Tianjin people face recognition first case: You are not allowed to have my face

Some scholars believe that from the legal level

The protection of biometric information is still far from enough

It is necessary to consider the National People's Congress and its Standing Committee

Solocent legislation of biometric information

Gu Cheng refused to "brush his face" home.

Every time he went to the gate of the community at the door of the district, he refused to light up his face on the camera, but directly called the security guard to open the door. Sometimes when he encountered someone else's face and opened his face, he followed him.

Gu Cheng rented in Tianjin Chengji Economic and Trade Center (hereinafter referred to as "Chengji Center"). When he moved in in March 2021, he was informed that the community could only swipe his face and had no other ways to enter.

To stay, Gu Cheng must provide his face information to the property company.

Photo/Visual China

Face information is a kind of biometric information and is sensitive personal information. Everyone has only one face. If the face information is collected and abused at will, the hidden danger is great. In recent years, although the laws and regulations of facial information have emerged endlessly, there are more and more facial acquisition facilities in public places.

On August 1, 2021, the judicial interpretation of face recognition of the Supreme People's Court was officially implemented, requiring property companies not to use face recognition as the only way to verify.

According to this, Gu Cheng prosecuted the property company to ask the property company to provide him with other pass verification methods, while deleting the face information he had previously provided.

On May 18, 2022, the court of second instance of the Tianjin First Intermediate People's Court ruled that he supported his demands.

"Why force me to brush my face into the door?"

In March 2021, 26 -year -old Gu Cheng signed a contract online to rent an apartment in Chengji Center. On the day of the bag in the bag, he learned from the entrance of the house that the community only provided face recognition.

"Because I have signed the house, if I can't hold it, I have to pay a liquidated damages." Gu Cheng, like most of the tenants who are afraid of trouble. Although he is doubtful, he still has a scalp to let the property take pictures into the face. Information and other information.

After settlement, Gu Cheng found that there was a position of the access control card next to the face recognition machine, but the property did not give the access card. He asked the security guard that the other party said that the face was recognized as "for the safety of the owner", and the property staff answered him to install the face recognition access control. After the consent of the owner committee, the official organizations of the street and the community participated.

The "face brushing" system of Chengji Center is indeed enabled to strengthen protection. This is a commercial and residential community located in the core area of ​​the Heping District of Tianjin City. It consists of two 33 -story and one 50 -story ultra -high -rise building. It has 5,536 houses and 400 merchants with a plot ratio of 17.5.

Prior to the outbreak of the new crown epidemic, Chengji Center installed a facial recognition system device. It was originally planned to be debugged and enabled in June 2020. However, due to the outbreak of the new crown epidemic, this system was enabled in advance around February 2020, and the system was enabled in advance. Essence

Tianjin launched the first level of response to the "Emergency Plan for Pneumonia in Tianjin Corresponding to the New Coronary Virus infection" on January 24, 2020.

"We predicted the situation with a high degree of sensitivity. After research and discussions from multiple departments, we decided to urgently enable the face recognition system." Chen Siyan, secretary of the community party committee, publicly stated in February 2020 that it must ensure that the epidemic is effective prevention and control. , The combination of civil defense+technical defense must be carried out. The basic principle is "blocking the mouth, stuck the door, and seeing people." The enabled face recognition system is an important step in the "technical defense" of Chengji Center.

Chen Siyan also introduced that the face information data of the Chengji Center is collected in four ways: one is to collect the households from the door; Fourth, residents send photos to the form of emails to the community mailbox for collection.

However, Gu Cheng realized that if there is only a choice of "brushing face", it may violate his own rights and interests. "Since living in Chengji Center, I have always wondered: Why do I force my face to identify the door?"

He said that the property of Chengji Center could not give him enough security. "After collecting my face information, how to transmit, how to use it, and where to store it, I know nothing. I don’t want to hand over the face information. Manage such an institution that has not been proved to be trusted. "

Gu Cheng's concerns are unreasonable. Wei Dongdong, a lawyer of Beijing Weiheng (Chengdu) Law Firm, told China News Weekly that some large Internet companies or banks in the field of strong supervision are relatively complete, but some small companies, especially small property companies, especially small property companies It is a lot of loopholes, and the sensitive personal information of explicit storage is the norm, and the user's face information and identity information are not stored separately.

