No compulsory request for unnecessary personal information. Supreme Law issues judicial interpretation, regulates face recognition applications.
In recent years, with the rapid development of information technology, face recognition has gradually penetrated into all aspects of people’s lives. Face recognition technology plays a great role in many fields, but it is also abused. Today (28th), the Supreme People’s Court issued a judicial interpretation to regulate face recognition.
Application of face recognition in judicial interpretation norms issued by the Supreme Law
According to the relevant person in charge of the Supreme Law, in recent years, some operators have frequently abused face recognition technology to infringe on the legitimate rights and interests of natural persons, which has aroused widespread concern and concern of the public.
Yang Wanming, Vice President of the Supreme People’s Court:For example, some well-known stores use "non-inductive" face recognition technology to collect consumers’ face information without consent, analyze consumers’ gender, age and mood, and then adopt different marketing strategies. The above-mentioned behaviors seriously damage the personality rights and interests of natural persons and need to be regulated urgently.
The Supreme Law formulates judicial interpretations on the basis of full investigation and provides judicial protection for face information. The explanation clearly stipulates that the use of face recognition technology for face verification, identification or analysis in hotels, shopping malls, banks, stations, airports, stadiums, entertainment places and other business places and public places in violation of laws and administrative regulations should be considered as an act that infringes on the personal rights and interests of natural persons.
Property shall not force face recognition as the only verification method for entering and leaving the community.
With the continuous enrichment of application scenarios of face recognition technology, some communities have introduced face recognition systems and replaced "swiping faces" with "swiping cards". There are different views on this from all walks of life. Some people think that using face recognition as a household identity verification method is an intelligent management, which can more accurately identify people entering and leaving the community and make community management safer and more efficient. Some people also believe that when entering face information, residential property requires that face information be bound with detailed address and identity information. Once this information is leaked, it may damage citizens’ personal privacy. Then how does the newly introduced judicial interpretation view this? Continue to look at the report.
The relevant person in charge of the Supreme Law said that the problem of compulsory "face-brushing" of residential properties is of general concern to the society. Face information belongs to sensitive personal information, and the collection and use of face information by residential property must obtain the consent of the owner or property user according to law. Only when owners or property users voluntarily agree to use face recognition can the collection and use of face information have a legal basis.
Samuel Kwok, Deputy Director of the Supreme People’s Court Research Office:In practice, some residential properties force residents to enter face information, and face recognition is the only verification method for entering and leaving the residential area. This behavior violates the principle of "informing and agreeing", and the masses have a loud voice of doubt. We should embrace new technology, but at the same time we should respect the rights and interests of personality. Residential property cannot infringe on residents’ personality rights and interests on the grounds of intelligent management.
To this end, the "Regulations" clarify: "Property service enterprises or other building managers use face recognition as the only verification method for owners or property users to enter and leave the property service area. If the owners or property users who disagree request them to provide other reasonable verification methods, the people’s courts will support them according to law." According to this regulation, when using the face recognition access control system to input face information, the residential property shall obtain the consent of the owner or the property user. For the owner or the property user who disagrees, the residential property shall provide alternative verification methods, and shall not infringe on the personal rights and other legitimate rights and interests of the owner or the property user.
Supreme Law: The processing of minors’ face information requires the sole consent of the guardian.
With the more and more extensive application scenarios of face recognition, there are more and more scenes where the face information of minors is collected. Once the face information of minors is leaked, the infringement effect may even accompany them for life. Therefore, the new judicial interpretation has made special provisions on the protection of minors’ face information.
According to the relevant person in charge of the Supreme Law, China’s Law on the Protection of Minors, Cyber Security Law and other laws have made special provisions on the network protection of minors: if an information processor processes the personal information of minors under the age of 14, it should obtain the consent of the parents or other guardians of minors; If minors, parents or other guardians ask the information processor to correct or delete the personal information of minors, the information processor shall take timely measures to correct or delete it. The new judicial interpretation adheres to the principle of being most beneficial to minors and strengthens the protection of minors’ face information from the judicial trial level.
