Chinese Supreme Court issues interpretation enhancing face information protection in civil cases
On 27 July 2021, the Supreme People’s Court of China published the Judicial Interpretation on the Application of Law in Civil Trials concerning the Application of Facial Recognition Technologies in Personal Information Processing, which specifies face information as a special category of “biometric information” that must be subject to strengthened data protection requirements.
The court's interpretation will take effect on 1 August 2021.
The interpretation identifies the following activities that infringe the personality rights of individuals and violate personal information protection law:
- using face recognition technologies for face verification, recognition or analysis in public areas (e.g. hotels, shopping malls, banks, stations, airports, stadiums, etc.) in violation of the law;
- failure to disclose the rules for processing face information or to explicitly express the purpose, manner and scope of processing;
- failure to obtain the consent of data subjects or their legal guardians as required by law;
- processing face information in violation of the agreed purpose, method or scope;
- failure to take the necessary technical or security measures that result in the leak, loss or manipulation of face information;
- providing face information to other parties in violation of the law or an agreement;
- processing face information in violation of public orders and the values of a good society; and
- processing face information in violation of the principles of legality, legitimacy and necessity.
Considering that most processing activities will be based on the consent of data subjects, the interpretation identifies the following circumstances, under which consent will no longer be a lawful basis for the processing of data:
- an organisation refuses to provide products or services to a data subject unless the individual consents to face information processing (and face information is not necessary for the provision of products or services);
- a data subject consents to a “bundled package” of processing activities including the processing of face information; and
- other circumstances where a data subject is forced to give consent on face information processing.
A data subject whose face information is processed in violation of law and suffers loss may claim monetary remedies, which includes reasonable costs (e.g. costs for investigating and obtaining evidence, and reasonable attorney fees). A court may also grant injunction relief to stop ongoing face information processing or processing that is about to happen, provided that the data subject can prove that failure to stop the processing in time would cause irreparable damage to the individual's legitimate interests.
To address the data protection obligations of platform operators (e.g. e-commerce platforms or information distribution platforms), the interpretation confirms that “notice and takedown” processes must also apply in the context of face information processing via online platforms. This indicates that platform operators can enjoy safe harbour protection if they duly perform the notice and takedown obligations.
In addition, the interpretation addresses the manipulation of facial recognition technology in the real estate industry (e.g. the placing of cameras at the entrance of sales centres, or requiring face recognition and verification to enter a building, etc.). The interpretation provides that standard contracts may be held to be invalid if they require data subjects to grant unlimited, non-revocable or freely transferable consent on the processing of face information. The interpretation also indicates that class actions may be possible where an infringement concerns multiple data subjects.
Please click here for the full text (Chinese only) of the interpretation.
For more information on this interpretation and laws in China governing facial recognition systems, contact your CMS client partner or local CMS experts:
