China tightens security management over facial recognition

BEIJING -- China has made public a set of security management measures concerning the application of facial recognition technology, aiming to standardize the use of the technology and protect individuals' personal information rights.

Jointly released by the Cyberspace Administration of China (CAC) and the Ministry of Public Security, the measures will go into effect on June 1, 2025.

The document sets forth basic requirements and processing rules for the use of facial recognition technology in handling facial data, security standards for the application of the technology, as well as relevant supervisory and management responsibilities.

Notably, regarding mandatory facial recognition, an issue of wide concern which often occurs at hotel check-ins and residence area entrances, the document introduces a non-mandatory principle, stipulating that facial recognition cannot be the sole verification method if "the same purpose or business requirement can be achieved through other non-facial recognition methods."

If individuals do not consent to identity verification through facial recognition, they should be provided with other reasonable and convenient alternatives, according to the measures.

Facial recognition data is sensitive personal information, and once it is leaked, it can cause significant harm to individuals' personal and property security, and even pose a threat to public safety, said an official with the CAC.

The measures were introduced as facial recognition becomes increasingly common across consumption, finance and transportation, thanks to the rapid development of internet technologies, according to the official.

While this has contributed to the growth of the digital economy and facilitated people's lives, it has also raised concerns about privacy and the leakage of personal information, drawing widespread attention from all sectors of society, the official said.

China has attached great significance to the protection of personal information. The law on the protection of personal information, which took effect in November 2021, stipulates that national cyberspace authorities shall coordinate relevant authorities to formulate specific personal information protection rules for new technologies and applications, including facial recognition.

Rules for the processing of personal information have also been included in laws and administrative regulations such as the Cybersecurity Law, the Data Security Law and the regulations on network data security management.

"The formulation and introduction of the measures is an important step in implementing the provisions of these laws and administrative regulations," the CAC official said.