On November 20, 2020, the Fuyang District Court of Hangzhou City held a trial in the case of Guo Bing v. Hangzhou Wildlife World Park. The court held that the collection of face recognition information exceeded the requirements of the necessary principles and was not justified.
Wildlife World Park was ordered to compensate Guo Bing RMB1,038 yuan and deleted the facial feature information including photos submitted by Guo Bing when he applied for the annual entrance card.
At the same time as the verdict of China’s first legal case relating to face recognition usage, the Ministry of Public Security issued a “Technical Requirements for Information Security Technology of Remote Facial Recognition System”. The new guidelines were implemented in November.
The Ministry of Industry and Information Technology also required apps to collect personal information such as user pictures and facial data with the principle of "minimal necessity". It means only minimal amount of data should be collected.
China’s local governments are issuing their own regulations. "Tianjin Municipal Social Credit Regulations" was voted and passed in December. The collection of facial recognition information was publicly prohibited for the first time in the country. Tianjin’s new regulations will be implemented on January 1, 2021, stipulating that enterprises, institutions, industry associations, and chambers of commerce are prohibited from the collection of biometric information such as faces, fingerprints, and voices.
Specially, where a market credit information provider collects natural person information, it shall obtain the consent of the individual and agree on the purpose, unless otherwise provided by laws and administrative regulations.
Market credit information providers must not collect natural persons’ religious beliefs, blood types, disease and medical history, biometric information, and other personal information that is prohibited by laws and administrative regulations.
The news that the collection of face recognition information was prohibited caused a huge stir in the Tianjin Cultural Village community. The community’s face recognition access control system has been in place for nearly three years.
The neighborhood committee had to “react quickly” and notify all residents of the community through WeChat groups, posting notices, and broadcasting messages. Residents are told to make their own decision before December 31 on whether to continue to use face recognition to enter and exit the community’s entrance gates.
As of December 24, 2020, among the more than 600 residents of Tianjin Cultural Village, nearly 50 households have chosen not to use the face recognition access control system. But the majority of residents still decided to continue using it.
After signing his name on the community’s consent form, Wang Qiang is still willing to use face recognition to enter and exit the community.
"I just go to the door, after successfully swiping your face, the door will open," The 75-year-old Wang Qiang is a loyal fan of the community’s face recognition access control system. "It’s very convenient comparing to the access card, which I sometimes forget to bring or lose."
After hesitating for a long time, Li Ling finally chose to agree to continue to use face recognition access control as well. "It just makes it easier and saves trouble," she said. Regarding the issue of potential data compromises, she bluntly said that she was worried, but she still chose to trust the community committee.
Some residents decided to request the deletion of facial information and photos. Li Jie was one of them. She is not a permanent resident of the community, and only needs to visit her parents frequently. She is always concerned about data security. "Where is the information stored? Will it be leaked? Will there be trouble?"
According to Gao Wen, the face recognition system used in the Tianjin Cultural Village mainly recognizes the information of the eyes and areas above the mouth. Even if you wear a mask during the pandemic, you pull the mask under your nose, the system can still recognize residents.
"There is indeed a situation that the system would fail. There was an old man, his hair was short before when he submitted his facial data. Later, because his hair was long and covered his eyebrows, the system could not recognize it. There were also children who gained a lot of weight, which caused the system to be unable to recognize them," Gao Wen said. In this case, you need to delete the original photos and re-enter new photos.
For those residents who continue to choose to use face recognition, apart from convenience, they find the system is making the community safer and more orderly.
Bo Jinrui said that because there are many hospitals around the community, people who visited the hospitals used to always park their cars in the community, taking up parking space that’s already limited and causing problems for residents to fine parking lots.
"At that time, from three o’clock in the afternoon, there were grandparents who would come out to occupy parking spaces for their children. There were always disputes and arguments over parking spaces," he said.
Now, all the community residents’ car license plates are entered into the system. Unregistered external vehicles cannot enter the community. It has totally solved the parking space problem.
The system also installed more than 70 cameras that are connected to the intranet. “When there are disputes of other sorts, the neighborhood community calls the police and ask them to check the camera footage to see evidence to help solve the problems,” Bo Jinrui said.
From February 2018 to the present, in the nearly three years of using the face recognition system in the Tianjin Cultural Village, there has not been a burglary. Before this, there were two or three burglaries in the community every year.
For the neighborhood committee, the face recognition system also was a great help during the pandemic. They can track who has traveled and monitor quarantine requirements.
It was not initially a popular idea among residents when the face recognition system was launched three years ago. It encountered resistance from individual residents in the community. Some residents said that they had seen people were angry and kicked the door forcefully for several days, eventually damaging the entrance gate.
"The biological characteristics of the human body cannot be reset. Once it is leaked, the consequences are unimaginable," Chen Hongbo, a network security expert, said that as long as the facial information of citizens is collected, it is possible to combine the home address and mobile phone number, ID number and other personal information to form a user portrait of personal information. "Technically speaking, it can even simulate human blinking, nodding, shaking head, which is very dangerous."
Xu Weidong, an associate professor at Hangzhou Dianzi University, also expressed the same view, “If the password is leaked, you just need to reset it. But once the biometric information such as the face is leaked, you may no longer be able to find a remedy."
"There are a lot of information that can be compared, such as interpupillary distance, face shape, mouth shape, eyebrows, eyebrow spacing and other biological information that cannot be changed," Xu Weidong said, whether a person becomes thin, fat, or old, unless he undergoes plastic surgery, it is possible to invalidate the leaked biological information.
Chen Hongbo pointed out that behaviors such as hacker attacks, information leakage, and company employees’ active reselling of data, may cause face information to be traded, abused, and disseminated.
In recent years, China has issued a series of related requirements to regulate the collection of personal information, and the "Personal Information Protection Law (Draft)" has also been publicly solicited for comments in October 2020.
In these laws and regulations, it is clearly stated that the collection of personal information should comply with the principle of "minimum necessity", the rules for collection and use should be made public, the purpose, method and scope of the collection and use of personal information should be clearly stated, and personal information should not be collected and used without the consent of the user.
Personal information should not be provided to others, the function of deleting or correcting personal information should be provided, and methods of complaints and reports should be published.