Can I install image acquisition and personal identification equipment at will?

"Personal Information Protection Law of People's Republic of China (PRC)" Article 26 The installation of image acquisition and personal identification equipment in public places shall be necessary for maintaining the safety of public places, comply with the relevant provisions of the state, and set up obvious warning signs. Personal images and identity information collected can only be used for the purpose of maintaining public safety, and shall not be used for other purposes; Unless you get personal consent.

The main idea of this article

This article is about the installation of image acquisition and personal identification equipment in public places.

Core concept

public place

A public place refers to a place that is open to the public for unspecified people to enter and leave. In the process of reviewing the second draft of the Personal Information Protection Law, a member of the National People's Congress Standing Committee (NPCSC) suggested that public places should be defined as "areas open to unspecified public for their use". According to Article 1 198 of the Civil Code, hotels, shopping malls, banks, railway stations, airports, stadiums and entertainment places are typical public places. In addition, post offices, parks, zoos and other places open to the public also belong to public places.

Image acquisition equipment

Image acquisition equipment refers to cameras, video cameras, scanners and other equipment with photographing function, which can collect relevant information related to external images of human body for subsequent processing.

Personal identification equipment

Personal identification equipment refers to the equipment that uses personal information (especially biometric information with high recognition such as face information, iris information and fingerprint information) to identify a specific person. For example, a face recognition system usually consists of face detection (finding the position of the face in the image and returning the coordinates of the bounding box containing each face), face alignment (scaling and cropping the face image with a set of reference points located in a fixed position in the image), face representation (converting the pixel values of the face image into compact and distinguishable feature vectors) and face matching (comparing the feature vectors of different face images and obtaining similarity scores, which gives the possibility that different face images belong to the same subject).

public safety

Public safety refers to the safety of life, physical health and important property of unspecified people or many people. Article 23 and Article 73 of the preamble of the EU General Data Protection Regulation stipulate that the laws of the EU or member states may restrict the basic principles of personal data processing, the rights of data subjects and the corresponding obligations of data controllers, as long as such restrictions are necessary and appropriate for the protection of public safety. In China, according to the third item of Article 13 of the Law on the Protection of Personal Information, processors (such as public security organs) who have statutory duties or obligations to maintain public safety can handle personal information within the scope and limits necessary to perform their statutory duties or obligations.

A detailed explanation of the terms

First, it is necessary to make special provisions on the installation of image acquisition and personal identification equipment in public places.

With the advent of a risky society, installing image acquisition and personal identification equipment in public places has become a necessary means to achieve orderly social governance and maintain the safety of public places. The ubiquity and invisibility of risks in society increase the public's sense of unease about risks, and the deep concern for safety issues has become an important feature of a risk society, which is reflected in the field of social governance, that is, strengthening risk prevention and risk avoidance. In order to ensure public safety and prevent social risks, the state can relax the requirements for personal information rights and privacy protection in some cases, so as to realize the existence of security protection and personal interests protection.

For example, it is a common practice all over the world to install video surveillance in public places to combat and prevent crime and maintain social order. 20 15 On May 6th, the National Development and Reform Commission and other nine ministries and commissions jointly issued "Several Opinions on Strengthening the Networking Application of Public Safety Video Surveillance" (No.996 of Development and Reform High-tech [2065438+05]), pointing out that by 2020, "global coverage, full-time availability and full-time availability" should be basically realized.

However, the image acquisition and personal identification equipment installed in public places may also be abused, which may lead to the risk of illegal infringement of personal information rights. For example, the main reason for the rapid expansion of face recognition technology in recent years is its easy acquisition and non-perception. Different from fingerprint recognition, iris recognition, voice recognition and other recognition technologies, modern face recognition system can collect personal face information and post-process it as long as it is within the field of vision of image acquisition equipment. Therefore, there is an inherent tendency for face recognition technology to be abused, and the processor is likely to process face information beyond the necessary limit or in other illegal ways, which will amplify the security risks of face recognition technology.

For example, the "3 15" party on 202 1 revealed that many well-known stores such as Kohler Sanitary Ware and BMW installed face recognition cameras to take face images and automatically generate numbers without consumers' knowledge. A manager of Suzhou Wandianzhang Network Technology Co., Ltd. said that they have installed face recognition systems for many businesses, and the platform currently has hundreds of millions of face data.

