In 2021, while face recognition continues to advance, chaos is also happening, and legislative supervision has arrived. Why is legislation necessary? What is global legislative practice? What are the controversies and difficulties?
On December 17, the "2021 Woodpecker Data Governance Forum" hosted by the Nandu Personal Information Protection Research Center was held in Beijing. At the meeting, Shi Jiayou, professor at the Law School of Chinese Min University and executive director of the Civil and Commercial Legal Science Research Center, delivered a keynote speech to discuss the international experience of face recognition governance and the Chinese model.
1
There are rich legislative practices around the world, and there are differences and controversies
Shi Jiayou introduced that in recent years, in the world, the controversy about face recognition legislation is extremely fierce. The reason is that, first of all, the quality of face recognition algorithms is very different, and excessive reliance on face recognition technology can easily lead to discrimination against specific ethnic groups and form "racial prejudice". For example, in the United States, if face recognition technology is used to detect criminal suspects, the probability of black people being identified as criminal suspects is much higher than that of whites, which is racial prejudice. Second, the quality of the photographs taken has a significant impact on the accuracy of the matching. For example, the light and angle of the photo itself are poor, the distance is far, the shooting quality is poor, the pixels are low, etc., which may lead to incorrect recognition or unrecognizability. Third, certain settings of the system can also cause recognition errors to occur. If the confidence threshold is set low, it is relatively easy to trigger a comparison, but the accuracy of the comparison results is low. Fourth, the application of facial recognition technology may pose a serious threat to an individual's privacy and freedom.
He described the case of Clearview AI, a company that has attracted a lot of attention around the world, to build a database of 3 billion faces by crawling public photos on social media. After the incident came to light, Clearview AI suffered lawsuits in several U.S. states. Google and Twitter have also explicitly sent stop-and-go letters to Clearview, prohibiting it from collecting face photos from their sites. Law enforcement agencies in other countries, such as Sweden, have also been penalized by their own data protection authorities for purchasing Clearview AI's facial recognition service.
Facial recognition legislation has been richly practiced around the world. Shi Jiayou introduced that in the United States, the first to make legal provisions on the issue of face recognition are the cities of some states. Cities such as San Francisco, Somerville, Oakland, Boston, Easthampton, and Springfield have enacted legislation prohibiting the use of facial recognition technology by governments. Cities such as Portland and New York have enacted legislation prohibiting the use of facial recognition technology in commercial establishments such as restaurants and retail stores open to the public. Subsequently, at the state level, some U.S. states have made legal provisions for biometric information, such as Texas, Illinois and Washington, which require enterprises to comply with prior notification and informed consent obligations to collect and use biometric information.
In Europe, the European Commission's draft Artificial Intelligence Regulation, submitted in April 2021, characterizes real-time biometric systems used by law enforcement agencies in public places as an "unacceptable risk" unless it is based on certain expressly defined purposes. Shi Jiayou analyzed that the exceptions in the bill are all necessary to achieve major public interests, and the importance of protecting interests exceeds its risks, including finding potential victims of crimes, including missing children, certain threats to the life and physical safety of natural persons or terrorist attacks, and detecting, locating, identifying or prosecuting criminal suspects.
In Shi Jiayou's view, the legislation of different european countries has diverged and disputed. In June 2021, the UK's Information Commissioner's Office issued a new "Practice Guide" that considers that public institutions and businesses can be allowed to use remote biometric technology in public places, but believes that a higher barrier to entry should be set. The French data protection regulator CNIL believes that as far as face recognition is concerned, in addition to the protection of personal information, it also involves possible infringements on personal freedom, such as the freedom of individuals to travel anonymously. The CNIL had refused to allow two secondary schools in Nice and Marseille to install facial recognition devices at their entrances. In December 2021, the Italian Parliament passed a moratorium ban on video surveillance of facial recognition technology, which prohibits private institutions from using such devices in public places; the ban is tentatively scheduled until December 31, 2023.
2
China's legislative model: it is not advisable to impose a one-size-fits-all ban
What is the model of domestic face recognition governance? In Shi Jiayou's view, in view of the actual situation of China's economic and social development, it is not possible to copy the methods of Europe or the United States, and it is not appropriate to adopt a one-size-fits-all complete ban on face recognition.
However, he stressed that legislation is necessary. In July this year, the Supreme People's Court issued the Provisions on Several Issues Concerning the Application of Law in the Trial of Civil Cases Involving the Use of Face Recognition Technology to Handle Personal Information, which is the only legal document in China that specifically stipulates the issue of face recognition so far, which is of landmark significance; in August, the Personal Information Protection Law of the People's Republic of China was passed by the legislature to regulate the application of face recognition at the legal level. The second paragraph of Article 28 of the Personal Information Protection Act stipulates that a processor of personal information may only handle sensitive personal information if it has a specific purpose and sufficient necessity and takes strict protective measures. According to the relevant provisions of the Personal Information Protection Law, face information as sensitive information must be handled with the individual's separate consent, and business operators must not collect their face information and identify them without the knowledge of consumers; face recognition monitoring devices set up in public places can only be used to maintain public safety, and must not be used to analyze individuals' occupations, consumption capacity, consumption frequency and habits and other unrelated purposes. In response to the phenomenon of "brushing face" access control, the affected individuals must be given the right to choose to verify the identity by means other than face recognition.
In addition, article 27 of the Personal Information Protection Law stipulates that where a personal information processor handles personal information that has been disclosed and has a major impact on the rights and interests of individuals, it shall obtain the consent of the individual in accordance with the provisions of this Law. Shi Jiayou believes that this provision is very important to prevent the occurrence of similar cases of Clearview AI. "The user's willingness to publish photos on social media is not the same as being willing to be collected by others for face recognition, and the use of this recognition is often unfavorable to the user, and may even be used to engage in illegal and criminal acts, which obviously violates the purpose of the user's public photo information." He said.
He also placed particular emphasis on the protection of information on the faces of minors. He believes that whether it is online or offline applications, in principle, it should be prohibited to face recognition of minors under the age of 14; if it is necessary to install face recognition devices for reasons such as public safety (such as campus security), the object of recognition should be adults entering and leaving the campus, not minors.
Producer: Nandu Artificial Intelligence Ethics Research Group
Written by: Nandu reporter Li Yaning
![Building trusted AI, the four experts discussed the new trend of biometrics with enhanced privacy protection[fig]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)