Key Takeaways:
- China’s Personal Information Protection Law (PIPL), enacted in August 2021, received great attention to the scope and extent of personal information protection, in particular, that of facial recognition information.
- Facial recognition information belongs to sensitive personal information and is under the most stringent protection by the PIPL.
- A study of over 400 administrative punishment cases sheds light on the current attitude of the Chinese government towards facial recognition and provides a scenario to assess how China’s Personal Information Protection Law would apply should the cases occur today.
China’s Personal Information Protection Law (PIPL) was promulgated in August 2021, which received great attention to the scope and extent of personal information protection, in particular, that of facial recognition information.
The Judicial Case Academy of the Supreme People’s Court (SPC) of China posted an article on its social media account to analyze how the Chinese government finds the behavior of the parties in administrative cases of illegal facial recognition. These cases may shed some light on the current attitude of the Chinese government towards facial recognition.
The above article, contributed by Chu Xia (褚霞), is entitled "Analysis and Interpretation of 400+ Administrative Punishment Cases of ‘Facial Recognition’".
I. Under what circumstances will facial recognition be subject to administrative punishment
Taking “facial recognition” as the keyword, the author retrieved 422 administrative punishment cases of facial recognition through the Wolters Kluwer database.
All of these cases occurred before the promulgation of the PIPL.
Among them, 29 cases concerned personality rights protection and the real estate sales industry.
According to the decisions of the 29 administrative punishment cases, the parties subject to administrative punishment are all real estate developers.
The reasons for their punishment are mostly because they use facial recognition cameras and other equipment to capture and compare the faces of visiting consumers for the settlement of relevant expenses, for example:
(1) Some parties fail to inform consumers of their facial information collection;
(2) Although some parties inform consumers of their facial information collection through bulletin boards, they fail to explicitly indicate the purpose, method and scope of collection and use;
(3) Although some parties inform consumers of the method of facial information collection, they fail to explicitly indicate the genuine purpose and scope of their collection and use, nor do they obtain the consent of consumers;
(4) Although some parties have obtained the consent of consumers, they fail to explicitly indicate the purpose, method, and scope of their collection and use when collecting facial information.
The administrative supervision department believes that the above acts are in violation of the Law on the Protection of Consumers’ Rights and Interests (消费者权益保护法), the Measures for the Punishment of Acts Infringing on Consumers’ Rights and Interests (侵害消费者权益行为处罚办法) and other relevant provisions, infringe on the legitimate rights and interests of consumers, and therefore are punishable according to law.
II. Facial recognition under the PIPL
How will facial recognition be treated after the promulgation of the PIPL?
1. What is facial recognition information
Facial recognition information is a type of biometric data.
According to Article 28 of the PIPL, biometric data, religious beliefs, specific identities, medical and health, financial accounts, whereabouts and other information, as well as the personal information of minors under the age of 14, are sensitive personal information.
Therefore, facial recognition information belongs to sensitive personal information and is under the most stringent protection by the PIPL.
2. How should you handle facial recognition information
(1) Individual consent
The PIPL requires personal information processors to obtain the consent of data subjects before their personal information processing. If sensitive information such as facial recognition information is involved, individual consent of the data subject will be required. What’s more, laws and administrative regulations may even stipulate that the processor must seek the written consent of the individual in question.
(2) Proper notification
The PIPL requires that before the personal information processing, personal information processors should truthfully, accurately, and comprehensively inform individuals of the following matters in a conspicuous way and easy-to-understand language:
(i) The identity of the personal information processor;
(ii) The purpose and method of personal information processing, the type of personal
information under processing and the storage period;
(iii) Ways and procedures for individuals to exercise the rights of erasure and access stipulated in the PIPL;
(iv) Other matters that shall be notified according to laws and administrative regulations
When processing sensitive personal information, the personal information processor shall also inform the individual of the necessity of processing sensitive personal information and its impact on personal rights and interests.
3. How can the parties in the aforementioned cases comply with the law
According to the PIPL, such real estate developers should inform consumers of:
(i) their collection of consumers’ facial recognition information;
(ii) the collection purpose, i.e., to establish a file of potential consumers, so as to analyze consumers’ purchase willingness;
(iii) the necessity of facial recognition information collection, i.e., to set a higher price for consumers with strong purchase willingness.
Under such circumstances, no consumers would be unwise enough to allow real estate developers to collect their facial recognition information.
Therefore, the 29 administrative punishment cases provide us with a scenario to assess how the PIPL would apply in China should the cases occur today.
This also means that if the PIPL is strictly implemented, such ridiculous circumstances of personal information abuse will no longer exist.
Photo by Yaopey Yong on Unsplash
Contributors: Guodong Du 杜国栋