Compared with user data security, small companies pay more attention to costs and profits. Wei Dongdong said that the data processing equipment purchased by many small property companies is relatively backward and there is no comprehensive security protection measures.

She even learned that the price of facial recognition facilities and employees 'attendance fingerprint punching equipment in some property companies are extremely low, and the reason why equipment suppliers are willing to supply at low prices are to collect sensitive personal information such as users' faces.

"User's information can be sold to sell money to increase the benefits to the supplier, so it is likely that your face has long -been didn't know how many hands have been sold." Wei Dongdong said.

As a sensitive personal information, face information has three characteristics: unique, easy to gain, and security. Wei Dongdong said that the "uniqueness" lies in the non -changing. As long as a camera is far away, face information can be obtained, which causes face recognition technology to facilitate the trajectory of people, which is extended to "security." "Because the face information is bound to the person, it needs to be provided by real people to visit. It is more difficult to imitate. Human face is often used for important scenarios in key places. Videos made by pictures, 3D models and deep synthetic technology have cheated face verification events. "Wei Dongdong said.

How to deal with face information is appropriate? Wei Dongdong said that whether it is a property or an office building to collect the face information, first of all, you should obtain a individual's individual consent to sign it on the list of face information processing rules. , Also provides residents with an alternative way.

The face of the Tianjin Chengji Economic and Trade Center recognizes the access control. Photo/Interviewee provided

After collecting face information, appropriate technical measures should be taken to deal with. According to Wei Dongdong, first of all, in the section of information comparison, try to complete the comparison of face information locally to reduce the transmission process; second, if you need to store it, you do not store the face photos or video itself. Generally, you need to process "message summary" Essence Summary is to use the algorithm of face information to "translate" it into a series of unique letters. Because the message Abstract cannot be restored to the face information itself, the face information itself can be prevented from leaking.

However, Wei Dongdong pointed out that the aforementioned measures are only the requirements of the recommended national standards. They are not compulsory legal obligations. They can only be used as a reference for administrative law enforcement, rather than the direct basis of law enforcement. The online information office coordinates the rules and standards of face recognition and protection issued by relevant departments.

The first trial had lost the case

On August 1, 2021, the Supreme People's Court issued the "Provisions on Several Issues of Laws for User Face Recognition Technology Related Personal Information Related Civil Information of Personal Information" (hereinafter referred to as "Face recognition judicial interpretation").

From the perspective of the legal community, this judicial interpretation has been strongly regulated on the processing information of the person's face recognition. The acquisition of face information behavior also involves details such as proof and rational expenditure.

Regarding Gu Cheng's situation, Article 10 of the "Interpretation of Face Recognition" stipulates that "property service enterprises or other building managers use face recognition as the only verification method for the property service area of ​​the property to enter and exit the property service area. If the owner or the property user requests it to provide other reasonable verification methods, the court will support it according to law. " This means that Gu Cheng's rejection of the face of the property collection "can be rely on."

On the second day of the implementation of the judicial interpretation, Gu Cheng once again expressed his request to refuse to brush his face to the property company, asking other ways of passing, but he was still rejected. On August 9, 2021, he commissioned a lawyer to letter to the property company's courier lawyer. The other party still had no response after signing August 19, and he decided to sue.

On September 3 of the same year, the Tianjin Heping District People's Court's prosecution of Gu Cheng was filed for "privacy dispute". "Chengguan Property"), Gu Cheng’s litigation request includes the deletion of his face information, stop the processing of the face information of others, and issue a written certificate that has been deleted by the relevant information, providing him with other convenient entry and exit of privacy. The method of the foundation center, as well as compensation lawyers and litigation costs.

Gu Chengfang, in addition to quoting Article 10 and 8 of Face recognition Judicial Interpretation, also mentioned that Article 15 of the Personal Information Protection Law that was passed by the National People's Congress at the time: For information, individual has the right to withdraw its consent. Personal information processors should provide a convenient way to withdraw consent.

Gu Cheng complained that he had repeatedly asked Chengguan Property to delete his face recognition information and provide other reasonable verification methods, but the other party explicitly refused. Chengguan Property refused to delete his face recognition information, and used face recognition as the only verification method of the access service area, violated his personality rights, and violated the principle of "legitimate, correct, and necessary" that the face information needed to follow.