Samuel Kwok, Deputy Director of the Supreme People’s Court Research Office:According to the principle of informed consent, according to the provisions of Item 3 of Article 2, information processors must obtain the independent consent of their guardians when processing the face information of minors. The specific age can be determined according to the Law on the Protection of Minors, the Law on Cyber Security and the future Law on the Protection of Personal Information.
According to the Supreme Law, from the perspective of responsibility identification, the new regulations clearly take "whether the victim is a minor or not" as a special consideration factor for responsibility identification in combination with the current situation of protection of minors’ face information. For those who illegally handle minors’ face information, they should be severely punished according to law to ensure that minors’ face information is specially protected according to law and care for the healthy growth of minors.
Applications must not force unnecessary personal information.
For a long time, some mobile applications have been forced to ask for unnecessary personal information through a package of licenses, binding with other licenses, and "not providing services without clicking on consent", which is not only a pain point for users, but also a difficulty in safeguarding rights. In this regard, the judicial interpretation has clarified such new rules for dealing with face information.
According to the Supreme Law, since face information belongs to sensitive personal information, processing activities have a great impact on personal rights and interests. Therefore, it is necessary to set a higher standard in informing consent, so as to ensure that individuals can reasonably consider the consequences of their own rights and interests on the premise of full knowledge.
Chen Longye, Director of Civil Affairs Department of the Supreme People’s Court Research Office:Item 3 of Article 2 of the Regulations introduces the individual consent rule, that is, when obtaining the individual consent, the information processor must obtain the individual consent for the face information processing activities alone, but not by means of blanket notification and consent.
According to the Supreme Law, personal consent is the legal basis of information processing activities based on personal consent to process face information. As long as the handler does not exceed the scope agreed by the natural person, in principle, the act does not constitute an infringement. The principle of voluntariness is the basic principle of the civil code, and the individual’s consent must be based on his voluntariness.
Chen Longye, Director of Civil Affairs Department of the Supreme People’s Court Research Office:In particular, the processing of face information can’t be forced by any factors. If the information processor adopts the mode of "binding with other authorizations" and "not providing services without clicking on consent", it will lead to the natural person being unable to voluntarily agree to face information alone, or being forced to agree to handle face information that he does not want to provide and is unnecessary.
In order to strengthen the protection of face information and prevent information processors from improperly collecting face information, Article 4 of the Regulations adopts the idea of strict identification of effective consent to face information processing. If the information processor forces or forces a natural person to agree to process his face information by means of "binding with other authorizations" or "not providing services without clicking on the consent", the people’s court will not support it if the information processor thinks that he has obtained the corresponding consent.
It is clear that face recognition can be used in five situations.
Just now, we have learned a lot about the regulations prohibiting and restricting the use of face recognition, so is it true that face recognition cannot be used at all? Under what circumstances, information processors can use face recognition technology to collect personal information, and the new regulations are also listed.
The new regulations are clear. In any of the following circumstances, if the information processor claims that it will not bear civil liability, the people’s court will support it according to law:
(1) Processing face information in response to public health emergencies or in case of emergency to protect the life and health of natural persons and property safety;
(two) in order to maintain public safety, according to the relevant provisions of the state to use face recognition technology in public places;
(3) Handling face information within a reasonable range by conducting news reports, public opinion supervision and other acts for the public interest;
(4) Handling face information reasonably within the scope agreed by natural persons or their guardians;
(5) Other circumstances that meet the provisions of laws and administrative regulations.
Yang Wanming, Vice President of the Supreme People’s Court:The Regulations fully consider the positive role of face recognition technology. On the one hand, it regulates information processing activities and protects sensitive personal information. On the other hand, it pays attention to promoting the healthy development of digital economy and protecting the legitimate application of face recognition technology.
In order to avoid imposing excessive responsibilities on information processors and properly handle the relationship between punishing infringement and encouraging the development of digital technology, Article 16 of the Regulations clarifies the basic rule of non-retroactivity of this judicial interpretation, that is, this regulation does not apply to information processors who use face recognition technology to process face information or face information generated based on face recognition technology before the implementation of these regulations.
(CCTV reporter Li Wenjie)