After years of dominating facial recognition tech, China is ready to govern it

• The draft rules are open for comment until September 7.
• The rules state that facial recognition tech should only be used when non-biometric measures are insufficient.
• Should facial recognition be used, the proposed rules encourage the use of national systems.

For years, it’s been known that facial recognition technology, a type of biometric computer applications, is an integral part of daily life in China. So much so that the Chinese facial recognition system logs nearly every citizen in the country, with a vast network of cameras nationwide. 

The world, in general, has watched with a growing sense of alarm over the past decade how China has emerged as a global leader in this surveillance space. It became more apparent when the database of SenseNets Technology, a Shenzhen-based biometrics provider, was leaked in 2019, exposing the personal information of millions of people for months.

According to security researcher Victor Gevers who found the database, SenseNets collected nearly 6.7 million GPS coordinates in one database. Within just 24 hours, SenseNets collected data from cameras positioned at hotels, parks, tourism spots, and mosques, logging details of individuals as young as nine days old.

The location data was matched to names — many of which were Uighur — as well as ID numbers, home addresses, photos, and employers, according to Gevers, who said he also discovered a large number of organizations were connecting to the database, including police stations, hotels, and various companies. Simply put, the database leak showed how pervasive China’s surveillance tools are.

China is finally drawing the line with facial recognition.

To put into context how heavy surveillance is in China, the country has over 700 million surveillance cameras, according to online data. That means one lens for every two citizens. Finally, China wants to create some boundaries and limit facial recognition technology altogether.

On August 8, via the Cyberspace Administration of China (CAC), China released draft regulations to govern the country’s facial recognition technology, including prohibitions on its use to analyze race or ethnicity. The purpose is to “regulate the application of face recognition technology, protect the rights and interests of personal information, other personal and property rights, maintain social order, and public safety,” as outlined by a combination of data security, personal information, and network laws.

The news might have been surprising to many worldwide, given China’s notoriety for extensive nationwide surveillance. The draft rules, which are open for comments until September 7, include some vague directives not to use face recognition technology to disrupt social order, endanger national security, or infringe on the rights of individuals and organizations.

The internet regulator noted that the “Face Recognition Technology Application Safety Management Regulations (Draft for comment) is drafted according to existing laws and regulations such as the “Network Security Law,” “Data Security Law,” and the “Personal Information Protection Law.”

The draft of the newest ruling suggests that “If there are non-biometric verification technologies that can achieve a similar purpose or business requirements, those non-biometric verification methods should be preferred,” as translated by Tech Wire Asia. Individual consent, however, isn’t required for certain administrative situations. Should facial recognition be used, the proposed rules encourage the use of national systems.

Image collection and personal identification equipment should be installed in public places to maintain public safety, the draft rules said, noting clear signage is required. The draft also states that building managers will not need to use facial recognition to monitor entries and exits on the property – they must provide alternative measures of verifying a personal identity for those who want it.

The technology also shouldn’t be primarily relied upon for “major personal interests” like social assistance and real estate transactions. For that, manual verification of personal identity must be used with facial recognition used only as an auxiliary means of verifying personal identity. Should there be a collection of images for internal management, it should only be done for a reasonably sized area, as per the draft.

Businesses like hotels, banks, airports, and more should refrain from deploying facial recognition to verify personal identity. If the individual links their identity to the image, they should be informed verbally or in writing and provide consent. 

Collecting images is also prohibited in private spaces, such as hotel rooms, public bathrooms, and changing rooms. Lastly, all entities in China currently using the technology in a public space, or those with more than 10,000 facial recognition records stored, must register with their local internet regulator within 30 working days.

---

---

---

---