Old Version


A lawsuit over facial data privacy at a residential compound in Tianjin triggered nationwide discussions about China’s weak legal protection of sensitive personal information. Experts are now calling for stricter laws

By Xie Ying , Yuan Suwen Updated Sept.1

A facial recognition camera at the Chengji Economy and Trade Center, Tianjin

When Gu Cheng approaches the gate to his apartment complex, he refuses to scan his face. Instead, he asks the doorman to open the gate, or follows others who did.  

Gu moved to the Chengji Economy and Trade Center in Tianjin in March 2021, where property management had installed a face recognition camera and refused to provide key cards for access.  

Not willing to hand over his biometric data, Gu sued. A district court ruled in favor of the property management firm, which argued they installed the cameras for pandemic controls. Gu appealed to a higher court in May 2022 which reversed the decision, citing precedent from a Supreme People’s Court ruling in August 2021 that the firm cannot force anyone to submit to face recognition software in the name of “management.”  

In an interview with Cover News on July 1, Gu revealed that the management firm compensated him 6,600 yuan (US$978) but has not yet deleted his data as instructed by the court. Gu is still fighting. 

The Dispute 
Gu, 26, had just signed the lease for his new apartment in the Chengji Center when property management informed him of their facial recognition policy.  

“If I had backed out of my lease, I would have to pay a penalty,” Gu told NewsChina. He reluctantly gave them his ID card number and submitted to face scans.  

When Gu discovered a card reader installed beside the face recognition camera, he requested a key card. Management refused, saying the homeowners association approved the face scanner and neighborhood authorities assisted in installation and data collection.  

Management also argued the scanner improved security in the complex, which has three high-rises containing 5,536 apartments and 400 businesses.  

The face scanner, management said, was installed before the Covid-19 pandemic broke out in January 2020 with plans for use starting in June that year. Because of pandemic controls, the system was activated ahead of schedule.  

Chen Siyan, the community Party secretary, said the scanners are part of the human and machine security measures sanctioned by Tianjin government’s emergency response to the pandemic, according to a neighborhood government report.  

Gu argued that requiring facial scans infringed on his rights. “I’ve been wondering since I moved into the complex how they could justify forcing me to enter the complex only by facial recognition,” he said.  

“I don’t know how they will transmit, use and store my information... I don’t want to give my biometric data to any company that I don’t trust... They did not give me any sense of assurance,” he added. 

Poor Protection
Gu has cause for concern. Wei Dongdong, a lawyer at Beijing Weiheng Law Firm Chengdu Branch, told NewsChina that smaller enterprises like property management companies have little to no cybersecurity measures in place for collecting personal information.  

For smaller companies, cyber security is cost-restrictive. Wei said many property management companies are not willing to invest in updating their data storage and protection.  

Wei said some cut costs with cheap face and fingerprint scanning systems, which like free apps profit from data harvesting. “They could make money by selling biometric information. Perhaps yours and my facial data have already been sold many times,” she warned.  

Because facial data is unique and unalterable, it poses exceptional dangers to victims of identity theft. “You can change your password if you lose it. But you only have one face. If your facial data is stolen, you can’t change it. But others could gather it simply with a camera or a face scanner,” Wei said.  

According to an October 2021 exposé on China Central Television (CCTV), identity thieves use AI technologies to compile people’s facial data through leaked portraits or video clips. Sheng Yang, a journalism professor at Beijing’s Tsinghua University told the Guangzhou-based Time Weekly in 2021 that the average Chinese may encounter over 500 cameras a day.  

In a 2020 survey by the Southern Metropolis Daily, over 90 percent of respondents use facial recognition software. Among them, 64.4 percent said the technology is abused, with nearly 30 percent saying they have suffered identity theft. 

Two Trials 
In August 2021, the Supreme People’s Court issued a legal interpretation stating that the use of facial recognition tech requires prior consent for face scanning at residential compounds, and property managers must provide a physical key upon request.  

Gu cited the interpretation and other privacy protection laws in his September 2021 lawsuit with the district court. During the hearing, Gu demanded the property management agency delete his facial data and provide him with a key and compensation for legal fees.  

The agency emphasized that Gu’s information was used only to enter the residential complex and was stored on a hard disk offline. The system’s installation conformed to Tianjin government’s pandemic control measures, the agency argued.  

This last point swayed the court, which deemed the system was necessary given the complex’s high density of residents. The court also said Gu presented little evidence that the agency was infringing his privacy.  

