'They Erased My Face From My Own Documents': São Paulo Residents Speak Out on Duplicate Image Errors in City Systems

Residents across São Paulo's peripheral districts are reporting a growing problem: their photographs are being replaced by strangers' images inside municipal digital platforms, leaving them locked out of health appointments, housing registrations, and social benefit portals. The error — known internally among city IT contractors as a duplicate image replacement fault — occurs when a database indexing conflict assigns one person's photograph to another user's taxpayer identification number.

The problem has surfaced most visibly in Brasilândia, in the far north of the city, and in Cidade Tiradentes, the sprawling residential zone on the eastern periphery roughly 35 kilometres from the city centre. Both districts serve predominantly low-income populations with heavy dependence on the municipal Unidades Básicas de Saúde network for primary care. When a UBS receptionist's terminal pulls up the wrong face, appointments get delayed, identity verification fails, and residents are sent home to gather paperwork they may not have readily at hand.

One resident of Rua Engenheiro Teixeira Soares in Brasilândia described spending three consecutive Tuesdays travelling to the local UBS only to be told the system showed a different person's photograph in her record. She was asked to bring her Carteira de Identidade Nacional, her CPF card, and a recent utility bill each time. She is retired and relies on public transport; each round trip takes over two hours.

A System Under Strain

The timing is significant. The city of São Paulo has been rolling out its Conecta SP digital services platform since late 2024, consolidating dozens of previously siloed databases — from the Secretaria Municipal de Saúde to the Cohab-SP social housing agency — into a single unified records architecture. That consolidation, while intended to reduce duplicated paperwork, appears to have introduced new synchronisation errors when legacy photograph files migrated between systems with non-matching identifier formats.

Cohab-SP, which manages social housing waiting lists affecting more than 750,000 registered applicants across the city as of its most recent published figures, uses photograph verification at key stages of the application process. Applicants whose images have been replaced by a duplicate-image error are effectively frozen at those stages until a manual correction is filed — a process that, according to documents circulating among tenant advocacy groups in Sapopemba, can take between 45 and 90 days to resolve.

The Instituto Brasileiro de Defesa do Consumidor, known as Idec, has flagged digital identity data integrity as a priority concern in its 2025 annual agenda. Brazil's Lei Geral de Proteção de Dados — the LGPD, in force since September 2020 — requires public bodies to notify affected individuals of data processing errors that impact their rights, though enforcement against municipal agencies has been inconsistent.

What Residents Are Doing — and What They Should Know

Community organisations in both Brasilândia and Cidade Tiradentes have begun hosting weekend orientation sessions at local Centros de Educação Unificada, known as CEUs, to help residents navigate the correction process. The CEU Paz, on Avenida Deputado Emílio Carlos in the north zone, held its first such session in June 2026, drawing more than 80 attendees in a single afternoon according to organisers present.

Residents who believe they are affected should file a formal correction request through the Ouvidoria Geral do Município, the city's official complaints and oversight office, citing the Conecta SP platform and requesting written confirmation of the error. Keeping a printed copy of that confirmation is essential, as it can serve as a bridging document when accessing services while the digital record remains incorrect.

The Secretaria Municipal de Gestão has not issued a public statement acknowledging the scale of the problem. Advocates say the absence of official communication is itself part of the burden — residents have no way to know whether their record is affected until they show up in person and the system rejects them. For anyone who cannot afford to lose a morning's wages or navigate two hours of bus travel on a weekday, that uncertainty carries a real cost.