On December 14, the topic of "Xiaopeng Automobile collecting 430,000 face photos in 6 months" caused a hot discussion. Xiaopeng Motors then responded that the data had been deleted.
Recently, Xiaopeng Automobile was fined 100,000 yuan by the Shanghai Xuhui District Market Supervision and Administration Bureau for infringing on the personal dignity of consumers, infringing on consumers' personal freedom or infringing on consumers' right to protect their personal information according to law.
According to the administrative penalty decision, in 2019, Xiaopeng Automobile Sales Co., Ltd., the parent company of Shanghai Xiaopeng Automobile Sales Service Co., Ltd., signed the "Framework Contract for Passenger Flow Monitoring Projects in Xiaopeng Automobile Stores" with a company, and the contract stipulated that the parties would purchase store passenger flow monitoring project services from a company from March 1, 2019.
After Xiaopeng Automobile Sales Co., Ltd. purchased the above services, it can obtain facial recognition data through the portrait recognition camera equipment installed in its stores, and can analyze the number of people entering the store, the proportion of men and women, and age analysis. It is reported that Shanghai Xiaopeng Automobile Sales service Company purchased a total of 22 camera equipment with face recognition functions to install in its stores, and the hardware and software procurement fee totaled 173822.77 yuan, involving 5 direct stores and 2 franchise stores. 8 system accounts were opened, and from January 2021 to June 2021, the above-mentioned face recognition camera devices collected and uploaded 431623 face photos.
After the punishment incident was reported, Xiaopeng Motors gave a response. According to his words, in this incident, the stores in the Shanghai area hoped to improve the reception process and better serve the customers who arrived in the store through the collection and analysis of data such as the store's customer flow, but due to their unfamiliarity with the relevant legal terms, they mistakenly purchased and used the products of a third-party supplier (Yuluoke) that violated the relevant legal terms. Face data is collected and analyzed by third-party software providers, and the data has been completely deleted. Xiaopeng Motors does not disclose or illegally use personal information, and only uses non-personally related digital data such as passenger flow visits as a reference for business conditions.
Xiaopeng Automobile said that it will strictly abide by the provisions of the state on the protection of consumers' personal information, ensure that the legitimate rights and interests of customers are not infringed, and apologize for the troubles caused to the public and customers by this incident.
It should be noted that the administrative penalty decision shows that it is not Shanghai Xiaopeng Automobile Sales service Company that purchases the service of the store passenger flow monitoring project, but its parent company, Xiaopeng Automobile Sales Co., Ltd., which also includes sales and service companies in Wuhan, Chongqing, Ningbo, Xiamen and other parts of the country. Do these subsidiaries also provide passenger flow monitoring services? In this regard, Xiaopeng Automobile did not respond.
For the penalty of Xiaopeng Automobile, netizens have commented: "430,000 faces, this is also too exaggerated!" "Is there a similar data collection in the sales office, and it really should be rectified." Some netizens also believe that the punishment is relatively light: "A face is less than 2 cents, is this not encouraging corporate crime?" ”
It is no accident that Xiaopeng Automobile collected face information without authorization. This year, CCTV "315" has exposed kohler bathroom, BMW car 4S store and other businesses to install face recognition cameras, consumers as long as they enter one of the stores, without knowing it, they will be captured by the camera and automatically generate a number, and then customers will go to which store, go to several times, these merchants will know.
Face information has become a lot of users' payment passwords, account passwords, etc., because users can not change their face information, once leaked, will seriously threaten the user's property security, privacy security and so on. The "Personal Information Security Specification" issued by the State Administration for Market Regulation clearly stipulates that face information belongs to biometric information and also belongs to sensitive personal information, and the authorization and consent of the personal data subject should be obtained when collecting personal information. Article 1035 of the Civil Code, which came into effect on 1 January 2021, also clearly stipulates that the consent of the natural person or his guardian shall be obtained for the handling of personal information.
Image source: Xiaopeng Motors