In addition, the comprehensive coverage of face recognition system in public places enables monitoring equipment to quickly identify specific individuals in public spaces, which leads to the expansion of monitoring power. With the help of face recognition technology, monitoring equipment can continuously track and monitor individuals, forming a "super panoramic prison", which has a negative impact on the protection of human rights and individual rights. It can be seen that in order to strike a balance between maintaining public safety and protecting personal information rights and interests, it is necessary to make special provisions on the installation of image acquisition and personal identification equipment in public places.

On July 27th, 20021,the Supreme People's Court issued the Provisions on Several Issues Concerning the Application of Laws in the Trial of Civil Cases Involving Personal Information (Fa Shi [202 1]No. 15, hereinafter referred to as the Judicial Interpretation of Face Recognition), which provided guidance for the trial of civil cases involving face recognition.

In the process of drafting the judicial interpretation of face recognition, the aim of "protecting the legitimate rights and interests of the parties and promoting the healthy development of digital economy" is closely focused, and the balance between personal interests and public interests is fully paid attention to in the rule design.

Regarding the installation of image acquisition and personal identification equipment in public places, Item 1 of Article 2 of the Judicial Interpretation of Face Recognition stipulates that in violation of laws and administrative regulations, in hotels, shopping malls, banks, stations, airports, stadiums, entertainment places and other business places and public places, the processor uses face recognition technology for face verification, identification or analysis, and Article 5, paragraph 2, stipulates that in order to maintain public safety, the processor shall. Article 10 stipulates that a realty service enterprise or other building manager uses face recognition as the only authentication method for owners or property users to enter and leave the realty service area. If the owners or property users who disagree request other reasonable authentication methods, the people's court shall support them according to law.

2. Prerequisites for installing image acquisition and personal identification equipment in public places.

According to the provisions of this article, the installation of image acquisition and personal identification equipment in public places shall meet three preconditions:

First, we must safeguard public safety.

The installation of image acquisition and personal identification equipment in public places should directly promote the maintenance of public safety and conform to the necessary principles of personal information processing. For example, the purpose of installing a face recognition system in a hotel is to improve the accuracy of identity recognition, so as to effectively detect the whereabouts of criminal suspects, prevent irrelevant personnel from entering and leaving the hotel through fraudulent use of passenger room cards, and protect the personal and property safety of passengers.

Second, abide by relevant state regulations.

Processors should abide by the provisions of laws and regulations and other relevant provisions of the state when dealing with personal information, which is the basic requirement of the legal principle of personal information processing. At the same time, the processor uses these devices to collect personal images and identity information without personal consent, which is also the legal basis for the processor to abide by the relevant state regulations and fulfill the statutory duties or obligations of maintaining public safety.

Third, set up eye-catching prompt signs.

Signs such as "public video surveillance system is running" or "you have entered the video surveillance area" that exist in practice belong to these prompt signs. Because personal identification devices such as image acquisition devices and face recognition systems are non-perceptual, the processor should actively inform individuals of the installation and operation of such devices to protect their right to know and refuse to give consent.

Devices with processors installed in public places should have both image acquisition and identification functions. If a device only has the image acquisition function but not the identity recognition function, the operation of this kind of device does not involve personal information processing, so it does not belong to the adjustment object of this article; If the devices installed in the processor only have the recognition function but no image acquisition function, the operation of these devices will not bring risks to individuals beyond those that may occur when processing personal information under normal circumstances. For example, the processor installs an ID card identification device at the station to carry out safety inspection on passengers. Such personal information processing activities do not need to meet the strict conditions stipulated in this article.

In addition, the installation of image acquisition and personal identification equipment in non-public places may seriously infringe on individuals' right to personal information and privacy, so it should be prohibited in principle unless such behavior is obviously necessary to safeguard public interests.

Three. Detailed implementation rules for installing image acquisition and personal identification equipment in public places.

For image acquisition and personal identification equipment installed in public places, the processor should meet two specific requirements when using it:

First of all, the collected personal images and identity information are strictly used for the purpose of maintaining public safety. For example, based on the needs of epidemic prevention, after face recognition system is used to collect face information in public places, the processor can only use this information for epidemic prevention and control purposes (such as identifying whether the detected person wears a mask) and not for other purposes such as daily management.

Second, in principle, the processor shall not disclose or provide personal images and identity information collected by it to others. According to Article 23 of the Personal Information Protection Law, if the processor provides the personal information it processes to other processors, it shall obtain the individual's separate consent. According to Article 25 of the Personal Information Protection Law, the processor shall not disclose the personal information it processes, except with the individual's separate consent.