Do you understand the 'red lines” and 'bottom lines” of face recognition?

In order to standardize the application of facial recognition technology, the Cyberspace Administration of China has drafted the "Regulations on the Security Management of Facial Recognition Technology Applications (Trial) (Draft for Comments)". The regulations were officially released to the public for comments on August 8, 2023, referred to as the "Draft for Comments on Face Recognition Technology"

Face recognition technology has been Controversial. Some supporters believe that face recognition technology has broad application prospects and has urgent needs in certain specific fields; while others hold objections and believe that the abuse of face recognition technology will seriously infringe the security of personal information

According to legal provisions such as the Civil Code, Cyber ​​Security Law, Data Security Law, and Personal Information Protection Law, it can be said that biometric information such as faces is personal information that needs to be protected. The application of facial recognition technology must consider the collection, storage, use, processing, transmission, provision, and disclosure of facial and other biometric information. This is a typical way of handling sensitive personal information. Therefore, it is necessary to formulate detailed technical rules and application specifications

Then, the publication and subsequent official introduction of the "Draft for Comments on Face Recognition Technology" will provide regulations and standards for the application of face recognition technology in our country. What are the impacts of development? What are the highlights of the "Draft for Comments on Facial Recognition Technology" that are worth paying attention to?

Five Highlights: Delineating “Red Lines” and “Bottom Lines”

The full text of the “Draft for Comments on Facial Recognition Technology” that is currently soliciting public opinions has a total of more than 3,200 words and consists of 25 clauses. , which is a typical "small incision" legislation.

The "Draft for Comments on Face Recognition Technology" aims to propose detailed and enforceable regulatory rules and requirements for the specification and management of the application of face recognition technology. It includes conditions for use, authorization rules, and application scenarios. , prohibitive requirements and the setting of rights and obligations are worthy of attention.

First, it clarifies the prerequisites for the application of face recognition technology. Including "reasonableness for specific purposes, sufficient necessity of application and strict protective measures when using". Simply put, facial recognition technology can be used to process facial information only if it has a specific purpose and sufficient necessity, and strict protective measures are taken.

Second, the licensing rules for facial recognition technology applications are refined. The "Draft for Comments on Facial Recognition Technology" proposes that the use of facial recognition technology to process facial information must obtain individual consent or written consent in accordance with the law. Except where laws and administrative regulations stipulate that individual consent is not required.

The third delineates the prohibitive scope of the application of face recognition technology. First, image collection and personal identification equipment must not be installed in places that may infringe on the privacy of others; second, image collection and personal identification equipment installed in public places must be necessary to maintain public security, comply with relevant national regulations, and set up prominent reminder signs.

Fourth limits the scope and rules for facial recognition technology to verify personal identity. First, unless laws and administrative regulations stipulate that facial recognition technology should be used to verify personal identity, individuals must not be forced, misled, defrauded, or coerced to accept facial recognition technology to verify personal identity on the grounds of handling business or improving service quality. Second, if an individual voluntarily chooses to use facial recognition technology to verify his or her identity, it should be ensured that the individual is fully informed and the process is carried out with the individual's active participation. During the verification process, the verification process should be immediately and clearly prompted in clear and understandable voice or text. Purpose.

The fifth clarifies the confidentiality and protection obligations of relevant parties to personal images and identification information. First, the construction, use, operation and maintenance units that install image collection and personal identification equipment in public places have the obligation to keep the personal images and identification information obtained confidential and shall not illegally disclose or provide it to the outside world. The collected personal images and identification information can only be used for the purpose of maintaining public security and may not be used for other purposes, except with the individual's separate consent. Second, organizations that install image collection and personal identification equipment for internal management should reasonably determine the image information collection area based on actual needs, and adopt strict protective measures to prevent illegal access, copying, disclosure, external provision, and dissemination of personal images. , to prevent personal information from being leaked, tampered with, lost or illegally obtained or used.

In addition, the "Draft for Comments on Facial Recognition Technology" also puts forward suggestions for establishing an impact assessment mechanism for personal information protection, and clarifies the relevant obligations and corresponding legal responsibilities for improper processing, storage, and use.

Fill the gap: The application of facial recognition technology will be "regulated and follow the rules"

Looking back on the development of facial recognition technology in China and the controversies it caused, there are two key time points that are very important. The first is the final verdict of the "First Facial Recognition Case", and the second is the release of relevant judicial interpretations

On April 9, 2021, the Hangzhou Intermediate People’s Court of Zhejiang Province issued the final verdict on the second-instance case of the service contract dispute between Guo Bing and Hangzhou Wildlife World Co., Ltd. This case became the “first case” involving litigation arising from the application of facial recognition technology since the implementation of the Civil Code. With the promulgation of the final judgment in this case, some legal remedies, judicial protection measures and business operation details regarding facial recognition technology have been clarified

On July 27, 2021, the "Supreme People's Court's Notice on the Trial of Users The Provisions on Several Issues concerning the Application of Law in Civil Cases Related to the Handling of Personal Information by Facial Recognition Technology (hereinafter referred to as the Provisions on the Trial of Facial Recognition Cases) were officially released and will take effect from August 1, 2021. The "Regulations on the Trial of Facial Recognition Cases" stipulate for the first time in the form of judicial interpretation the application of facial recognition technology, the damage that may be caused by the processing of personal information, and the judicial relief methods

For example, the "Regulations on the Trial of Face Recognition Cases" "Provisions on Recognition Cases" stipulates that the following behaviors are behaviors that infringe on the personality rights of natural persons: "Illegal use of facial recognition technology for face verification, identification or analysis in business premises, public places, etc.", "Failure to disclose rules for processing facial information or Failure to clearly state the purpose, method, and scope of processing," "Failing to obtain the separate consent of natural persons or their guardians to process facial information," "Processing in violation of publicity or agreement," and "Failure to take measures to cause facial information to be leaked, tampered with, or lost." , "Provide to others illegally or in violation of the agreement, and deal with it contrary to public order and good morals." For these acts, the right holder is given the right to sue for relief

The "Draft for Comments on Facial Recognition Technology" that is currently soliciting public opinions has a clear definition of what scenarios and conditions under which facial recognition technology can or cannot be used to collect data. or processing facial information have made provisions: detailed requirements have been made for the subjects and scenarios that can use facial recognition technology to collect or process facial information according to law, and the collection, storage, and processing of relevant information, that is, the relevant participation has been clarified responsibilities and obligations of the parties. This will have a positive impact on curbing the impulse of relevant subjects to use facial recognition technology and protecting personal information.

Before the "Draft for Comments on Facial Recognition Technology" was made public, there were certain gaps in my country's application standards and governance of facial recognition technology in the field of administrative supervision. By announcing and formally promulgating the "Draft for Comments on Facial Recognition Technology", it is expected to fill the administrative supervision gap in the application of facial recognition technology and achieve rules and regulations. In addition, it is also expected to play a positive role in the handling and resolution of disputes similar to the above. Of course, it should also be noted that delineating the "red lines" and "bottom lines" for the use of face recognition technology is the first step. , and more importantly, ensure that the subsequent "Safety Management Regulations on the Application of Facial Recognition Technology" can be effectively implemented after it is officially promulgated, and ensure that subjects, places or scenes that should not use facial recognition technology will not use the technology. If improper use occurs, regulatory authorities should pursue their responsibilities in accordance with the law

The above is the detailed content of Do you understand the 'red lines” and 'bottom lines” of face recognition?. For more information, please follow other related articles on the PHP Chinese website!