow a natural person to be directly or reasonably identified through automated systems, including artificial intelligence. Where such representations are based on sensitive data, their processing will be subject to the regime applicable to that category of data.
In addition, the bill establishes that the use of identifiable synthetic representations for commercial purposes will require the express authorization of the data subject. Furthermore, it proposes amendments to Law No. 17.336 on Intellectual Property, providing that the commercial exploitation of a person’s image, voice, or biometric traits—including their synthetic representation—must be authorized by the data subject.
Digital impersonation and exercise of rights
The bill provides that, where a synthetic representation constitutes an evident simulation or impersonation of identity, the data subject may exercise the right to erasure in accordance with the general procedure set forth in personal data protection legislation. Likewise, the data subject may request the rectification of representations that are inaccurate or misleading as to their identity.
Artificial intelligence systems training
It is clarified that the use of personal data—including sensitive data—for the training, adjustment, or validation of artificial intelligence systems constitutes the processing of personal data for all legal purposes. Only data that has undergone an effective and irreversible anonymization process that reasonably prevents the re-identification of the data subject will be excluded from the data protection regime.
Protection of freedom
Finally, the bill establishes that its provisions may not be interpreted in a manner that affects the legitimate exercise of freedom of expression, artistic creation, scientific research, or informational use, provided that there is no direct commercial purpose or fraudulent impersonation of identity.
The bill is currently at its first constitutional stage of review in the Senate and has been referred to the Committee on Constitution, Legislation, Justice, and Rules for analysis.
For questions or further information on this matter, please contact our corporate legal team.