Key takeaways:
- In August 2021, China’s Supreme People’s Court (SPC) issued “Provisions on Several Issues concerning the Application of Law in the Trial of Civil Cases Involving the Use of Facial Recognition Technology to Process Personal Information” (关于审理使用人脸识别技术处理个人信息相关民事案件适用法律若干问题的规定)，places stricter restrictions on facial recognition technology to protect the individuals’ facial information.
- The Provisions addresses disputes over facial recognition technology mainly from two perspectives, namely, liability for tort and liability for breach of contract.
- The Provisions sets out the circumstances under which facial recognition technology may infringe the parties' personality rights, and requires that no service provider or information processor may unilaterally compulsorily acquire or process the facial information.
On 1 Aug. 2021, China’s Supreme People’s Court (SPC) implemented a new judicial interpretation to unify the standards for the application of law by courts at all levels nationwide in hearing civil disputes involving facial recognition technology.
The said judicial interpretation refers to the “Provisions of the Supreme People's Court on Several Issues concerning the Application of Law in the Trial of Civil Cases Involving the Use of Facial Recognition Technology to Process Personal Information” (hereinafter referred to as “the Provisions”, 最高人民法院关于审理使用人脸识别技术处理个人信息相关民事案件适用法律若干问题的规定).
The Provisions places stricter restrictions on facial recognition technology to protect individuals’ facial information.
I. Background
In China, facial recognition technology has permeated every facet of people’s daily life, being used in various areas such as cellphone account login, digital payment, border defense, public transport, urban security, and epidemic prevention and control.
However, the personal information protection issue brought by facial recognition technology has also aroused public concern in China. For example, many stores may collect consumers' facial information, analyze their gender, age, mood, etc. without their consent, and then accordingly adopt different marketing strategies. Some people even publicly sell facial recognition data and other information.
The SPC holds that facial information is biometric, which makes it very sensitive, with strong social attributes and easiest access. Once divulged, it will do great harm to personal and property safety, and even threaten public security.
As a result, the SPC formulated the Provisions to resolve relevant civil disputes between civil persons arising from the use of facial recognition technology in processing facial information.
The Provisions addresses disputes over facial recognition technology mainly from two perspectives, namely, liability for tort and liability for breach of contract.
From the former perspective, the SPC believes that facial recognition technology may infringe the parties' personality rights, while from the perspective of the latter, it requires that no service provider or information processor may unilaterally compulsorily acquire or process the face information of the parties concerned.
II. Liability for tort
What rights may the facial recognition technology infringe on?
In accordance with Part Four of China’s Civil Code, a natural person enjoys multiple personality rights, including the right to privacy and the right to personal information protection. Biometric information, as a type of personal information, is also protected by the law; Any subject shall process the personal information of others in accordance with the principles of legality, rightfulness and necessity, and shall not handle it beyond the needs.
The SPC confirms that facial information is a type of biometric information. Therefore, where any subject fails to process the facial information under China’s Civil Code, it constitutes a violation of the natural person's personal information to be protected, i.e., the personality right.
Under what circumstances will the behavior of the relevant subject violate the natural persons’ personality rights in relation to their facial information? The Provisions lays out that the following situations are applicable where:
(1) the facial recognition technology is used for identity recognition, verification, or analysis in public places in violation of laws;
(2) the rules of facial information processing are not disclosed or expressly stated;
(3) no consent of the natural person or his/her guardian is obtained in the case where individual’s consent to the processing of the facial information is required;
(4) it is in violation of the express or agreed ways to deal with the facial information;
(5) the face information is led to be divulged, tampered, or lost;
(6) the facial information of the party concerned is provided to others; and
(7) the processing of facial information is against the public order.
Under what circumstances are the parties exempted from liability for processing the facial information? The Provisions sets out that the following situations are applicable where:
(1) it is of necessity to respond to public health emergencies or to protect the life, health, and property safety of natural persons in emergencies;
(2) it is to safeguard public security
(3) it is for news reporting and media supervision for the public interest; and
(4) reasonable processing of facial information is conducted within the scope agreed by the natural person or his/her guardian.
III. Liability for breach of contract
This perspective mainly includes two situations: one is the use of facial recognition technology under the offline property management service contracts; the other is the facial information processing under other types of contracts.
(1) Property services
Where the property management service enterprise or other building managers requests that facial recognition be the exclusive way for a property owner or user to verify his/her access to the property services area, the property owner or user may reject to accept the verification of his/her facial information, and require it to provide alternative verification methods to enter the property instead.
The underlying cause of these provisions lies in that currently in order to reduce the cost of identity verification, many property service enterprises or public place operators in China tend to force individuals to accept the facial recognition for place entrance. Now, the individuals may refuse such practice.
(2) Other types of contracts
An information processor has no right to request a natural person to sign an agreement with the processor containing standard clauses, stipulating that the natural person agrees on granting it the irrevocable and sublicensable right to process the facial information for an indefinite time limit. If such agreement is concluded, the natural person may apply to the court for invalidation of such standard clause.
If the information processor violates the agreement to process the facial information of a natural person, the natural person not only can request it to assume the liability for breach of contract, but also can request the information processor to delete the facial information, even if there is no such stipulation in the contract.
IV. Our comments
Being one of the many technologies that have been permeating the daily lives of Chinese people, facial recognition is very commonly used, which has also caused the prevalent abuse of such technology.
After SPC’s implementation of the Provisions, it remains to be seen whether there will be many people to file lawsuits over such issues and whether such lawsuits will actually curb the abuse of facial recognition technology. We expect to see how courts handle such disputes under specific scenarios in future cases.
Photo by Joshua Fernandez on Unsplash
Contributors: Guodong Du 杜国栋
