The collapse of UENO BANK is not just a financial crisis; it is also a personal data crisis. Three million people handed over their faces, selfie videos, and financial histories to an ecosystem that is now under intervention, with its executives facing charges and its databases hosted by a company in Texas, United States. In just over two years, the faces of thousands of people also became the key to watching a match, entering a fair, or collecting a pension. Those data ended up in the hands of the same private group that sells surveillance technology, without an applicable law to regulate it.
In 2021, the Vázquez Group acquired ITTI, a company within the holding group that includes UENO Bank. In addition to financial software, ITTI provides surveillance technology and has been in the market for more than 20 years. It works with facial-recognition and video-surveillance companies such as Corsight, Avigilon, and Dermalog; installed facial-recognition cameras in public spaces; and was named in allegations of possible bid-rigging in the purchase of espionage equipment through the Itaipu Technological Park. ITTI also supplied the facial-recognition systems used in Paraguayan Football Association (APF) stadiums and operated the mandatory biometric verification system for entry to Expo Paraguay 2025, where UENO was the only accepted payment method. Other services include biometric proof-of-life checks for retirees and pensioners through the Social Security Institute (IPS), cloud services for government programs, and everyday apps connected to UNID.
While public debate is rightly focused on returning people’s savings, we at TEDIC want to raise a question we have been asking for several years: What is happening to users’ biometric and sensitive data? A deposit may be covered by a guarantee fund, but a leaked face, fingerprint, or health record cannot be returned or reissued.
Background: From mass-market digital bank to intervention
On November 2, 2026, the Central Bank of Paraguay (BCP) initiated the resolution of UENO Bank after its solvency ratio fell below 50% of the required minimum. Since then, none of the bank’s apps, cards, or services has worked.
UENO belongs to the Vázquez Group, the same conglomerate that controls ITTI, the technology company providing biometric identification and facial-recognition systems. In June 2026, the bank reported 2,941,996 customers in a country of around 6.1 million people. It also managed approximately USD 850 million in public and IPS funds.
| Date | Event |
|---|---|
| 2021 | The Vázquez Group acquires ITTI. |
| Jan. 2024 | The APF and the Ministry of the Interior sign an agreement on facial recognition in stadiums, with ITTI as the provider. |
| Feb. 2025 | UENO announces ISO/IEC 27701 certification and presents itself as a “leader in data protection.” |
| Apr. 2025 | IPS–UENO agreement for biometric proof-of-life checks for retirees and pensioners. |
| Aug. 14, 2025 | Data leak: around 100,000 transfers, including ID numbers, account details, and amounts, appear online. The bank denies the breach. |
| June 5, 2026 | The Superintendency identifies loans to companies linked to the group that controls the bank. |
| June 15, 2026 | UENO sells a loan portfolio to Vinanzas S.A. for USD 74.4 million, financed indirectly by the bank itself. (*) The raid took place on Nov. 9. |
| Nov. 2, 2026 | The BCP board unanimously resolves to begin the bank’s resolution. |
| Nov. 3, 2026 | The app, cards, ATMs, and branches are suspended. |
| Nov. 4, 2026 | Prosecutors charge Miguel Vázquez and 27 other people over loans to companies in the group, including ITTI. |
| Nov. 6, 2026 | Following Santiago Peña’s impeachment, Pedro Alliana assumes the presidency and calls for the resignation of the entire cabinet. |
The 2025 leak had already exposed the problem. It was reported to SEDECO, the consumer-rights regulator, which has yet to make progress on its investigation. The bank described the incident as “malicious information” and did not notify the affected people. Without an applicable law, no one was required to report the breach.
TEDIC had been raising the alarm
We have been working on personal data issues for 14 years. We have also been denouncing the acquisition and deployment of biometric technology in Paraguay. Our first report, in 2017—nine years ago—addressed the use of fingerprints in the DNIT system, formerly known as SET. This mandatory “enrollment,” like other biometric systems used to record attendance, lacked personal data protection standards. At the time, there was not even a comprehensive law to protect people.
In 2024, we documented how the same economic group was concentrating the collection of biometric data in everyday settings, without an applicable law or public oversight. The group’s legal team was also lobbying to block the personal data protection bill promoted by the Personal Data Coalition, which was eventually passed by Congress after nearly four years.
In January 2024, before the Sports Law was passed, the APF and the Ministry of the Interior signed a facial-recognition agreement and installed cameras in stadiums. ITTI supplies those systems, while UENO simultaneously became an official sponsor of the APF and several clubs.
In our article Surveil, Censor, and Punish, we analyzed Law No. 7269/2024 and showed that, out of more than 1,641 cameras installed, only four facial-recognition alerts were generated during all of 2023. Through our #ConMiCaraNo campaign, we asked football supporters the same question people across the country are asking today: How can we make sure our data won’t be sold? In the stadium context, the UK-based organization Privacy International warned that facial recognition threatens privacy and the right to participate in sporting life.
To enter Expo Paraguay 2025, people had to use the TUTI app, pay exclusively with UENO, and undergo biometric verification operated by ITTI. Our analysis pointed out that all three companies belong to the same holding group, and asked what would be done with the data, who would control it, and for how long. We therefore called for the use of biometric technologies to be suspended until a robust law was in place.