Chengguan Property argued that the collection of face recognition information is the work completed by the owner committee, the comprehensive governance office, the community, and the street office. The information is only used on the access control and stored in the internal database and hard disk. The database is not connected to the network.

The Heping District Court accepted the view of Chengguan Property. The court believes that, in view of the large number of residents of Chengji Center, the use of Gucheng's face information is in accordance with the relevant provisions and requirements of the Tianjin epidemic prevention and control, "it is indeed a necessary measure and need for the prevention and control of the epidemic." Related evidence cannot prove that the property property violates his privacy. Based on this, the court of first instance rejected Gu Cheng's litigation request. "The defeat of the first trial is a bit unexpected." Gu Cheng said, "The case is simple, and the law is very clear. I feel that the court does not support compensation for lawyer fees, but it will not cause differences in the problem."

Lao Dongyan is a professor at the School of Law of Tsinghua University. She has been paying attention to the protection of personal information for a long time. She told the "China News Weekly" that the first trial of the Gucheng case "is obviously wrong to understand the current legal regulations." She pointed out that in the "Personal Information Protection Law", it clearly stipulates that the withdrawal of the withdrawal of the withdrawal can be deleted, and there is no provision to prove that the data processor must have hidden dangers in the process of processing, and individuals can exercise the right to delete.

"If the court of the first instance of the Gucheng case understands, any individual will be defeated, because individuals cannot prove that the actor's behavior of handling personal information has hidden security hazards. Unless the personal information has been leaked, it has been leaked. It is difficult to prove who leaked, "she said.

Lao Dongyan also proposed that the court in the first instance considers the factors of the epidemic prevention and control, and rejected Gu Cheng's demands, and also had a deviation of the legal understanding of the law. "The epidemic can no longer be said to be an emergency, not to mention the" Personal Information Protection Law "and" Face recognition judicial interpretation "were announced during the epidemic period. Naturally, it can be inferred that it is suitable for the epidemic period."

She pointed out that the court of first instance may consider the need for prevention and control of the epidemic.

Gu Cheng decided to appeal. He resumed with a lawyer. The reason why the first trial lost was because the case was set as a "privacy dispute". Because he could not prove that his information had been leaked, he could not determine that privacy was infringed. In the second instance appeal, the appeal to the "personal information protection dispute", in terms of personal information protection, the responsibility of proof is in the property party.

On May 18, 2022, the Tianjin First Intermediate People's Court judged the second instance of the case and supported Gu Cheng's demand.

The court believes that in February 2020, Chengguan Property enabled the face recognition system as an entry and exit verification method of the owner and property users, which can more accurately identify the personnel in and out of the community, make the management of community more secure, pass more efficient, and in the prevention and control of the new crown pneumonia. Playing a great role does not violate legal regulations. However, when Gu Cheng took a check -in, although Chengguan property was agreed to extract the face information as a pass verification method, the face information of the face of the city's property has been obtained as the sole verification method. Chengguan Property refused to provide other verification methods for Gu Cheng, which contrary to Article 10 of the "Face recognition judicial interpretation".

Therefore, the court in the second instance believes that Chengguan Property should actively fulfill its legal obligations, deletes Gu Cheng's face information, provides other verification methods, and undertakes reasonable expenses such as lawyers 'fees for lawyers' litigation expenses in this case.

Is it necessary to consider separate legislation alone

Nowadays, face recognition devices are "fully blossoming" in various communities across the country. Local regulations have been stepped first.

Guo Bing, an associate professor at the School of Law and Government of Zhejiang University of Technology, told China News Weekly that on March 1 this year, the latest revised "Hangzhou Property Management Regulations" was implemented, which added that "property service people must not force owners to pass fingerprints, face face, face face, face face Entering the property management area or using the common part of the biological information method such as identification. "

Guo Bing has participated in the amendment of the "Hangzhou Property Management Regulations" and made suggestions for the protection of face recognition information. At that time, in addition to his identity as a legal expert, he was also the initiator of the "first case of Chinese face recognition".

