Brazilian biometric company expands as data rules tighten

For almost 20 years, Griaule expanded in conventional fashion, opening offices in the US and Europe, in addition to its headquarters just outside São Paulo. Then, this year, it hired a project manager in Afghanistan.

“After some evaluation of the daily tasks and operations [in Afghanistan], we thought that it would be a good idea,” says Thiago Ribeiro, chief marketing officer for the company, which develops technologies for biometric recognition.

The move into the war-torn central Asian nation represented the culmination of one of the company’s most ambitious projects: a years-long effort to sell its fingerprint technology to the US Department of Defense.

Griaule’s man in Afghanistan is helping the country’s armed forces track down terrorists by pulling fingerprints from exploded bomb fragments and other crime scenes, and cross-checking them against identity databases. The $75m contract, which also includes projects in Iraq, was a crowning achievement and one that Griaule burnishes proudly.

The Campinas-headquartered company is one of Brazil’s most advanced tech groups. It is also one of the fastest-growing, placing 364th in the latest FT-Statista ranking, which lists companies from across the Americas by their 2016-19 compound annual growth rate (CAGR).

Started in 2002 by two founding partners, this year Griaule expects to expand its workforce to more than 100 worldwide, up from 40 in 2019, and open a new office in Mexico City.

With 2019 revenues of $4.5m, Griaule’s 2016-19 CAGR was 35 per cent, the FT ranking shows. And last year, the company more than doubled its revenues to BR$57m ($10.3m).

In addition to the US Department of Defense, the company now boasts customers including the US Department of Homeland Security, as well as several international and Brazilian banks, which have adopted an array of its technologies for everything from facial recognition scanners to app authentication processes.

Privacy discussions are more present in recent years. But we haven’t received any pushback

The sector, however, is not without its headwinds. Led by the EU, governments around the world are growing increasingly sensitive to data privacy concerns and the collection of biometric information.

Brazil is no exception. Late last year, after years of planning, the government implemented the General Law for the Protection of Personal Data — or LGPD in its Portuguese acronym — which sets out citizens’ rights and regulates how companies can collect and use personal data. The legislation was widely seen as an effort to keep pace with the EU’s General Data Protection Regulation.

“We are moving towards increased [data privacy] awareness,” says Bruna Santos, an advocacy co-ordinator at the Data Privacy Brazil Research Association. “It has been an [increasingly important] topic for policy wonks and society in general. We recently approved our own legislation with penalties for infringements to come.”

Griaule, however, remains sanguine about the emerging challenges.

“Privacy discussions are more present in recent years. [But] we haven’t received any pushback,” says João Weber, chief project officer. The company provides the software that underpins facial recognition scanners, but works with “customers to follow regulations and be compliant with all the laws”, Ribeiro adds.

“We were prepared for [the LGPD]. When these new regulations were made effective, our products were prepared for it. We had to make sure clients could use the products as the law required.”

On the controversial point of data storage — earlier this year, millions of citizens’ tax numbers, facial images and addresses were leaked and are now for sale on the dark web — the company says it only “provide[s] the technology to the government and clients; they are usually responsible for keeping data safe”.

Weber notes that Griaule’s technology is typically aimed at preventing fraud. He points to a project with Brazil’s electoral court, which cross-checked data to ensure there was no duplication of voters. Through the process, Griaule found one voter with 55 different IDs. “That person could vote 55 times — enough to potentially change an election [result] in a small town or city,” he says. 

The company also found that the pandemic spurred a surge in corporate clients searching for authentication software to verify the identities of staff or customers.

Ribeiro points to digital banks that are increasingly using technology to cross-reference identity documents against photographs of prospective customers to prove their identity.

“How do they prevent fraud if they do not verify in person? They move towards this kind of tech,” he says. “[Clients] do not have to go outside of Brazil to look for this tech. They can find it here at the same level or even better than elsewhere.”