A wildlife park in Hangzhou has landed in some legal trouble after changing over its admissions process to a facial recognition system. A court has sided with a citizen in a lawsuit that claimed the sudden switch to this system without customer notification or consent constitutes privacy infringement and a breach of contract. While the compensation that the park has been ordered to pay is trivial, the ruling sets an interesting precedent for the handling of biometric information by private businesses in the country.
Abrupt introduction of facial recognition system ruled inappropriate
The case is important because it is the first facial recognition litigation to be ruled on under the terms of China’s consumer protection laws, which saw a significant update in 2014. It was brought by law professor Guo Bing after he arrived at the Hangzhou Safari Park on October 17, 2018 to find that the park’s former fingerprint verification system for entry had been “upgraded” to a facial recognition system. A sign informed visitors that unless they registered with the new facial recognition system, they would not be allowed access to the park.
The professor had purchased an annual park pass in April of 2018, and argued in court that he had not agreed to collection of facial biometric information when he purchased the pass. He pointed out that facial recognition information is more of a privacy infringement as it is more sensitive than fingerprints, and argued that it was much more likely to put consumers at risk if it was leaked in a data breach. The park refused to refund his money in return for cancelling his membership, which led to filing of the case in the Zhejiang province.
The court agreed that the park’s new requirement violated Article 29 of the Law of the People’s Republic of China on Protection of Consumer Rights and Interests, which requires business operators to meet certain standards in the collection of customer personal information. Businesses must meet a threshold of “legitimacy and necessity” under this law as well as clearly indicating to the consumer the “method and scope” of the information being collected.
The park has not scrapped the facial recognition system, but it has reinstated its previous fingerprint scan system as an alternative for entry in a bid to assuage concerns about privacy infringement.
China biometric privacy infringement rules begin to come into focus
While the 1,360 yuan (about $193) plus legal costs that the park is required to pay by the decision is far from a heavy penalty, the decision is worthy of note as it begins to illuminate how the Chinese government will handle the use of facial recognition information by the country’s businesses and potential privacy infringements.
The early government position would appear to be that while it considers the use of facial recognition systems to be “reasonable and necessary” for its law enforcement agencies, it will not be extending similar considerations to private businesses unless they can demonstrate a very good reason for putting them in place.
This policy is the opposite of the government’s established and widespread use of facial recognition systems, which have reached the doorsteps of certain public housing complexes in Hangzhou, Beijing and several other large cities. Some of the systems have been in place since 2016 and are capable of detecting non-residents that are on the premises, which some see as a form of privacy infringement. As of this year the country has about 626 million facial recognition cameras in place in public spaces. While the use of these systems is not yet uniform across the country, the larger cities such as Beijing and Shanghai are using facial recognition for purposes such as security checks at public transportation stations, picking up prescriptions at pharmacies and signing up for new phone service.
Public attitudes toward this mass rollout of facial recognition (and its attendant privacy infringement issues) has been mixed among residents of the country, and some observers wonder if this case might spark a national debate about how far into personal lives these high tech systems should be allowed to extend. At the very least, it would appear to inspire some pushback toward businesses collecting biometric personal data for reasons that they cannot justify.
Though the Chinese government is known for an authoritarian approach, it has relented on the use of facial recognition technology in the past in at least some limited circumstances. In late 2019, the government decided to pull facial monitoring apps out of universities in response to negative polling and widespread concerns about privacy infringements. The systems were being trialed at select universities and high schools for the purposes of attendance and monitoring of student behavior in the classroom. One high school provided teachers with a real-time feedback system that indicated student attention levels. The government issued a statement urging its schools to seek the feedback of students, teachers and faculty before implementing any such systems.
