China strengthening face biometrics regulation to mandate choice, consent

China’s boom in selfie biometrics and facial recognition may already have peaked, with new regulations published so businesses can plan for compliance before they take effect later this year.

The new regulation is known as “Administrative Measures on the Security of Facial Recognition Technology Application,” according to Tech in Asia.

Cyberspace Administration of China (CAC) has published new regulations for commercial uses of facial recognition, including hotel check-ins or physical access to gated communities. The agency says the regulations are a response to growing concerns about the impact on data privacy from widespread use of face biometrics. They take effect in June.

The regulations specify the need for clear signage indicating when facial recognition is in use, and that companies need to gather explicit and informed consent before processing individual’s biometric data. For people under 14 years old, parental consent is required.

Individuals who don’t give consent for their face biometrics to be used should be given “other reasonable and convenient options,” CAC said in a post to its website, as quoted by Reuters.

Organizations handling the face biometrics of more than 100,000 people will be required to register with provincial cybersecurity authorities. Businesses must also carry out Personal Information Protection Impact Assessments (PIPIAs), DataGuidance reports.

Cybersecurity rules introduced recently also place limits on the storage and handling of biometric data by payment providers.

China’s Personal Information Protection Law, which took effect in November of 2021, also mandates explicit consent to process people’s biometric data. The law was introduced just as reports emerged of the Chinese public’s discomfort with the proliferation of facial recognition.

The change also comes amid turbulence at Chinese facial recognition and AI “dragon” SenseTime, as Co-founder Xu Bing has resigned from the company.

Article Topics

biometric data  |  biometric identifiers  |  biometrics  |  China  |  data protection  |  facial recognition  |  Personal Information Protection Law (PIPL)  |  regulation  |  selfie biometrics