Facial recognition is omnipresent in China's everyday life, used for purposes from mobile payments to compound entrance. With the broader application of the technology, related disputes, too, are on the rise.

A public survey on the application of facial recognition technology published in 2020 showed that of over 20,000 respondents, 94 percent had used the technology. However, more than 64 percent said they felt the technology tends to be abused, with 30 percent adding that they had suffered material losses or privacy infringement because of the improper collection and misuse of facial information. 

A set of regulations for the use of facial recognition technology published by the Supreme People's Court (SPC) on July 28 aim to provide a legal solution to the increasingly pressing problem. 

The rules deal with issues vis-à-vis the application of the law in civil cases involving facial recognition technology.

Hidden threats 

Facial information can be collected when one is completely unaware. Maybe at one point or another, the ubiquitous surveillance cameras have collected one's facial information. Once such information is leaked, the consequences can be dire because unlike digital passwords, which can be changed, people can hardly change their faces.

These special characteristics of face-related information mean that any abuse of the technology might lead to both financial losses and privacy violations.

Some victims of this technology abuse have brought their cases to court. The first legal case involving facial recognition technology in China was filed in 2019, with a resident of Hangzhou, capital of Zhejiang Province,

accusing a local wildlife park after the latter required a facial recognition scan for holders of its annual pass to get admitted into the park. At the second-instance trial of the case in April, the court ruled the park pay over 1,000 yuan ($154.3) in compensation for infringement upon the resident's rights, and further ordered the park to delete the plaintiff's personal information. 

Other cases have subsequently been reported. In 2020, a gym in Suqian of Jiangsu Province was ordered to correct its practices after it had received a police warning for capturing its members' facial images without their permission. The gym deployed facial recognition systems to check people coming in and out of the facility, but it did not encrypt the biometric data to properly protect the information.

The loopholes in the information security of a number of online platforms and shops were also exposed during a China Central Television evening gala to mark Consumer Rights Day on March 15. They were accused of using facial recognition systems to collect information such as the outlets customers had been to, the number of times they visited and the amount of money they spent, all for the sake of targeted marketing and differentiated pricing.

The illegal collection of face-based information has unlocked new space for criminal activities. In 2019, a new mobile app called ZAO turned into a sensation within mere weeks of its release. People could upload photos of their faces and then replace their own features with those of TV and movie stars. However, the app soon aroused concern, with some users worrying that their image could be used by criminals to trick facial recognition payment software—resulting in hefty financial losses.

One experiment saw an individual using a photo print of a face to trick the facial recognition system of a self-service package locker, succeeding in opening it and getting the parcel out. 

This risk of information leakage caught the attention of regulators. Last December, Tianjin Municipality became the first city in China to prohibit businesses and institutes from collecting personal bio-information without authorization, including facial features.

Better protection 

The regulations of the SPC stipulate that the misuse of facial recognition without legal authorization in businesses and public spaces, including hotels, shopping malls, banks and airports, constitutes infringement of personality rights.

When online platforms or apps gain user approval to process facial information, they should present the specific clauses to users for special consideration rather than leave them buried in the general terms of use, says the SPC document. 

Chen Longye, an official with the SPC research office, said as facial information is highly sensitive personal information, strict standards are essential to ensure people have been adequately informed before agreeing to provide the relevant information. Additionally, they must give full consideration to the possible impact on their rights and interests.

The newly issued protocols also forbid the practice of forcing users to agree to facial recognition terms if they want to obtain services that do not rely on the access to facial data.

According to the rules, property management enterprises shall not compel residents to use facial recognition as the only means of verification for entrance. To begin with, such enterprises should acquire residents' permission and provide those who disagree with alternative ways to enter their compound.

With the increasingly wide applications of facial recognition, chances that the facial information of minors gets collected, too, are on the rise. "As minors have a weaker sense of personal information protection and are more curious about new technologies, their information is more likely to be gathered," Guo Feng, Deputy Director of the SPC research office, said. Guo said the new regulations reinforce the protection of minors' face-based records, making it compulsory to first obtain custodian consent. Cases involving the illegal management of the data of minors will be more strictly handled.

In a bid to balance both individual and public interests, the document has specified the circumstances under which punishment is waived, such as amid a public health emergency or for the protection of people's lives and health.

Yang Wanming, Vice President of the SPC, concluded that the consolidation of the judicial protection of personal information meets the people's expectations and is also a priority of the people's courts. The SPC will carry on its efforts to promote the legal, proper and efficient use of data and promote a healthy development of the digital economy.

(Print Edition Title: Saving Face)  

Copyedited by Elsbeth van Paridon

Comments to jijing@bjreview.com