Karl Zhang
On July 27, 2021, the Supreme People’s Court promulgated the Provisions of the Supreme People’s Court on Issues Concerning the Application of Law in Civil Cases Relating to the Use of Face Recognition Technology to Process Personal Information (the “Provisions”), which came into effect on August 1, 2021. The Provisions are highlighted as follows.
I. Scope of application and definition
The Provisions apply to civil cases arising from an information processor’s use of face recognition technology to process facial information, in violation of law, administrative regulations or an agreement between the parties. The processing of facial information includes its collection, storage, use, refinement, transmission, provision and disclosure, etc. Facial information is part of the “biometric information” stipulated under Article 1034 of the Civil Code.
II. Acts that violate the rights and interests of natural persons
An information processor engaging in any of the following in processing facial information shall be considered a violation of the personality rights and interests of a natural person: (1) Use of face recognition technologies for face verification, identification or analysis in hotels, shopping malls, banks, stations, airports, stadiums, entertainment venues and other business premises and public places in violation of law or administrative regulations; (2) failure to disclose the rules for processing face information or the purpose, manner, and scope of processing; (3) failure to obtain the independent consent of natural persons or their guardians in cases where facial information processing requires such consent, or failure to obtain the written consent of natural persons or their guardians as required by law or administrative regulations; (4) violation of the purpose, manner, scope, etc., for processing facial information that the information processor had specifically disclosed or as agreed between both parties; (5) failure to take due technical measures or other necessary measures to ensure the security of the facial information as collected and stored, which caused such information to be leaked, tampered or lost; (6) provide facial information to others in violation of law, administrative regulations, or as mutually agreed; (7) process facial information in violation of good social morals; or (8) process facial information under other circumstances where the principles of legality, appropriateness and necessity are violated.
III. Determination of liability
A court shall not accept a defense from an information processor that it had obtained the consent of the natural person or his/her guardian if any of the following circumstances is present: (1) The information processor conditions the provision of goods or services on the processing of facial information, unless the processing of facial information is needed for such goods or services; (2) the information processor requests a natural person to agree to the processing of his/her facial information by tie-ins with other required authorization(s); (3) other ways the information processor compels or in effect compels, a natural person to agree to the processing of his/her facial information. However, the Provisions also enumerate several circumstances in which the information processor does not assume civil liability, e.g., the facial information is needed to protect the life, health or property of a natural person due to a sudden public health incident or other emergency.
IV. Substantiation and form of liability
If a party requests the information processor to assume civil liability, the people’s court shall determine the burden of proof of both parties pursuant to the rules of evidence in civil litigation. If the information processor asserts that consent was given and it has acted in accordance with the legal requirements, or that it was acting in response to a sudden public health incident or maintaining public order, the information processor has the burden of proof to support such assertion.
If multiple information processors violated the personality rights and interests of a natural person in processing his/her facial information, such natural person has the right to require all such information processors to assume tort liability depending on the extent of each processor’s infringement; if the provisions on joint and several liability under the Civil Code are met, the natural person may require the information processors to be held jointly and severally liable for the harm caused.
V. Scope of damages
In case of property damage as a result of infringing the personality rights and interests of a natural person, such natural person has the right to claim compensation for such property damage and reasonable expenses to stop the infringement, including those paid to an agent to investigate and collect evidence of the infringement. The people’s court may award reasonable attorney’s fees according to the request of the parties and the specific circumstances of the case.
VI. Other provisions
(1) Prohibition against violation of personality rights
If a natural person has evidence to prove that the information processor who used face recognition technology is engaging or is about to engage in an act that would infringe on his/her privacy or other personality rights and interests and cause irreparable harm to them if not stopped in time, and the natural person is thus applying to a people’s court to take measures to enjoin the information processor from engaging in such act, the people’s court may, according to the specific circumstances of the case, issue such an order to prevent the infringement of personality rights.
(2) No compelled face recognition by property service enterprises
If a property service enterprise or any other building manager uses face recognition as the only verification method for the owner or property user to access the property service area, the owner or property user who does not wish to submit to face recognition has the right to request an alternative reasonable verification method.
(3) Restrictions on facial information authorization contracts and related liability
A natural person may seek to invalidate any boilerplate clauses used by an information processor in a contract with that natural person to request him/her to grant an irrevocable and freely transferable right to process facial information with no time limit, and the natural person may also request the deletion of the facial information. If the information processor processes the facial information of the natural person in violation of the agreement, the natural person may claim breach of contract liability and request the deletion of that facial information.
(4) Public interest litigation and litigation between close relatives
Statutory authorities and relevant organizations may initiate civil public interest litigation against an information processor if its facial information processing acts meet the relevant elements for initiating civil public interest litigation.
If an information processor processes facial information of a natural person in violation of law, administrative regulations or the agreement between the parties after the death of the natural person, the natural person’s close relatives may file suit to cause the information processor to assume the relevant civil liabilities.