In May 2026, we published Biometric Surveillance: Facial Recognition and Human Rights at Sporting Events in Paraguay. The report calls for impact assessments, independent oversight, and specific safeguards for biometric data. Other ties to the State have also come to light: the news outlet El Surtí documented ITTI contracts to store the Che Róga Porã databases in the cloud, as well as a sponsorship agreement with the National Sports Secretariat that included facial-recognition cameras.
Before the full Senate, the new president of the Central Bank of Paraguay, Jorge Schreiner, said that banking was never the business of UENO’s owners. According to him, their aim was to capture the biometric data of millions of people, build a large national database, and then do business with it. “They weren’t bankers; they were database managers,” he summed up. Schreiner also recalled that people could not even enter Expo without first registering their biometric data on UENO devices. When the country’s top financial authority says this in the Senate, it confirms what TEDIC has been warning about since 2024: the real asset of this ecosystem is our faces and other sensitive data.
And that is without even considering how, during Santiago Peña’s government, ITTI was one of the State’s main providers of communications surveillance, using invasive software without transparency or accountability.
What data were collected, and where are they?
To open a bank account, customers had to accept UNID’s terms. UNID is a “single sign-on” service connecting UENO, the APF, Club Olimpia, and other apps in the group. UNID is a product of ITTI USA, LLC, based in Dallas, Texas. Identity verification was carried out using a selfie video.
The contractual documents leave little room for interpretation:
- UENO’s single contract authorizes the use, storage, and exploitation of data “with or without commercial purposes,” and their transfer to third parties—including biometric data.
- UNID’s terms extend that authorization to identification, employment, academic, financial, and social-circumstance data, including data collected automatically.
- UENO’s privacy notice allows data to be processed abroad, using third-party infrastructure, and permits the use of advanced analytics and artificial intelligence.
- Another ITTI USA privacy notice identifies the company as managing data collected by UENO, ITTI, Monchis, Upay, Wepa, MUV, TUTI, UELA, and CONTO. And ITTI USA, LLC’s privacy notice…
Were the data sold? To date, there is no public information confirming or ruling this out. But the contracts already authorized their commercialization, and the sale of a loan portfolio to Vinanzas necessarily entails the transfer of borrowers’ data. With the bank undergoing resolution and deposits in the process of being transferred to other institutions, no one has said what will happen to the biometric databases.
Biometric data and the limits of data protection laws
In most countries, national laws do not adequately regulate the use and transfer of biometric data or address the risks of its misuse on a large scale. For us at TEDIC, data protection is necessary, but not sufficient.
We also stress that any interference with privacy must pass a test of necessity and proportionality. Before deploying a biometric system, we must ask what alternatives are available and whether they are less invasive. Often, a simpler solution works just as well. We also warn that centralized databases often fail this test: storing a data point on a chip is not the same as storing millions of faces on a server.
There are two further concerns that characterize the Paraguayan case. First, data collected for one purpose end up being used for others—for example, the same face used to enter a stadium, Expo, and a bank. Second, biometric systems are sold by a powerful industry, often with close ties to governments and little transparency. Because biometric data cannot be changed like a password, TEDIC calls for prior risk assessments and privacy by design.
The Necessary and Proportionate Principles, promoted by the Electronic Frontier Foundation (EFF) and organizations around the world—including TEDIC—complete the framework. Although they were written for state surveillance of communications, civil society applies them by analogy to biometrics. Any restriction on privacy must be prescribed by a clear and foreseeable law (legality), be the least invasive means available (necessity), genuinely serve its purpose (suitability), and balance the benefits against the harm (proportionality).
Is a separate law needed for every case? Not necessarily a separate law for every case, but there must be a specific legal basis for each form of processing that restricts rights:
- State uses for security purposes. Article 2 of Law No. 7593 excludes from its scope data processing for public security, immigration, defense, and criminal justice purposes; these require their own specific laws governing the processing of biometric data. Facial recognition in stadiums or on the street falls outside the general law and requires a specific law setting out purposes, retention periods, judicial oversight, and independent supervision. Sports Law No. 7269/2024 does not meet these standards.
- State administrative uses. The IPS proof-of-life process needs a clear enabling rule that explains why biometrics are necessary. An agreement with a private bank is not a law.
- Private-sector uses. Law No. 7593 provides a framework, but consent is not valid when it is not freely given—for example, when biometric verification is required to enter Expo, collect a pension, or open an account. In such cases, either a law authorizes the processing with appropriate safeguards, or it should not take place. The regulations must make the impact assessments provided for in Article 14 mandatory for all biometric processing.
Biometrics used for security purposes therefore fall outside this law and require a specific legal instrument: Law No. 7593 is a floor, not a ceiling. Any other use must be shown, on a case-by-case basis, to be necessary, suitable, and proportionate, with a prior impact assessment.
A little more history: what Law No. 7593/2025 says
The Personal Data Protection Law, Law No. 7593, was enacted on November 27, 2025. It is the result of four years of advocacy by the Personal Data Coalition, made up of APADIT, TEDIC, Abente Stewart Law Firm, the Internet Society Paraguay Chapter, and Puente.
