FOCUS TIGHTENS ON FACIAL RECOGNITION

Questions asked as use of the technology increases

A lawsuit brought by an associate professor at a university in Zhejiang province over use of facial recognition technology has resulted in him becoming headline news nationwide.

The legal case brought by Guo Bing has also been used to promote the drafting of laws and regulations related to protecting personal information.

For the past 18 months, Guo was featured in media reports, stemming initially from a text message he received from a wildlife park in Hangzhou, capital of Zhejiang.

The associate law professor at Zhejiang Sci-tech University bought an annual pass to Hangzhou Safari Park in 2019 after providing personal information, including his identity card number and fingerprints.

However, soon afterward, the park sent a text message asking him to register his facial recognition information, as it had just set up a face-scanning system for entry to the venue.

Guo could not understand why a safari park needed such data from visitors, but he complied with the requirement. "Anyone who refused to do so would be denied entry. I was forced to do this," he said.

In late 2019, he took the park to a local court, accusing it of breaching the membership contract, improperly collecting facial information and damaging consumers' rights.

Although judges in Hangzhou, after hearing the case twice, ruled that the park should delete Guo's facial data, he expressed dissatisfaction with the result, and appealed for a new hearing.

He said he needs a court to clarify whether facial recognition is covered by a clause in the contract between the park and a visitor, instead of just ordering the venue to remove his facial information for breaching the contract.

Guo said he is optimistic about winning the latest round in his fight to protect personal information, as the nation has attached great importance to the issue and taken measures, including drafting a law and stepping up inspections, to resolve irregularities.

In April 2019, Guo paid 1,360 yuan ($211) for a VIP pass to the park and agreed to use fingerprint recognition to enter the venue under the contract.

A short time later, he received the message requiring him to provide facial information for the venue's upgraded entry system.

Guo rushed to the park and asked who authorized the use of facial recognition technology. He also inquired about the devices used to implement it, "but no staff members were able to give me a clear answer", he said.

"It was a complete mess. I even saw workers scanning visitors' faces on their mobiles."

After failing to cancel his membership at the park, he sued the venue at Fuyang District People's Court in Hangzhou in October 2019 for contract violation.

The case, widely acknowledged to be the country's first lawsuit involving facial recognition, has triggering widespread public attention and discussion on the ever-increasing use of the technology in China.

A month later, the court ordered the park to pay 1,038 yuan in compensation for Guo's loss of contract benefits and to cover his transportation costs. The venue was also told to remove his facial data from its membership records.

Guo explained his decision to appeal to a higher court-Hangzhou Intermediate People's Court－which early last month upheld the original ruling.

"I couldn't accept the result, as the core problem of my litigation－whether a zoo has the right to gather people's facial information and whether the park is qualified to require facial recognition in the contract－had not been resolved," he said.

Early this month, Guo appealed to Zhejiang High People's Court for a new hearing. "A clear answer from justice on this issue is more significant for me, all the other VIP pass holders and people nationwide," he said.

Growing concern

Zhang Yiqun, 37, a Beijing resident who works for a technology industrial website, has been keeping a close eye on Guo's lawsuits.

He also voiced concern about facial recognition technology, with use of face scanners widening to include locations such as subway station entrances, residential compounds and hotel check-in desks.

"I understand and will accept the collection of facial information if it is used for national and public security, but I don't know why some vendors need to gather such data," Zhang said.

"The more personal details I provide, the greater the chance of them being passed on. I'm not sure whether those collecting the information, especially businesspeople and community management departments, can guarantee the security of my data," he said.

Zhang's concerns increased after China Central Television exposed a number of outlets, including internet platforms and shops, during an evening gala to mark Consumer Rights Day on March 15, accusing them of improperly or excessively collecting and using people's personal information.

For example, some employers at Zhaopin, a large online platform offering recruitment services, discovered they could access numerous job seekers' resumes if they became members of the platform. Many stores operated by leading bathroom brand Kohler were found to have installed cameras to gather consumers' facial data without their consent.

