Good governance of facial recognition devices can better protect personal data

As the 2024 World Internet Conference Wuzhen Summit unfolds in Wuzhen, a water town in East China's Zhejiang province, from November 19 to 22, with artificial intelligence as its centerpiece, the broader implications of emerging technologies, including facial recognition devices, demand attention. While this technology enhances efficiency and convenience, its rapid proliferation across public and private sectors underscores the need for robust regulations to safeguard privacy, prevent misuse, and ensure ethical deployment in a society increasingly shaped by AI.

The application of facial recognition technology increased exponentially in China during the COVID-19 pandemic, with the momentum continuing until now. Data collection, data processing and the facial recognition device business have continued to grow thanks to the fast-paced development of information and communications technology. However, this has given rise to some security problems, including increasing the risk of personal information theft and misuse.

The use of facial recognition technology can improve personnel management and help prevent incidents. But since a person's face is the most important piece of personal information, the collection of facial data of natural persons must be lawful and devoid of potential risks.

The problems related to facial data that have arisen in recent years can be mainly attributed to the lack of transparency in data collection, storage and usage.

Hence, the legality of collecting facial data in public places needs reassessment. Given the grave threat the pandemic posed to people's health and life, the installation of facial recognition devices to collect facial data in public places, including universities, government buildings, plazas, railway stations, airports and hospitals was justified.

But is it still necessary and legal to maintain and even increase the use of facial recognition devices in public places? Except for certain places where tight public security is always needed to ensure the safety of people and safeguard national security, public places such as universities, shops and communities must follow strict legal procedures for collecting and handling personal data using facial recognition devices.

The lack of transparency has prompted some to ask whether it is still necessary to collect facial data in public places. They have also questioned the manner in which facial data and other personal information are collected, stored and used.

Personal data are mostly collected and handled by institutions and organizations with government consent, while individuals whose facial data are collected are rarely informed about it. This lack of transparency is not in the interest of those people whose personal data are collected. Individuals whose data are collected are exposed to higher risks given the rising commercial value of personal data and their misuse in criminal activities.

It would be a shocking irony if individuals' personal data, including facial data, are used by some to commit a cybercrime or any other crime. Private information, especially facial data, of individuals is highly sought after by both marketing experts and criminals. The latter use such information to commit crimes. Hence, it is important to prevent personal data leaks and reduce security risks.

Effective governance of facial recognition systems in public places is a pressing need. First, government agencies should issue detailed, implementable guidelines in accordance with laws including the Cybersecurity Law and the Personal Information Protection Law. This will help institutions better handle related issues.

Second, facial recognition systems should be classified by functions and locations. While facial recognition devices should continue to be used in high-security areas such as airports, and railway and bus stations, their use in other places should be restricted or prohibited.

Third, the use of facial recognition systems should be based on improved standards. And individuals should be encouraged to supervise the use of individuals' personal data or give suggestions on how to make their use less intrusive. In fact, public participation can help establish a more balanced and transparent data management framework.

And fourth, preemptive measures should be taken to prevent the leak or theft of personal data. Steps should also be taken to ensure facial recognition devices and software follow safe practices and better safeguard personal data security. And the authorities should make sure individuals and companies violating the laws related to personal data safety are penalized to deter potential violators.

By taking these measures, China can better manage facial recognition systems in public places as well as protect individual privacy and security.

Wang Sixin is director of the Research Center for Cyber Law and Intellectual Property, Communication University of China. Ling Yunfei is a PhD candidate at the School of Marxism, Lanzhou University.