That was Guo Bing, a member of the Hangzhou Wildlife World Card member in October 2019, was notified that the face recognition of the registered person was not informed that the annual card he purchased would not be able to enter the park normally. The refund of the card was required to be rejected, so the animal world was brought to court.

According to the court's judgment, the animal world finally deleted the facial feature information submitted by Guo Bing when handling the annual card, compensation for his contractual loss and transportation costs. In 2020, during this lawsuit that caused widespread attention, the "Hangzhou Property Management Regulations" began to revise, and the country's first legislation to launch the prohibition of forced face recognition of the forced face recognition nationwide.

Immediately after, the "Sichuan Provincial Property Management Regulations" began revised in 2021. Among them, the owner committees and members, alternate members and property service people were more clear. At the same time, it is clear that the property service person cannot use the shared facilities and equipment through biological information such as fingerprints and face recognition.

my country's first "Personal Information Protection Law" was implemented on November 1, 2021, highlighting the special protection of biometric information as a sensitive personal information, which pointed out: "Sensitive personal information is leaked or illegally used, which can easily lead to natural persons. Personal information that is violated or personal and property security is harmed. "Sensitive personal information includes information such as biometrics, religious beliefs, specific identities, medical health, financial accounts, trajectories such as trajectory, and individuals under the age of 14 years. information. Only with a specific purpose and sufficient necessity, and adopting strict protection measures, those who process personal information processing can process sensitive personal information. Compared with ordinary personal information, the "Personal Information Protection Law" stipulates that handling personal sensitive information should be more notified, including the corresponding risks, and the individual's individual consent.

However, in Lao Dongyan's view, the "Personal Information Protection Law" distinguishes general personal information from sensitive personal information, which reflects the spirit of strengthening the latter. This "strengthening" still has obvious shortcomings.

"The place to highlight the protection of sensitive personal information is actually only in the section of consent. There are almost no differences from ordinary personal information in other places, and there is no threshold for substantially raising legal protection." La Dongyan believes that from the legal level, Lao Dongyan believes that from the legal level, Nowadays, the protection of biometric information is still far from enough. The National People's Congress and its Standing Committee need to consider separate legislation on biometric information, and should not be protected on the framework of the Personal Information Protection Law.

La Dongyan also pointed out that Article 26 of the Personal Information Protection Law stipulates that "installing image collection and personal identification equipment in public places shall be necessary for maintaining public safety, comply with relevant national regulations, and set up remarkable prompts Identification; the collected personal images and identification information can only be used to maintain public safety, not to other purposes; except for obtaining individuals' individual consent. "This clause is suspected of using" public safety "as" pocket " Essence

"If the expansion of the" public safety 'inside, it actually means that except at home, face recognition devices can be installed in almost all places, such as subways, communities, and even corridors. "She believes that" After writing the legislation on the grounds, public safety must be strictly explained and limited, otherwise it may be legalized to collect the facial information of overdoor people.

In addition, the abuse of facial information may cause a large amount of information leakage, and many accidents and disputes are occurred. "When the problem flooding generally comes, it will bring particularly large pressure on the back -end supervision and law enforcement, and law enforcement resources are limited." Lao Dongyan said that in addition to the abuse of information collection, it is also necessary to pay attention to the storage and use of information. The regulation of the links and how to better exercise the right to delete.

When he sued Hangzhou Wildlife World in 2019, Guo Bing asked the animal world to delete his face information under the witness of a third -party professional and technical institution, but did not receive the support of the court.

"I still think that this is the best way to realize the right to delete." He pointed out that in Gucheng's case, Chengguan Property claims to store face information on "internal databases and hard disks", which is difficult to ensure confidentiality, but for, for the confidentiality, but for, for the confidentiality, but for, for the confidentiality, but for, for the confidentiality, but for, for the confidentiality, but for, for the confidentiality, but for, for the confidentiality, but for the confidentiality, but for, for the confidentiality, but for, it is difficult to ensure the confidentiality. Gu Cheng's "face" was not deleted, and he couldn't listen to the other side of the other party.

Send 2022.7.4 Total Issue 1050 "China News Weekly" magazine

Magazine title: Behind the first case of face recognition of Tianjin: "My face is the master"

Reporter: [email protected])

Edit: Cai Rupeng

- END -