Long criticized from the outside for its extensive use of facial recognition technology, China is preparing draft rules that would force private organizations to obtain user consent or “legal permission” before biometric data could be collected. This would likely not have any impact on the government’s operations, however, leaving questions about what private companies might be excepted from the new rules.
China’s new facial recognition rules define sensitive personal data categories, require demonstration of specific purpose
The new draft regulations were released by the Cyberspace Administration, and are currently subject to a public consultation period that ends on September 7. Barring any surprises, the rules will go into effect after that. The rules apply to all businesses in the country, but any organization that stores the facial information of over 10,000 people must register with the closest branch of the Cyberspace Administration.
The new rules for facial recognition technology require companies to protect personal information, and to demonstrate a “specific purpose” and “sufficient necessity” when collecting biometric data of this nature. “Strict” data protection measures must be employed when facial data is captured, and scanning must not negatively impact national security, public interests or social order. Face scanners also may not be installed in certain places, such as hotel rooms and restrooms, and must have prominent warning signs posted next to them.
Use of facial recognition technology to determine ethnicity, health status or religion is prohibited under the new rules. Any other processing of facial data requires either the consent of the individual or written legal permission. Parental consent must also be collected from those under the age of 14.
As these terms demonstrate, the government retains a free hand in picking and choosing how facial recognition technology can be used; true blanket protection for individuals is very unlikely. The terms specify a category of organizations that are “not required by laws and administrative regulations to obtain personal consent,” though these are not actually named as of yet.
Though the government maintains an extensive surveillance network, there has been recent public outcry about increasing facial recognition technology abuse by individual companies and organizations. The issue came to a head in 2020, when some locations throughout the country responded to serial toilet paper theft by installing a face scanner (manufactured by Tianjin Soline Technology) that limited restroom visitors to receiving paper just once every seven minutes. And in 2021, the Supreme People’s Court ruled in favor of a safari park visitor who objected to face and fingerprint scanning as a term of entry, calling for improvements to consumer protections.
This kicked off a string of examinations of companies using facial recognition technology that saw numerous fines for abuse handed out by local courts. The law is now stressing that the technology is meant almost exclusively for public safety, and will likely have to demonstrate a legitimate use of that sort. Businesses seeking to use it as a means of identification, such as banks and retail shops, will likely now have to abandon those plans. The law also states that buildings cannot use facial scans as the sole means of authorizing entrance, and that alternatives must be “reasonable and convenient.”
China restricts facial recognition technology while fielding criticism about its use
As tends to be the case with technology laws and regulations in China, there are two completely different sets of rules for the government (which reserves the right to profile by ethnicity or religion in the name of national security) and independent organizations. Those organizations that can demonstrate a public safety need for facial recognition technology are being told that they should first attempt to make use of information provided by the government’s own surveillance databases.
China has the world’s largest government-run centralized surveillance system by far, with its “Sharp Eyes” program fielding over 200 million cameras in both public and private spaces across the country (about four times more than can be found across the United States, though the US is slightly higher per capita). It also leads the world not just in deploying facial recognition technology domestically, but also in exporting similar systems to other countries. In 2019 this led to a US ban and blacklisting of a number of the country’s AI tech companies (such as HikVision, Megvii and SenseTime) due to their participation in the surveillance of Uighur Muslims residing in the Xinjiang province.
The government’s new rules appear to include no plans to slow down its own surveillance, and it would appear that some of these key tech players will be among the companies that the government grants its exceptions to. Some of the companies known to provide facial recognition technology have recently showcased new developments at trade shows, such as AI-driven behavior interpretation and accurate face scanning from increased distances (about as far as an NFL football field).
