On July 27th, 2021, the PRC Supreme People’s Court issued the Provisions of the Supreme People’s Court on Several Issues Concerning the Application of Law in the Trial of Civil Cases Involving the Processing of Personal Information Using Facial Recognition Technology (hereinafter as the “Provisions”), which is a total of 16 articles and has come into force as of August 1st, with the legal effect of judicial interpretation. The Provisions focus on the legislative perspective of consumers and users and provides relief through the channel of Tort in cases of infringement on personal information and particularly biometric information obtained with the use of Facial Recognition Technology (i.e., in such cases the user may in principle claim the violation of his or her personal rights and claim compensation based on the actual losses suffered).
Facial Recognition Technology refers to a series of related technologies that automatically detect and track faces in an image based on facial features (hereinafter referred to as “facial information”) and conduct data analysis to achieve the purpose of facial recognition. Due to the convenience and non-contact feature of facial recognition, this technology is widely used, however it does have the tendency to be abused. For example, certain property sales centers have implemented facial recognition systems to recognize visiting customers for the purpose of identifying the sources of the customers, which in turn, led the use of helmets by customers to avoid such recognition and avoiding to lose any benefits granted to first-time or referred customers only. If we discuss facial recognition in a broader sense, the field of facial recognition even includes the app “ZAO”, an AI face-changing app that caused public controversy and was banned in 2019.
Unlike the monitoring equipment that only takes images or video clips without further storing for recognition purposes, facial recognition has the additonal function of recognition, and such fields include not only identity verification/recognition but also customer data analysis, behavior analysis and other areas closely related to the customer privacy. It is undeniable that facial recognition, as cutting-edge technology, currently lacks corresponding legislation and policies to form effective supervision. Therefore, with the promotion of social development and public opinion, the supervision of facial recognition was bound to be gradually improved and strengthened.
Under such background, we have witnessed the promulgation of the Provisions. Although the Provisions are merely judicial interpretations, it is the first exploration at the pre-legislative level nationwide under the current legislative framework, and it still has an important role that cannot be ignored. In terms of effectiveness and practical value, as the courts and judges should follow judicial interpretations in the trial process, the Provisions have no less status than legislation in cases involving face recognition. On the other hand, with the new Personal Information Protection Law of the People’s Republic of China, released on August 20 and set to take effect on November 1, it is easy to conclude that the Regulations are the first step in legislation for a cutting-edge technology like facial recognition.
The Provisions outlines that facial information falls under the category of “biometric information” stipulated in Article 1034 of the Civil Code of PRC, which is within the personal privacy information protection scope. The collection, storage, use, processing, transmission, provision and publication of face information all belong to the behavior of “processing” facial information..
Accordingly, the Provisions emphasize that the processing of facial information needs to follow the “principles of legality, legitimacy, and necessity”, and shall expressly indicate the purpose, mode, and scope of processing to the user, and obtain the user’s clear and written consent. If the use of facial recognition violates the above compliance requirements, the Court shall determine that the activity constitutes an infringement of the personal rights of a natural person.
In addition, based on the 2017 Interpretations of the Supreme People’s Court and the Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Involving Infringement of Citizens’ Personal Information, the Provisions also specify that any user authorization obtained by abusing the standard terms of contracts, by using bundled authorization, or by refusing to provide main business services without granting the authorizations (unless the processing of such facial information is necessary for providing the product or service) and by other coercive ways shall not be valid as a defense. This will constitute a relief to some extent for the current weak position of users & consumers against information service providers, but the specific effect needs to be further observed due to its legislative positioning.
In summary, we can see that stakeholders expect the provisions to contain or prevent, to some extent, the abuse of users and customers’ facial information by information processors. The actual result and effect needs to be followed and observed at a later date, especially following on from the implementation of the new Data Protection Law and the Personal Information Protection Law.
