One of the recent innovations that the technology brought into our daily life is the facial recognition.

Even if it is relatively new, this technology and its implementation has quickly and pervasively permeated our lives, and the mainstream response of the public has also changed, from "convenient and hi-tech" to "intrusive and abusive".

For individuals, the face information is highly sensitive, easy to collect, unique and unchangeable. In the event that the facial information is leaked, it can bean irretrievable situation, let alone the individuals' suffering from the harm of properties and personal safety.

On July 27th 2021, the Supreme People's Court (the "SPC") has promulgated the Provisions of the Supreme People's Court on Several Issues concerning the Application of Law in the Trial of Civil Cases involving the Processing of Personal Information Using Facial Recognition Technology (the "Provisions"), which has become effective since August 1st.

The promulgation of the Provisions from the SPC – who has no legislation power– is even earlier than the effectiveness of Data Security Law and the Personal Information Protection Law, which shows the importance and urgency of the Provisions.

There are sixteen articles in the Provisions, not very extensive but worthy-of-attention for each of them.

In the following parts, we highlight two most outstanding aspects of the Provisions.

1. Express, separate, written and voluntary consent.

In the Provisions, it is stipulated that the explicit consent of the individual (or his/her guardian in case of minors) shall be obtained before processing of the facial information.

This seems not new to us. The consent of data subjects is usually one of the key prerequisites for exemption. However, in practice, the individuals sometimes are not given any other alternatives but to agree with the collection and processing of facial information, which makes the "consent" an empty shell. For example, some places offer no other options to its visitors but facial recognition; some Apps do not provide any services if the consent of facial information is not provided.

The above "coercive" situations have obviously been noticed by the SPC and are now expressly prohibited in the Provisions:

In any of the following circumstances, a defense claimed by an information processor on the grounds that it has obtained the consent of the natural person concerned or his/her guardian shall not be supported by the people's courts:

  1. Where the information processor requires the natural person to consent to the processing of his/her facial information before providing a product or service to the natural person, unless the processing of such facial information is necessary for providing the product or service;
  2. Where the consent to the processing of his/her facial information required by the information processor from the natural person is bundled with any other authorization; or
  3. Any other circumstance under which the information processor forces or forces in a disguised form, the natural person to consent to the processing of his/her facial information.

In addition, it is also clearly and specifically pointed out in the Provisions that

  1. using facial recognition technology to verify, identify, or analyze faces in hotels, shopping malls, banks, transport stations, airports, sports venues, entertainment venues, or other business places or public places in violation of laws or administrative regulations shall be considered as infringement of personal rights of a natural person; and
  2. where a property service company or any other building manager uses facial recognition as the only means of authentication for owners or users of the property to enter or exit the property service area, a request for the provision of another reasonable means of authentication made by any owner or user of the property who does not consent to such use shall be legally supported by the people's courts.

We believe that the refined and detailed stipulations in Provisions will provide a more solid and more practical legal foundation of individuals' facial information protection.

2. Injunction against infringement.

Pursuant to Article 9 of the Provisions, where a natural person has evidence to prove that an infringement of his/her right to privacy or any other personality right is being committed or is to be committed by an information processor using facial recognition technology, and that irreparable damage will be caused to his/her lawful right if the infringement is not stopped in time, if the natural person applies to a people's court for taking measures to order the information processor to stop the relevant act, the people's court may, depending on the specific circumstances of the case, issue pursuant to the law, an injunction against infringement of personality rights.

The right to apply for injunction in case of an infringement of personality rights is also stipulated in the PRC Civil Code.

This is a big step for SPC to expand or interpret "facial information" as "personality right". In any case, the injunction is a strong and effective weapon provided by the Provisions to the individuals against infringement of facial information.

As an important part of Chinese data security section, we believe that the Provisions have comprehensively laid down the basic principles of facial information protection.

We will remain attentive to its implementation in judicial practice.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.