The whereabouts of the biometric records of nearly three million people in Paraguay, and who can access them after the fall of Ueno Bank. That is the concern of Paraguayan civil-society organisation TEDIC, after the Central Bank of Paraguay (BCP) took control of Ueno Bank in early November 2026. For years, Ueno scanned the faces and fingerprints of its customers and of people entering large events.
Concerns grew when newly appointed BCP president Jorge Schreiner told Paraguay’s Senate “that Ueno’s owners were not bankers”. “Their business is not banking; it is capturing the biometric data of millions of people to have a database of the country and then do business,” he stated about Ueno Bank’s data collection “They were database administrators.”
Maricarmen Sequera, executive director of digital rights organisation TEDIC, is cautious about that claim. “I cannot say it was only about processing personal data,” she says to The Asunción Times. “We know it became a bank, and the negative impact was atrocious.”
Ueno Bank’s data: Not only the bank’s customers
Biometric data covers the face, fingerprints, iris, voice and body movement.
“We are not only talking about three million people affected by Ueno Bank. We are also talking about a large biometric database,” Sequera continues. “The database now includes people who never held an account but used biometric access systems at venues such as stadiums and sports clubs.”
The risks of data collection
The danger lies in what is done with such data, Sequera states. “Almost 99.9% of the time, this information is cross-referenced with other data to build a profile: What kind of phone do they have to install the app? How did they install the app, and when did they install it? How much money do they move?”
The result of this data collection, as experts warn, can be sold as marketing data or, for example, used for targeted surveillance. TEDIC has found no public information on whether any data were sold.
Unlike a stolen credit card, biometric data cannot be replaced. “It cannot be reprinted. It cannot be generated again.” TEDIC questions the need. “We cannot use a technology like an atomic bomb to kill a mosquito.”
Years of warnings
In July 2025, TEDIC criticised Expo Paraguay, the annual agribusiness fair in Mariano Roque Alonso, near the capital, Asunción. Visitors had to use the Tutti app, pay through a Ueno account and pass biometric verification run by ITTI, a technology company linked to Ueno. TEDIC says all three belong to the same business group. “Many people had to enter to work and were obliged to have this profile.”
Football followed a similar path regarding Ueno Bank’s data collection. A 2024 law allows facial recognition at stadium entrances. Months earlier, ITTI signed a US$1.73 million agreement with Paraguay’s National Sports Secretariat. Such systems track more than identity. “With that identity you bought a beer or a water, and you were tracked moving around inside the stadium.”
Who guards Ueno Bank’s data now?
With Ueno’s directors and managers removed, the interveners appointed by the BCP are responsible for the database. TEDIC asks the BCP to state publicly where the sensitive records are held. TEDIC also wants a guarantee that no database passes to another entity without each person’s free, specific and informed consent.
TEDIC further calls for an independent audit of biometric use. That includes state agreements with companies of the group, such as the proof-of-life system for retirees at the Social Security Institute (IPS) and stadium access. “It is important to think about recovering trust, not only of the resources or the money, but also of the data.”
A law that is not yet in effect
Paraguay approved Law 7593 on personal data protection in November 2025, but it takes full effect only in late November 2027. People affected by Ueno cannot yet invoke it. The Ministry of Information and Communication Technologies (MITIC) must still draft the implementing regulation, and no public draft exists. The future data protection agency would also depend on that ministry. “An authority without independence is, obviously, in a very fragile position.”
The law still has strong points. Consent must be free and informed, and it is not free when biometrics are the only way to enter a fair, collect a pension or open an account. State security uses, such as facial recognition in streets and stadiums, need their own specific law. “All laws can be improved; no law is perfect. The law we have today is fine; it is worse not to have one.”
What people can do today
TEDIC suggests a formal written request for access and deletion. Because Ueno no longer operates, the request can be sent to the BCP’s intervention team. Article 135 of the Constitution also guarantees habeas data, which lets people access their data and demand its correction or deletion. People who used Ueno or its biometric systems while living in the European Union can file a complaint to the data protection authority where they live. The European Union’s GDPR protects people according to where they are, not their nationality.
People should also beware of scams, states the Social Security Institute: The IPS has warned that the institution does not ask for personal data or passwords by phone, message or social media.
A moratorium and a regional case
TEDIC calls for a moratorium on new facial recognition deployments until the law is in force and impact assessments exist. In April 2019, Sequera asked the Interior Ministry for protocols and impact assessments on facial recognition cameras in Asunción. The ministry refused, citing national security.
On 19 June, TEDIC, the Electronic Frontier Foundation and the Centre for Justice and International Law (CEJIL) petitioned the Inter-American Commission on Human Rights. TEDIC expects the state to respond by January or February. “If we manage to get this into the Commission and obtain a positive resolution, it will have an impact not only in Paraguay, but across the region.”
The wider question is one of trust, according to TEDIC’ executive director. “What kind of democracy do we want to live in”, Sequera concludes. “In what kinf of country do we want to live; under authoritarian watch, or do we actually want to rely on trust?”
About TEDIC
TEDIC (Asociación de Tecnología, Educación, Desarrollo, Investigación y Comunicación) is a Paraguayan civil-society organisation founded in 2012 in Asunción. TEDIC focuses on digital rights, free culture, privacy, gender and technology, and civic technology, and is funded primarily through international cooperation grants and project support from various donors.