“I didn’t expect to lose, since this case wasn’t complicated and was clearly backed by the law. I didn’t think that the court would dispute these core issues,” Gu said.  

“The first trial’s ruling was obviously a misunderstanding of prevailing relevant laws and regulations,” Lao Dongyan, a law professor at Tsinghua University who focuses on privacy rights, told NewsChina. “China’s Law of Personal Information Protection states that any facial data should be deleted on request and does not say its owner must prove the data’s collector or user poses security risks,” she said.  

“Based on [the district court’s] ruling, no individual would ever win a similar case, since it’s very hard to prove those risks unless the data involved had already been leaked. Even then, it’s hard to prove who leaked it,” she added.  

Lao said the district court was wrong to reject Gu’s claims over pandemic controls. “The pandemic is no longer an emergency, and both the Law of Personal Information Protection and the Supreme People’s Court’s legal interpretation were released during the pandemic. This means they apply to cases happening during the pandemic,” she said.  

In May 2022, Gu appealed to a higher court. However, he changed his lawsuit from a dispute over privacy to “personal information protection.” In such cases, the burden of proof falls on the defendant.  

This time, Gu won. The higher court ruled the property management agency violated the Supreme People’s Court’s legal interpretation and ordered it to delete Gu’s data, provide him with a key and pay his legal expenses. 

Legal Precedent 
China’s first court case involving facial data was in October 2019 when Guo Bing, an associate law professor at Zhejiang Sci-Tech University, sued Hangzhou Safari Park for denying him entry after he refused to scan his face. The park argued it had updated their system from fingerprinting to facial recognition for increased security, but the court sided with Guo. It ordered the park to delete Guo’s facial data, including the photos he provided for an annual pass to the park, and pay his legal fees. 
The following year, Hangzhou government passed a regulation forbidding property management agencies from forcing residents to submit to face scans, the first of its kind nationwide. Guo was invited to hearings to draft the regulation.  

Sichuan provincial government followed suit in 2021 and revised property management regulations to contain similar clauses found in Hangzhou’s regulation.  

Nationally, facial recognition data is covered in China’s Law of Personal Information Protection, which took effect on November 1, 2021. According to the Law, protected “sensitive information” includes biometric data, religious beliefs, health and medical care information, financial records, geolocation data and the personal information of minors under 14 years old. Any use or gathering of such information requires full permission from its owner.  

But Lao said this is far from enough.  

“The parts on protecting sensitive information only focus on permission, while other parts resemble existing laws concerning ‘ordinary information,’ so it does not fully enhance the legal status of sensitive information,” she told NewsChina.  

Lao expressed concern that Article 26 – which says that collected identity information may be used in cases of public security – would be subject to abuse.  

“‘Public security’ could refer to any location outside homes, including subways, communities and even corridors and stairs. So we have to define this term clearly or risk legalizing inappropriate collection of facial data,” she said.  

At a forum held by research institute Hong Fan Legal and Economic Studies this January, experts called for clearly defined boundaries for collection of facial data, especially under the umbrella of public security.  

“Seeing so many cameras in public places, I don’t know which are legal and which are not, let alone why the information is being collected,” Xu Ke, director of the Study Center for Digital Economy and Law Innovation, University of International Business and Economics in Beijing said at the forum.  

“I suggest posting QR codes beside each camera that reveal who installed it and why, where the information will be stored and what department to contact in case of disputes... No matter if the information is for public security or private enterprise, the public should have the right to know,” he added.  

Lao agrees. “The present law emphasizes ‘autonomy’ over the collection and use of [sensitive] information, but in many cases, the public knows nothing about the risks, which greatly weakens that ‘autonomy,’” she said. “The law should focus more on the protection and use of [sensitive] information and its deletion,” she added.  

At the January forum, experts called for separate legislation involving facial recognition technology. “Department rules or local administrative regulations will usually prioritize the interests of government departments which are processing the data themselves and should be subject to the laws,” Lao said at the forum. “As individuals are often disadvantaged in disputes with government departments and enterprises, we need stronger laws to protect the disadvantaged,” she added.  

In the 2019 case, Guo Bing requested that a third-party witness be present when Hangzhou Safari Park deletes his facial data, which the court denied.  

Given that Chengji Center in Tianjin still has not provided proof that they deleted Gu’s facial data or given him a physical key, Gu is once again appealing to the courts to intervene.

A visitor asks about the facial recognition system at an exhibition at Zhengzhou International Exhibition Center, Henan Province, July 1, 2022