Steps mulled to regulate facial recognition tech

China's top internet regulator started seeking suggestions from the public on Tuesday on a draft regulation on facial recognition technology, as the nation aims to provide more advanced and stronger protection of Chinese people's personal information and biological data.

The full version of the 25-article draft focusing on the application security of the technology has been published online by the Cyberspace Administration of China.

Facial recognition, a major feature of artificial intelligence, has been widely applied in recent years in fields such as public transportation and security management, but it has also led to some concerns over the misuse of this data.

To respond to these concerns, the country has stepped up efforts to regulate the use of the technology. In 2021, for example, it adopted the Personal Information Protection Law, calling for stronger protection of sensitive information, along with a judicial document dealing with civil lawsuits involving technology.

Zhao Zhanling, a lawyer from Beijing Yunjia Law Firm, welcomed these moves, but said they have yet to "solve a few practical problems, such as where the technology could be applied and what obligations its users should have".

While highlighting the importance of technological security, he said that the newly released draft offers some answers to related problems.

For instance, the draft clarifies that any party responsible for processing someone's facial information with face-scanning technology should first obtain his or her permission, and such information can only be further processed under strict safeguards.

It specifies that hotels, banks, stations, airports, sports venues, exhibition halls, museums, art galleries, libraries and other business places, should not force, mislead, coerce or threaten individuals to accept the technology to verify their identity on the grounds of handling business or improving service quality, unless the current laws or administrative rules have already required the use of the technology.

It also states that those who install, use or maintain cameras or other facilities to collect images or verify the identity of individuals in public places are obligated to keep the collected information confidential.

In addition, it said the users of this technology must make a filing with the local cyberspace department within 30 days if they use it in public places, or store the facial information of more than 10,000 people.

Furthermore, it stipulates that community management departments should make other options available for residents to prove their identity and grant them entry even if they decline to use a facial recognition system.

Zhao said that such a regulation focusing on the application of this technology is essential and timely, "as it's related to individual's rights and interests, as well as public security".

"Facial information is sensitive, so everyone, especially the information handlers, should be more prudent in its application," he added.

Before the release of this draft, the Cyberspace Administration of China had also mentioned facial recognition technology in its data security regulation in 2021.

Postal and e-mail addresses for collecting the public's suggestions have been put on the administration's website, and the deadline for these is Sept 7.