Data privacy Illustration: VCG

As the plaintiff of China’s first facial recognition-related legal case, which involved an individual suing a park for improperly collecting his facial recognition information, Guo Bing said he was not satisfied with the court’s first-instance verdict on November 20.

The court ordered the case’s defendant, Hangzhou Safari Park in Hangzhou, East China’s Zhejiang Province, to pay Guo compensation of 1,038 yuan ($157.7) and to delete his facial information. Days earlier, the park repeatedly asked Guo for his latest facial recognition information for activation of his annual admission card, although Guo had had his fingerprints and photo taken by the park when applying for the card last year.

The court dismissed some of Guo’s requests in the first instance, such as requesting that the court declare invalid the park’s claim that visitors’ biometric information is their only form of entrance permission. 

Unhappy with the result, Guo told the Global Times that he has decided to appeal.

A legal expert himself, Guo believes that it is neither necessary nor safe for the park to force visitors to provide their facial information, which has seriously violated individuals’ privacy. “[Similar situations] of citizens’ personal information being excessively collected and used are too common nowadays,” he said.

Some surveys seem to show the issue that Chinese people face in this information era. As many as 77.7 percent of internet users in China have suffered varying degrees of financial, time or energy losses in various information security incidents, according to a report released by China Internet Network Information Center in 2019.

Information security has turned into a public concern along with the inevitable trend that more private data will be recorded for people to enjoy the convenience of technology, said He Lingnan, a big data and communications scholar at Sun Yat-sen University.

How to safeguard citizens’ personal information and improve their awareness of privacy protection, therefore, is not only an increasingly urgent task for China’s lawmakers and authorities, but also an important step to achieve the goal of accelerating digital development that China has set in its the latest 14th Five-Year Plan (2021-2025) for National Economic and Social Development, experts noted.

Crossing a line

Including Guo’s case, sporadic cases of companies inappropriately collecting personal facial information have occurred in many places across China with the gradual popularization of this technology, raising doubts about its validity.

Some real estate agencies in Hangzhou, for instance, take photos of their potential clients with hidden cameras and secretly share their information with local counterparts, said a few local house purchasers reached by the Global Times. This is to “identify whether the clients have been to other agencies,” they said.

The agents, attempting to lock in the clients, will threaten to charge the purchasers the higher prices offered by other firms. 

Li Ang, a house buyer in Hangzhou, said his facial recognition information was secretly collected at a local agency earlier this month. Li hadn’t been aware of the collection until the agency told him about it when he said he would like to shift to another agency.

Li was worried the agent would share his photos with other firms. “I was extremely disgusted by this dirty trick,” he told the Global Times.

The face recognition system that some enterprises use is for their own commercial purposes, rather than to protect the rights and interests of their clients, He said. 

Worse still, they collect facial information without consent, which “is unacceptable and brings great risks to the security of customers’ biological information data,” He noted.

Similarly, Best Express, an express delivery outlet in a community in Shanghai’s Jinshan district, had been photographing people who take their packages there, reported Xinmin Evening News on November 13.

A community resident surnamed Zhu confirmed to the Global Times that he had been asked to have his photo taken at the outlet. Though feeling confused, Zhu let the outlet staffers collect his facial information. “They explained that it was to prevent some people from falsely claiming the packages as their own,” he recalled.

The outlet stopped the facial information collection recently after being exposed by local media reports, a staffer surnamed Liu, who works at the Shanghai branch of the express company, told the Global Times.

Best Express’ collection of facial information has no legal basis, legal experts said. Without letting people know every detail of the process and getting their permission, the company can never push them in front of the camera, said lawyer and Certified Information Security Professional (CISP) holder Shi Yuhang.

"Questions including how Best Express deals with the photos, how long the company will keep the photos and whether it may give them to a third party, should not be evaded,” Shi told the Global Times.

Chinese laws are set to limit the collection of personal information, She said. For those who have “crossed the line” – making the collections via business or other improper purposes – people can complain to local market supervision and administration departments, or directly report it to public security organs in serious cases, he suggested.

Weak awareness 

Given the convenience but also the potential security risks that personal information recognition and collection technologies have brought, Chinese citizens have different opinions about it, observers found.

This is the case with a community in Shanghai’s Songjiang district, where many younger residents object to the community’s facial recognition system at the entrance while their parents welcome it. The system scans the faces of residents when they enter.

"I don’t think the community’s property manager has the right to collect our facial information,” a resident surnamed Chen told the Global Times. “But my in-laws are quite happy with the system, saying it’s so convenient that they don’t need to bring keys or access cards when entering the community any more.”

Young people usually have higher awareness about protecting their information than the elderly do, and the well-educated elites and middle class value their privacy more than others, He said. 

"But generally, Chinese citizens’ awareness of information privacy protection is relatively weak,” He noted, saying that even though many people have the awareness, they can hardly adhere to it in practice if protecting personal information requires meticulous long-term persistence and may bring invonvenience.

He himself insisted for two years, blacking out the personal information on the express delivery boxes before throwing them away, but then gave up this practice.

The general lack of privacy protection in Chinese society has unfortunately to some extent encouraged the underground industry of personal information trading and fraud. There were at least 1.6 million people in China engaged in internet fraud, CCTV reported in 2016, causing more than 110 billion yuan in financial losses for victims a year.

Earlier this month, media reports about employees at courier company YTO Express leaking and selling 400,000 pieces of package owners’ information shocked the public. Many YTO clients later complained online that they received fraud calls.

Through investigation, the Global Times found there are many people who sell information of shopping website users at 0.2-2 yuan each. They peddle and seek buyers via anonymous instant messaging systems including QQ and BatChat.

The Global Times reached a seller on QQ and paid 30 yuan for 100 pieces of Taobao users’ shopping information, including their names, mobile phone numbers, addresses and the latest products they bought on Taobao. The seller, with the alias of ZM, said he got the information from people working at courier companies and recycling centers.

When the Global Times randomly called a dozen people on ZM’s list, none of them said they would report it to the police or supervision authorities, although they felt “surprised” and “angry” after being told that their information was leaked and trafficked.

"Most of the time, citizens can do little about it,” Guo sighed. “With regard to the violation of personal information, even legal professionals like me would find it difficult to collect evidence to file a lawsuit, let alone ordinary people.”

A good beginning

Nonetheless, Guo’s “first facial recognition-related litigation” is regarded by Chinese legal experts and the public as a good sign for protecting people’s personal information from being overly collected and utilized.

China is trying to improve its legal system to better cover citizens’ privacy and information security. The Personal Information Protection Law of China (Draft), for which the public comment period just ended on November 19, intends to regulate that the personal information collected by equipment in public areas can only be processed for public security purposes, Shi said.

The Draft Law also sets out specific requirements for the processing of personal information collected in public areas. It shall regulate that the installation of image collection or individual identification devices in public areas, such as facial recognition machines, must give individuals prominent notice, and the information collected must not be publicly disclosed or shared with third parties, unless separate consent from the individual has been obtained or the disclosure is otherwise required by applicable laws and regulations.

China’s first-ever Civil Code, which was adopted by lawmakers at the third session of the 13th National People’s Congress (NPC) in May, also regulates in Article 1035 that the handling of personal information must meet several conditions, including expressly stating the purpose, method and scope of information treatment.

The Civil Code will take effect on January 1, 2021. “At that time, people will enjoy more legal support in safeguarding their [information] rights,” Shi told the Global Times.

Apart from legal protection, Guo said citizens should also enhance awareness when their information is improperly collected or used. “The best way is to take the initiative to defend their rights, negotiating with the business or making complaints to the consumer protection associations,” he said.