On 8 August 2023 the Cyberspace Administration of China published for public consultation the Safety Management Measures for the Application of Face Recognition Technology (Trial). The text is short, but it moves face recognition from a question of technology selection back to a question of legal basis.
For products and users of face recognition, five questions come first: is it necessary, is it the only method, where is it installed, how much is stored, and where does the data go.
Is it necessary
The draft requires a specific purpose and sufficient necessity, and the least intrusive means. Necessity is not a self-declaration. A company must be able to explain why other methods cannot achieve the same purpose, and why face recognition rather than fingerprint, password or document verification.
In office access control, membership identification and attendance, the necessity case is often thinnest. Companies should weigh efficiency gains against impacts on individual rights rather than assuming that facial verification is simply more advanced.
Is it the only method
The draft provides that, except where law or administrative regulations require face recognition, it may not be used as the sole verification method. Where an individual refuses facial verification, another reasonable and convenient method must be offered.
This directly affects product design. A product offering only facial login may need an alternative path. The alternative cannot be a deeply buried, visibly inferior option, or it may still be treated as disguised coercion.
Where it is installed
Face recognition equipment in public spaces must be necessary for public security, comply with state rules and carry prominent notices. Installation in private spaces such as hotel rooms, bathrooms, changing rooms and restrooms is prohibited.
For commercial premises, “necessary for public security” is a higher threshold than “necessary for business management”. Shopping centres and stores installing cameras for footfall analysis must distinguish general video surveillance from face recognition; the former does not automatically permit the latter.
How much, and how long
The draft provides that face data should be stored within the device and not transmitted over the internet, unless separate consent is obtained or law provides otherwise. Where face data of more than 10,000 individuals is stored, filing with the provincial or higher cyberspace authority is required.
Filing is not a simple headcount registration. It usually requires purpose, method, scope, retention period and security measures. For retail chains, industrial parks and property management, cumulative numbers cross the threshold easily, and centralised counting should start early rather than at inspection.
Where the data goes
Face data is sensitive personal information. The draft requires storage in China in principle; where cross-border provision is genuinely necessary, security assessment, standard contracts or certification must be used. For minors’ face data, guardian consent and dedicated processing rules are required.
The most overlooked point is the supplier chain. Algorithms, cameras and access systems often come from third parties, and data may be processed in supplier clouds. Contracts should specify purpose, retention, method, security measures and deletion obligations, together with incident notification and assistance.
For face data processing and filing, see our data compliance service; for algorithms and system launch, see algorithm filing; for device and system security, see cybersecurity compliance.
This article is based on the draft Safety Management Measures for the Application of Face Recognition Technology (Trial) published for consultation by the Cyberspace Administration of China on 8 August 2023. It is for reference only and does not constitute legal advice.