One particularly important feature of this new right is the law’s extraterritorial reach. Data have no borders; they follow the person—or, more precisely, the person’s data. Article 2 applies the law to entities established in Paraguay even when they process data in another country, and to entities not established here that offer goods or services to people residing in Paraguay. The location of the server does not matter; what matters is whose data they are. That is why ITTI USA, LLC, based in Texas, falls within the law’s scope. This principle is drawn from the European General Data Protection Regulation (GDPR) and OECD guidelines, which informed the law.
What the law requires—and what the UENO case puts to the test:
| Article | Requirement |
|---|---|
| 3 and 6 | Prior, freely given, informed, specific, and unambiguous consent, which can be withdrawn at any time. |
| 3.4 and 3.7 | Biometric data are sensitive data. |
| 19 | International transfers are permitted only where there is an adequate level of protection, contractual safeguards, or explicit consent. |
| 20 | Processing sensitive data is prohibited, except in specified cases. |
| 26–32 | Rights of access, rectification, erasure, objection, and portability, with a free response within 30 days. |
| 33 | The right to review automated decisions, such as a risk score. |
| 17 | Security breaches must be reported within 72 hours. |
| 45 | Transferring data to third parties or abroad in violation of the law is a serious offense. |
Under these rules, clauses authorizing the “exploitation with or without commercial purposes” of biometric data would not meet the standard for freely given and specific consent.
The limits: a law that still offers no protection
The law exists, but the UENO case is unfolding in the vacuum created by the delay in bringing it into force. Here are its current limitations:
- It is not yet in force. It takes effect 24 months after publication, in late November 2027. People affected by UENO cannot yet invoke it before an authority.
- The regulations are still outstanding. The Executive Branch has the same 24-month period to issue implementing regulations. Almost a year after the law was enacted, no public draft is known to exist. In October, the minister promised to present one “in the coming months” for public comment. The Personal Data Coalition was promised a participatory rule-making process, and we are still waiting for that consultation to be called.
- The Agency is not independent. The National Personal Data Protection Agency is part of MITIC. When the State itself contracts with companies that should be subject to oversight—as happened with ITTI—an authority without independence is in a vulnerable position.
- Private certifications are no substitute for the law. In 2025, UENO announced ISO/IEC 27701 certification and linked it to the GDPR. But ISO certification is not GDPR certification: the GDPR recognizes only certifications approved by European authorities. UENO’s announcement does not name the certifying body or specify which systems the certification covers, and it makes no mention of UNID or ITTI.
- Biometric systems were deployed before the rules were in place. Stadium cameras, Expo entry systems, and the IPS proof-of-life process are operating without impact assessments or independent oversight.
What you can do now
Although the law is not yet in force, users already have tools they can use:
- Submit a formal request for access and erasure. The single contract requires the bank, upon the customer’s express request, to remove or delete their data from all databases with which it has shared them. The request can be addressed to the BCP’s intervention team and ITTI USA, LLC.
- File a habeas data petition. Article 135 of the Constitution allows people to access data held about them, learn how and why it is being used, and request that it be updated, corrected, or destroyed. This is the judicial remedy currently available, as in cases involving political party affiliations recorded without consent.
- Withdraw your consent. UENO’s privacy notice recognizes the right to withdraw consent for marketing purposes and the right not to be required to provide sensitive data.
- Explore the European route. The GDPR’s protections depend on where a person is, not their nationality. People who used UENO or UNID while in the European Union—for example, to send remittances—could file a complaint with the data protection authority in the country where they live. TEDIC is assessing this option.
- Watch out for scams. The IPS and the AFD have warned that, during the account transition, they will not ask for personal data or passwords by phone, text message, or social media.
What we are asking of the new government
President Pedro Alliana took office on November 6 and is reshaping the cabinet and the leadership of the BCP, where the Senate approved Jorge Schreiner as president. Returning people’s savings is urgent, but restoring trust also requires action on their data.
TEDIC is calling for:
- Transparency about UENO’s databases. The BCP and the intervention team should publicly disclose where users’ biometric and sensitive data are stored, who can access them, and the terms of any contract with ITTI USA, LLC.
- No transfers without renewed consent. No database should be transferred to another institution along with deposits or loan portfolios without each person’s freely given, specific, and informed consent, as required by the standard set out in Law No. 7593.
- An independent audit of biometric systems. The use of biometric data under government agreements with companies in the group should be audited, including the IPS proof-of-life system, APF stadiums, Che Róga Porã, and the National Sports Secretariat.
- Issue the regulations now, with public participation. The new MITIC leadership should publish a draft of the regulations for Law No. 7593 and open a public consultation, as promised to civil society.
- Get an independent Data Protection Agency up and running. It needs a budget, technical staff, and genuine autonomy from both the Executive Branch and companies that contract with the State.
- Declare a moratorium on biometric surveillance. Suspend new facial-recognition deployments until the law is in force and impact assessments are in place. My data, my rights
[Research] Technology-facilitated gender-based violence against women politicians in Paraguay