The Civil Code of the People's Republic of China was deliberated and passed on May 28, 2020, and officially took effect on January 1, 2021. This Civil Code contains many innovations and highlights. One of them is that the Civil Code clearly stipulates in the General Provisions that 'the personal information of natural persons is protected by law.' The Personality Rights section includes a special chapter on 'Privacy Rights and Personal Information Protection,' which defines the concept, rules, defenses, and specific pathways for personal information, marking the preliminary completion of the top-level legislative design for personal information protection in China.

As for the underlying construction of personal information protection in China, it is specifically implemented through the 'Personal Information Protection Law.' The Personal Information Protection Law was deliberated and passed on August 20, 2021, and will take effect on November 1, 2021. It consists of 8 chapters and 74 articles, with the legislative purpose of protecting personal information rights and interests. The entire text of the Personal Information Protection Law contains 74 instances of 'shall,' and the expression of the two characters 'shall' constitutes a mandatory regulation for enterprises, requiring them to shoulder the social responsibility of protecting personal information while focusing on compliance, which is of milestone significance for the protection of personal information.

What is 'Personal Information'?

Personal information refers to various information recorded in electronic or other forms that is related to identified or identifiable natural persons, excluding information after anonymization processing.

Sensitive personal information refers to personal information that, once leaked or illegally used, is likely to cause harm to the dignity of natural persons or the safety of their person or property, including biometric information, religious beliefs, specific identities, medical health, financial accounts, location tracks, and other information, as well as personal information of minors under fourteen years old.

It is particularly noteworthy that the processing of personal information of individuals under fourteen years of age shall require the consent of the minor's parents or other guardians.

Legal Interpretation Case: 'Who Stole My Face'

(1) 'Wearing a Helmet to Go House-Hunting'

The personal information protection issues brought by facial recognition have become prominent. According to the 'Public Research Report on Facial Recognition Applications,' among more than 20,000 interviewees, over 90% have used facial recognition technology, and more than 30% of interviewees have suffered losses or had their privacy infringed upon due to leakage, misuse, or other issues with facial recognition information.

For example, in real life, facial recognition systems have become standard equipment in sales offices, such as for categorizing customers and linking them to home purchase discounts. However, for customers, on one hand, they are passively labeled by enterprises, making it impossible for customers to enjoy related discounts; on the other hand, customers have no control over whether the customer information randomly collected by enterprises is limited to this use. Therefore, to prevent excessive collection of their information, customers have no choice but to go house-hunting while wearing helmets and masks to prevent their facial information from being leaked.

In fact, the collection and processing of personal information (facial) by sales offices are both illegal. Most sales offices obtain facial information through non-intrusive capture without the consent of consumers, nor have they provided obvious warnings about the presence of facial capture devices. Moreover, facial information is unique and identifiable, and as sensitive personal information, it requires specific authorization from the individual before an enterprise has the right to collect it. Furthermore, the enterprise's use of personal information is unreasonable. Using facial recognition to categorize house hunters into different types and offering different levels of discounts raises suspicion of 'price and service discrimination.'

(2) Big Data 'Price Gouging'

This year's CCTV 315 Gala exposed the big data price gouging behavior of a bathroom fixtures enterprise. All stores of this bathroom fixtures enterprise across the country have facial recognition cameras installed, which can accurately capture consumer facial information without the consumers' knowledge.With facial recognition-enabled cameras, once a customer enters a certain bathroom fixtures store, their facial information will be captured and recorded, and thereafter, no matter which store they go to or how many times they visit, the enterprise will know.A certain retail sales director of this bathroom fixtures enterprise said: 'For example, if a person has been to Store A and then goes to Store B, Store B will prompt that this person has also visited Store A, so Store B can be psychologically prepared for how to receive and quote to this person.'The Market Supervision Administration believes that the behavior of a certain bathroom fixtures enterprise installing camera devices without the consent of consumers to capture facial information in stores violates the Consumer Rights Protection Law and decided to impose a fine of 500,000 yuan.

Lawyer Peng Cheng's Interpretation:

The promulgation of the Personal Information Protection Law has made more explicit provisions regarding the capture of facial information in public places:

1. 'Notification-Consent' Principle: Personal information processing shall obtain individual consent on the premise of sufficient prior notification, and individuals have the right to withdraw consent; if significant matters change, individual consent shall be re-obtained; products or services shall not be refused for the sole reason that the individual does not consent.

2. Two 'Most' Principles for Information Collection: Minimum Impact: The processing of personal information shall have clear and reasonable purposes and shall be directly related to the processing purposes; the collection method shall have the minimum impact on individual rights and interests; Minimum Scope: The collection of personal information shall be limited to the minimum scope necessary for the processing purposes, and over-collection is prohibited.

3. Prominent Identification Required: When installing image capture or personal identity recognition equipment in public places, it shall be necessary for maintaining public safety, comply with relevant national regulations, and set up prominent notification signs. The collected personal images and identity recognition information shall only be used for the purpose of maintaining public safety and shall not be used for other purposes, unless separate individual consent is obtained.

In reality, most merchants collect facial information without individual consent, putting the unique, permanent, and irreversible facial information at enormous risk. This not only infringes upon individuals' portrait rights but also seriously crosses the boundaries of personal information, already crossing the legal red line. In this 'era of looking at faces,' the 'Personal Information Protection Law' protects your personal information. Moreover, after the introduction of the new law, if information processors perform poorly, they may face fines of up to 50 million yuan or 5% of revenue, up to having their business licenses revoked and business suspension for rectification. Such high illegal costs will certainly deter unlawful violations and reduce the misuse of illegal personal information collection technology.