China’s top court has made a key judgment related to facial recognition technology, empowering individuals to reject unauthorised facial recognition data collection by commercial entities such as hotels, banks and nightclubs.
The decision, which is included in a directive issued to local courts this week by the People’s Supreme Court, makes it clear that any collection and analysis of facial data by commercial operations must receive the “independent” consent of the individual concerned. If not, the act of using facial recognition technology can be defined as an infringement of personal rights and interests, a civil offence that allows the victim to file a lawsuit and claim compensation.
The directive will likely have far-reaching consequences for China’s booming surveillance camera and related data systems industry, increasing legal and operating costs. It also redefines the legal boundary between privacy and surveillance at a time when hotels, shopping malls, bank branches, train stations, airports, stadiums and entertainment venues across China are rushing to install facial recognition systems to digitalise their operations, often without individual consumer consent.
“The Supreme Court was in a hurry. It didn’t even wait for the Personal Information Protection Law to be rolled out,” said He Yuan, executive director of Shanghai Jiao Tong University’s Data Law Research Centre. “Because it cannot wait anymore.”
Although facial recognition technology has been widely-adopted in China, laws pertaining to invasion of privacy have been vague. For example, in China’s first facial recognition lawsuit that took place in Hangzhou, a law professor sued a local zoo for denying entry to customers who did not use its new facial recognition access control system.
Despite ruling in favour of the professor, the Hangzhou court did not determine
whether it was legal for the zoo to only allow entrance by facial recognition, but instead made its judgment based on breach of contract.
He said that the new directive from the Supreme Court, which will come into effect on August 1, will provide a clear legal basis and guidance for local courts on how to handle similar cases.
However, the Supreme Court decision on facial recognition technology only covers civil disputes. Chinese police and other government authorities are still legally empowered to use facial recognition technology for the purposes of public security. Chinese police, for instance, have taken advantage of facial recognition cameras at airports and stadiums to spot wanted criminal suspects. The traffic authority in the southern tech hub of Shenzhen has used facial recognition technology to name and shame jaywalkers.
The new directive should help to address public concerns over data leaks from for-profit facial recognition collection. Physical shops, including those operated by international brands including Kohler and BMW, were found to have been discreetly using facial recognition on visitors for sales purposes in China, and were named and shamed at this year’s consumer gala broadcast by the country’s state-owned central television.
The “independent consent” requirement means a person’s facial data must be requested separately from other information requests. As long as facial information is involved, “bundled consent” – a popular digital business practice whereby someone is asked to consent to multiple requests in one swipe – will be outlawed, according to the Supreme Court’s judicial interpretation.
The Covid-19 pandemic has pushed more residential communities into adopting facial recognition access control systems, due to the limitations on physical gatherings imposed by lockdowns. Last year, a law professor in Beijing publicly voiced opposition to a decision by her residential property management to use facial recognition as the only access control system.
According to this week’s Supreme Court directive, in the case where a resident of a property refuses to use facial recognition for access control and requests an alternative entry method, courts should support such requests.