The Civil Code of the People's Republic of China was adopted upon deliberation on May 28, 2020, and formally came into effect on January 1, 2021. The Civil Code contains many innovations and highlights, one of which is that in its General Provisions, it explicitly stipulates that "the personal information of natural persons shall be protected by law", and the Personality Rights Section includes a dedicated chapter on "Protection of Privacy Rights and Personal Information", which sets forth provisions on the concept, rules, defenses, and specific pathways concerning personal information. This marks the initial completion of the top-level legislative design for personal information protection in China.

The underlying framework for personal information protection in China is specifically implemented through the Personal Information Protection Law. The Personal Information Protection Law was adopted upon deliberation on August 20, 2021, and will come into effect on November 1, 2021. It consists of 8 chapters and 74 articles, with the legislative purpose of protecting the rights and interests of personal information. The term "shall" appears 74 times throughout the Personal Information Protection Law. For enterprises, the use of "shall" constitutes a mandatory provision, requiring enterprises to focus on compliance while shouldering the social responsibility of protecting personal information. This holds milestone significance for the protection of personal information.

What is "personal information"?

Personal information refers to various types of information recorded by electronic or other means that relate to an identified or identifiable natural person, excluding information that has been anonymized.

Sensitive personal information refers to personal information that, if leaked or illegally used, may easily lead to infringement of the dignity of natural persons or endanger their personal or property safety. This includes biometric information, religious beliefs, specific identities, medical and health information, financial accounts, location tracking information, as well as the personal information of minors under the age of 14.

Of particular note is that the processing of personal information of individuals under the age of 14 shall obtain the consent of the minor's parents or other guardians.

Legal Interpretation Case: "Who Stole My Face"

(I) "Going House-Hunting Wearing a Helmet"

The issue of personal information protection arising from facial recognition has become prominent. According to the "Public Research Report on Facial Recognition Applications", among over 20,000 respondents, more than 90% have used facial recognition technology, and over 30% of respondents have suffered losses or privacy violations due to the leakage or misuse of facial recognition information.

For example, in real life, facial recognition systems have become standard equipment in sales offices, used, for instance, to categorize customers and link them to购房优惠. However, for customers, on the one hand, they are passively labeled by enterprises, which may prevent them from enjoying relevant preferential benefits; on the other hand, customers have no control over whether the information collected by enterprises is used only for this purpose. As a result, to prevent excessive collection of their information, customers have no choice but to go house-hunting wearing helmets or masks to prevent their facial information from being leaked.

In fact, the collection and processing of personal information (facial data) by sales offices are illegal. Most sales offices obtain facial information through无感 capture without the consent of consumers and without clear prompts indicating the presence of facial capture cameras. Furthermore, facial information is unique and identifiable, and as sensitive personal information, it requires specific authorization from the individual before enterprises are entitled to collect it. Additionally, the use of personal information by enterprises is unreasonable; distinguishing house viewers into different types through facial recognition and offering different discount levels is suspected of "price and service discrimination".

(II) Big Data "Price Discrimination Against Regular Customers"

At this year's CCTV 315 Gala, a bathroom fixture enterprise was exposed for engaging in big data price discrimination. All its stores nationwide were equipped with facial recognition cameras, which could accurately capture consumers' facial information without their knowledge.With cameras featuring facial recognition, once a customer enters a bathroom fixture store, their facial information is captured and recorded. The enterprise will then know which stores the customer has visited and how many times.A retail sales director of the bathroom fixture enterprise stated: "For example, if a person has visited Store A and later goes to Store B, Store B will be prompted that this person also visited Store A, and Store B will then have a psychological preparation for how to receive and quote to this person."The Market Supervision Bureau held that the bathroom fixture enterprise's act of installing camera equipment in its stores to capture facial information without consumers' consent violated the Consumer Rights Protection Law and decided to impose a fine of 500,000 yuan on it.

Lawyer Peng Cheng's Interpretation:

The enactment of the Personal Information Protection Law has made more explicit provisions regarding the capture of facial images in public places:

1. The "Informed-Consent" Principle: The processing of personal information shall obtain the individual's consent on the premise of prior and sufficient notification, and the individual shall have the right to withdraw consent; if important matters change, consent shall be re-obtained; products or services shall not be refused on the grounds of the individual's refusal to consent.

2. Two "Most" Principles for Information Collection: Least Impact: The processing of personal information shall have a clear and reasonable purpose, be directly related to the processing purpose, and the collection method shall have the least impact on the individual's rights and interests; Minimum Scope: The collection of personal information shall be limited to the minimum scope necessary for the processing purpose, and excessive collection shall be prohibited.

3. Prominent Identification: The installation of image collection and personal identification equipment in public places shall be necessary for maintaining public security, comply with relevant national regulations, and be accompanied by prominent warning signs. The collected personal images and identification information may only be used for the purpose of maintaining public security and shall not be used for other purposes, unless separate consent from the individual is obtained.

In reality, most businesses collect facial information at will without personal consent, exposing facial information— which is unique, permanent, and irreversible—to significant risks. This not only infringes upon an individual's right to portrait but also seriously crosses the boundaries of personal information, already violating the red line of the law. In this "age of face recognition", the Personal Information Protection Law safeguards your personal information. Moreover, after the new law comes into effect, if information processors fail to comply, they may face high fines of up to 50 million yuan or 5% of their revenue, and even have their business licenses revoked or be ordered to suspend operations. Such high illegal costs are bound to deter unlawful infringement and reduce the abuse of technology for illegal collection of personal information.