Kong Yiying, 32, who works for an advertising company in Guangdong province, said: "Scanning someone's face without their knowledge is too much. It's like theft.

"In my view, using facial recognition to pay online is much safer than any other method, but the user must get my permission. As a consumer, I've the right to know and choose who can collect my personal information."

Steps taken

Internet enterprises have paid close attention to the protection of personal information by introducing stricter measures. For example, Sina Weibo has used the Cybersecurity Law and related regulations to provide protective measures. The action taken is aimed at data classification, building a secure system for personal information, including the collection, storage and transmission of data.

"We save users' sensitive information through encryption to improve privacy security and to reduce the risk of data being released on the public network," the company said.

Growing public concern over the issue has attracted the attention of legislators and administrators, in turn accelerating the drafting of laws and increasing the number of inspections.

Cao Jianming, vice-chairman of the Standing Committee of the National People's Congress, the country's top legislature, said it is essential to give special and stronger protection to sensitive personal information.

"Abuse of and excessive or disorderly use of new technologies, especially artificial intelligence and facial recognition, have been seen more frequently at enterprises and government agencies," he said late last month while deliberating on a draft of the country's first law on protecting personal information.

Cao said the issue was becoming increasingly serious, adding, "Special administrative permission with stricter review is urgently needed when an employee or departments plan to use the technology."

Zhou Min, a member of the legislature, said facial data must only be collected or used for maintaining State and public security.

"We should pay close attention to businesses, such as real estate agencies, attempting to apply the technology and bar them from collecting facial data," she added.

Wang Chaoying, another NPC Standing Committee member, said providing facial information should not be compulsory.

"For example, a community management department should make other options available for people to prove their identities and grant them entry if they decline to use a facial recognition system," he said.

Although the draft will take some time to become law after further amendments, Guo, the associate professor, was pleased to learn that it calls for the Cyberspace Administration to introduce a special regulation governing the use of facial recognition technology.

Viewing this as a highlight of the draft, he said it means that those who have the right to apply the technology, and the way in which it will be used, will be regulated in "an administrative manner".

"A clear picture is needed urgently on the people who are qualified to use the technology. Naming a third party to assess whether those collecting such information have the ability to protect data is also crucial," Guo said.

"In simple terms, the application of facial recognition technology needs a threshold. Not everyone can use it."

In recent months, the Cyberspace Administration has taken a number of steps against irregularities in collecting personal data.

This month, more than 100 apps, including those used for navigation, security and online loans, have been ordered not to collect users' data without permission. They have also been told they cannot obtain personal information that has nothing to do with the services they offer.

Last month, the Ministry of Industry and Information Technology announced a rule on the management of personal data protection on apps, with the public asked to share ideas and offer advice before May 26.

In addition, a draft amendment to the regulation in Hangzhou makes it clear that community management departments should not force residents to obtain entry through facial recognition. This is reportedly the first local regulation on the use of such technology to be introduced nationwide.

Answers sought

With legislative and administrative measures on the collection of personal information being accelerated, legislator Li Wei said deleting such data that has been collected should be further considered, especially with the pandemic being contained in China.

"To help keep the COVID-19 outbreak in check, almost everyone has had their personal data collected and used. I think several questions, such as how long the data needs to be kept and when the information can be destroyed, should be answered. Otherwise, people will feel unsafe and face data security risks when the pandemic ends," he said.

Feng Dan, an NPC deputy, said: "Residents have provided personal information to help and support many government agencies, including hospitals and parking administrations, to efficiently trace cases of infection. However, there have been no rules on deleting the data after the pandemic," she said, adding that this is just as important as obtaining the information.

Zhao Zhanling, a lawyer at the Beijing Yujia Law Firm, suggested the country give residents the right to apply for the destruction of their personal information if they cancel accounts with apps.

He called for cyberspace administrators to play a supervisory role to ensure personal data can be effectively removed from apps.

"For example, the top internet watchdog can inspect app operators randomly or organize campaigns to see whether users' requests for the removal of personal data are being met," he added.

caoyin@chinadaily.com.cn