Tianjin has laws to collect face recognition information, and excessive collection of personal information is a "curse".

In recent years, the abuse of face recognition technology has become increasingly prominent, and relevant departments and localities have continuously taken measures to rectify the illegal collection of face information, and relevant policies have been gradually introduced.

65438+February 1 day, the Standing Committee of Tianjin Municipal People's Congress voted and passed the Tianjin Social Credit Regulations (hereinafter referred to as the Regulations). Article 16 of the Regulations stipulates that if a market credit information provider collects natural person information, it shall obtain its consent and agree to use it, except as otherwise provided by laws and administrative regulations. Market credit information providers shall not collect religious beliefs, blood types, diseases and medical histories, biometric information and other personal information prohibited by laws and administrative regulations. Therefore, enterprises, institutions, trade associations and chambers of commerce are prohibited from collecting biometric information, such as faces, fingerprints and voices.

Face recognition is a biometric technology based on human facial features. This technology achieves the purpose of personal identity verification by collecting portraits, extracting key points, preprocessing portraits, extracting features and comparing faces.

In the eyes of the industry, the "Regulations" prohibit face recognition technology for market credit information collectors in specific scenarios, which means that there may be technical abuse in the above fields. Based on this, Nanjing, Xuzhou, Hangzhou and other places have previously required sales offices not to photograph visitors' facial information privately, and property service providers are not allowed to force owners to use * * * facilities and equipment through biometric information such as fingerprints and face recognition.

Risks and opportunities coexist under the blue ocean of the industry.

According to statistics, from 20 10 to 20 18, the average compound annual growth rate of China's face recognition industry reached 30.7%, and the market scale is expected to exceed 1000 billion yuan by 2024. However, facing the vast blue ocean, the development of the industry still faces many information security problems. Especially in the financial field, technologies such as fingerprints and face recognition are more risky.

In view of the above, in recent years, many technologies such as face recognition are constantly being standardized. 20 19 1, Shanghai issued the "Implementation Plan for Accelerating the Construction of Shanghai Financial Technology Center", which mentioned that it will promote 23 financial technology application pilots such as face recognition offline payment; In February of the same year, Fuzhou Central Sub-branch of the People's Bank of China officially released the "Fujian Province Face Recognition Offline Payment Security Application Pilot Implementation Plan".

On August 23rd, 20 19, the People's Bank of China issued FinTech Development Plan (20 19-202 1), which mentioned that it would explore the security application of offline payment based on face recognition, and realize the transaction verification of licensed financial institutions with the help of technologies such as password identification, privacy calculation, data tag and pattern recognition.

Especially in June 5438+ 10 this year, China Payment and Clearing Association also formulated the "Self-discipline Convention on Offline Payment of Face Recognition (Trial)", which requires the collection and storage links, adheres to the principle of "user authorization and minimum sufficiency", clearly informs users of the purpose, mode and scope of information use, and obtains user authorization to avoid collecting functions unrelated to demand.

However, from the perspective of the industry, brush face payment has become the focus of competition among large payment institutions in the past two years. In the previous stage, WeChat payment and Alipay's brush face payment attracted widespread attention. According to Su, a senior researcher at Sack Research Institute, the first reason why leading payment institutions vigorously promote face-brushing payment is that face-brushing payment, as a way of biological payment, has low penetration rate and wide development space, and giants seek to seize the commanding heights of emerging models.

Secondly, face-brushing payment can really alleviate the cashier's queuing situation to a certain extent, which is helpful to improve transaction efficiency. Moreover, payment giants such as WeChat and Alipay have a huge financial ecosystem. In the future, it is not excluded that the user's face-brushing record is related to his credit granting and risk control. For example, users pay more for brushing their faces, and their credit scores are improved, or when they apply for loans in the future, they will compare and observe their face information in many aspects.

The legislation related to personal information security is not perfect.

It is noteworthy that the first case of face recognition in China ushered in the first-instance judgment. 165438+1October 29th, the "network legal practice circle" learned that Guo Bing, the plaintiff in the first case of face recognition, refused to accept the judgment of the first instance (the judgment of the first instance: the judgment of the first case of face recognition (full text)) and appealed that afternoon.

On June 20, 2020, 165438+ the people's court of Fuyang District, Hangzhou held a public hearing to hear the case, and made the following judgment: the defendant wildlife company compensated the plaintiff for the loss of contract benefits and transportation expenses, totaling RMB 1038 yuan, deleted the facial feature information including photos submitted by the plaintiff when handling the fingerprint annual card, and rejected the plaintiff's request to confirm the relevant notices in the zoo store and SMS notices.

The court held that the focus of the dispute in this case is the evaluation and standardization of the operator's handling of personal information of consumers, especially personal biometric information such as fingerprints and faces. Although the law of our country does not prohibit the collection and use of personal information in the field of consumption, it emphasizes the supervision and management of personal information processing, that is, the collection of personal information should follow the principle of "legality, legitimacy and necessity" and obtain the consent of the parties concerned; The use of personal information shall follow the principle of ensuring safety and shall not be disclosed, sold or illegally provided to others; When personal information is infringed, the operator shall bear the corresponding tort liability.

165438+1October 30, related media reported that Guo Bing, the chief prosecutor of the case, was informed that some of his requests were not supported by the court, and he had sent a civil complaint the day before, requesting to cancel the civil case No.6971kloc-0/65438 of the Fuyang District People's Court.

It is worth mentioning that the draft personal information protection law reviewed at the the National People's Congress Standing Committee (NPCSC) meeting on June 65438+1October 65438+March stipulates that personal consent should be obtained on the premise of full notice in advance, and individuals have the right to withdraw their consent; If important matters are changed, personal consent shall be obtained again; Do not refuse to provide products or services on the grounds of personal disagreement. Commercial marketing and information push through automated decision-making should also provide options that are not specific to their personal characteristics.

Not long ago, the National Network Information Office also released the Personal Basic Information Scope of Common Mobile Internet Applications (APP) (hereinafter referred to as the Draft for Comment), excluding biometric information such as face recognition and fingerprint recognition from the personal basic information scope of 38 common apps.

The above-mentioned exposure draft clarifies the necessary personal information scope of 38 kinds of common apps such as short video, map navigation, online ride, study and education, and puts a "tight spell" on the behavior of excessive collection of personal information. Necessary personal information refers to the personal information necessary to ensure the normal operation of the basic functions of the APP. Without this information, applications cannot provide basic functional services. As long as the user agrees to collect the necessary personal information, the APP shall not refuse the user to install and use it.

Zhang Xiaorong, president of Shenzhen Institute of Science and Technology, said that the unhealthy trend of the Internet Office restricting the unlimited "request" of personal privacy information by APP has finally been curbed, and the information protection of China in the APP era has finally taken a step forward. The opinion draft covers a wide range, and all kinds of apps are almost wiped out.

However, Zhang Xiaorong also believes that the new regulations have no detailed provisions on associated login. Previously, the "Guidelines for Personal Credit Information" mentioned that when using the same account to register and log in to multiple apps, it can provide a channel to revoke the use relationship of a single app user account. This unnamed associated login may bypass the new rules of the Internet office and still collect user privacy.

"In addition, personal information has long been collected by the APP, and the only ones that are not poisoned are some after 00. The "Draft for Comment" has a protective effect on new netizens after 00, and it seems that the protection of the rights and interests of old users is insufficient. " Zhang Xiaorong further pointed out that "the abuse of brush face recognition technology is not directly clear, and the information collected by fingerprint recognition technology is not limited, but the information collected by personal biometric technology is more likely to cause harm than ordinary text information."