Personal information protection sees new regulations across various regions

[2] Compiled from: CCTV News, Red Star News
 
 
Case review
Recently, a short video of a man "viewing an apartment while wearing a helmet" went viral online. The video featured a caption that read, "Wearing a helmet to view an apartment in order to protect personal information." For a time, the topic of how to protect personal information sparked widespread discussion among netizens.

 

[4] It also drew attention from local government authorities. Within just a few days, multiple regions took action: Tianjin, Nanjing, and Hangzhou introduced policies banning the illegal collection of facial information and the forced use of facial recognition. The nation is taking steps to protect personal information and safeguard our faces.
 
 
[5] Relevant policies
On December 1, the Regulations on Social Credit of Tianjin Municipality were adopted and will take effect on January 1, 2021.
 
Article 16 of the Regulations stipulates that market credit information providers collecting natural persons' information must obtain their consent and agree on the purpose of use, unless otherwise provided by laws and administrative regulations. Market credit information providers are prohibited from collecting natural persons' religious beliefs, blood type, diseases and medical history, biometric information, and other personal information that laws and administrative regulations prohibit from collecting.
 
Therefore, enterprises, institutions, industry associations, chambers of commerce, etc., are prohibited from collecting biometric information such as facial features, fingerprints, and voice.
 
In response to the incident of “wearing helmets while visiting sales offices,” Nanjing took the lead in taking action against facial recognition systems at real estate projects. Recently, the Nanjing Municipal Housing Security and Real Estate Bureau issued an emergency notice requiring that sales offices of real estate projects must not capture the facial information of visitors without their consent.
 
Meanwhile, some developers revealed that following Nanjing, the Xuzhou Municipal Housing and Urban-Rural Development Bureau also issued verbal notices to certain newly launched and ongoing property projects, requiring sales offices not to use “facial recognition” systems.
 
With the advancement of smart community construction, more and more residential areas are installing facial recognition access controls. Supporters claim facial recognition facilitates community security management, while critics argue that arbitrarily collecting personal information is illegal and even worry about adverse consequences from data leaks.
 
The revised draft of the Hangzhou Property Management Regulations, submitted for deliberation in October, stipulates that property service providers shall not force property owners to use shared facilities and equipment through biometric means such as fingerprints and facial recognition.

 
 

According to data, in addition to the Hangzhou revised draft, the "Property Management Regulations" in Anhui Province, Lanzhou City, Beijing, and other places also explicitly stipulate the protection of owners' personal information. However, these regulations do not clearly mention biometric information such as fingerprints and facial data, nor do they address the issue of forced collection. If the revised draft is passed, the "Hangzhou Property Management Regulations" will become the first formal legislation in China to regulate facial recognition in residential communities.
 
 
 
[1] The author's perspective
How to solve the problem of protecting personal information, including facial recognition data? From a legislative perspective, establishing and improving relevant laws and regulations is undoubtedly the most effective means. In recent years, the pace of formulating relevant laws and regulations in China has been gradually accelerating.
 
As can be seen from the upcoming "Civil Code," the names and biometric information of natural persons are considered personal information, and the act of collection is classified as a form of processing personal information. It requires that collection should follow the principles of legality, legitimacy, and necessity, without excessive processing, and must meet four conditions: first, obtaining the consent of the natural person or their guardian; second, disclosing the rules for processing information; third, clearly stating the purpose, method, and scope of processing information; and fourth, not violating laws, administrative regulations, or agreements between both parties.
 
The tide of technological development is mighty and unstoppable, but the collection and use of personal information must have boundaries. Facial recognition technology is a “double-edged sword”: when used properly, it can leave lawbreakers with nowhere to hide, but when abused, it can become an accomplice to those with ulterior motives. We hope the courts will improve and effectively implement relevant laws so that technology truly benefits the public.