Source: CNR
CCTV Beijing, April 25 News (Reporter Zhang Shengpo) When checking into the hotel, hand over the ID card, the hotel front desk will ask the passenger to point at the camera to "brush his face" before checking in. This should be a scenario that many people have experienced.
Recently, some travelers reported that when they checked into a hotel in Shanghai, they were told that they no longer needed to "brush their faces". On April 12, a reminder issued in the Shanghai Hotel Industry Public Security Management Information System showed that "it is strictly forbidden to conduct 'compulsory face brushing' verification for passengers who have presented their valid identity documents" and "it is strictly forbidden to have the problem of not being able to check in without 'brushing their faces'". In an interview with the media, the staff of the Shanghai Municipal Public Security Bureau said that at present, Shanghai has strictly prohibited mandatory face brushing in hotels in the city, and said that this is a special work deployment that has been carried out since last year, and has recently been reiterated and emphasized.
According to media reports, in addition to Shanghai, many places across the country, such as Guangzhou, Yichang, Hubei and Zhuhai, have asked hotels to cancel the "mandatory face brushing" rule. On April 24, CCTV reporters randomly interviewed a number of hotels in Beijing, Shanghai, Shijiazhuang and other places, and the staff all said that they would no longer "force face brushing" to check in, and only when they could not confirm with the naked eye that the ID photo matched the person, they would need face recognition verification.
In this regard, Guo Bing, deputy dean of the Institute of Data Rule of Law of Zhejiang Sci-Tech University, said that in the past, the public security department required hotels to force tourists to brush their faces, which was due to traditional security considerations. However, the relevant state departments and the public are gradually realizing that face recognition technology itself also has security risks, and this risk may be more harmful than traditional public security risks.
Tips published in the Shanghai Hotel Industry Public Security Management Information System
CPPCC members: It is easy to cause dissatisfaction among tourists and increase the operating costs of enterprises
Guo Bing has been studying the Personal Information Protection Law for many years, and he is better known to the public as the chief complainant of the "first domestic facial recognition case". According to him, Article 21 of the Mainland's Anti-Terrorism Law, issued in 2015, stipulates that operators and service providers of various businesses, including "accommodation", shall verify the identity of customers. Services must not be provided for those whose identities are unclear or who refuse to have their identities checked.
This may be the legal basis for the police to require the hotel to verify the identity of the traveler. Guo Bing told reporters that as for how to verify identity, the law does not clearly stipulate. In practice, it was initially a manual inspection of ID cards, but as the technology continued to mature, there were electronic devices dedicated to checking ID cards. In recent years, with the development of face recognition technology, face recognition technology has been applied in the field of identity verification.
He said that in recent years, face recognition technology has been developing and is becoming more and more widely used in the daily life of the public, but the technology of using face recognition technology to engage in illegal and criminal activities is also developing, and the security risks contained in it are becoming more and more prominent. In addition to the risk to individuals, once personal information is misused or leaked on a large scale, it may bring significant risks to the public interest and even national security.
During the National People's Congress and the National People's Congress this year, Dai Bin, a member of the National Committee of the Chinese People's Political Consultative Conference, president of the China Tourism Academy, and director of the data center of the Ministry of Culture and Tourism, submitted a proposal on restricting the excessive use of "face recognition" in tourism scenes.
Dai Bin's research found that almost all provinces and cities of guesthouses, hotels, B&Bs and other tourist accommodation institutions have set up face recognition systems, in addition to showing and checking identity documents by reception staff, tourists also have to go to the special face recognition equipment in front of the "face" to check-in.
He believes that this measure not only reduces the efficiency of services, is easy to cause dissatisfaction and complaints from tourists, but also increases the operating costs of enterprises.
In fact, Dai Bin found in his investigation of hotel enterprises, tourism and commerce authorities, grassroots police stations and local public security bureaus in Yunnan, Beijing, Guangdong and other places that there are no clear laws and administrative regulations for the installation of facial recognition equipment terminals in hotels, nor are there formal departmental rules. Now, places that allow tourists to do facial recognition are implemented according to the principle of "inform and agree", that is, the public security department informs the hotel, hotel, and homestay, and then they also agree, so it is done.
Dai Bin suggested that the Ministry of Public Security should promptly guide local public security departments to cancel the regulations that tourists must "brush their faces" when staying in hotels, and recall relevant software and hardware equipment. At the same time, he also suggested that the Legislative Affairs Committee of the National People's Congress conduct special inspections on the "forced face brushing" behavior of government departments and market entities, and conduct a legality review of relevant systems, regulations and standards.
Expert: The benefits are small, but the risks are great
Yao Zhiwei, a professor at the Law School of Guangdong University of Finance and Economics and director of the Network and Information Law Research Association of the China Law Society, introduced that facial information is biometric information, and according to the provisions of the Personal Information Protection Law, biometric information is sensitive personal information, and once leaked or illegally used, it is easy to cause the personal dignity of natural persons to be violated or personal and property safety to be endangered.
He said that the collection and use of facial information must comply with the provisions of the Personal Information Protection Law, and personal information processors can only process sensitive personal information when there is a specific purpose and sufficient necessity, and strict protective measures are taken.
In Yao Zhiwei's view, the hotel's collection of passengers' facial information may no longer comply with the principle of necessity, because the travelers have submitted their identity documents, and the hotel management can manually verify them on the spot, and the possibility of discrepancies in the person's ID card is extremely small. In addition, the current facial recognition technology cannot guarantee the absolute accuracy of the witness information.
"So in this scenario, it's not necessary to put travelers at such a risk. Yao Zhiwei said. Any social management tool is a combination of benefits and risks. From the current point of view, the hotel's "forced face brushing" method has a small benefit, but the risk is very large, and there is no need to continue. For example, he said that facial recognition is now commonly used to log in to personal bank accounts, and if facial information is leaked and abused in other channels, it will bring great property security risks to individuals. In Guangdong, there have been cases in which criminal gangs have specialized in collecting facial information, breaking through the security authentication of the financial system, and transferring users' deposits.
Guo Bing believes that this kind of worry is not necessary, from a practical point of view, if the criminals want to take advantage of the loophole of hotel identity verification, they will most likely not live in a regular hotel, even if they stay, they will find various ways to avoid the link of face recognition.
A police officer from a street police station also told reporters that from the perspective of grassroots security, the installation of a face recognition system in the hotel will not help them much, mainly to reduce the pressure of the hotel to verify the identity of tourists. Now that the cancellation is complete, the workload of hotel staff to verify the identity of travelers will increase.
"The cancellation of face recognition will not have much impact on us, that is, in the future, we will have to rely on our employees to compare the passenger's ID card with their own appearance, which is a little difficult. A hotel executive said.
Guo Bing suggested that although some places are still requiring hotels to "brush their faces" on travelers, ordinary consumers should cooperate cautiously from the perspective of personal information security. In daily life, we should follow the principle of "providing as little personal confidence as possible, and not providing sensitive personal information unless absolutely necessary".
Lawyer: The hotel "forced face brushing" or violated the privacy of passengers
"Face recognition technology is a typical application scenario of artificial intelligence, and in a sense, its security risk is also a security risk in the application of artificial intelligence technology. Guo Bing said.
According to Guo Bing, in August 2021, according to the requirements of the "Provisions on Several Issues Concerning the Application of Law in the Trial of Civil Cases Related to the Use of Facial Recognition Technology to Process Personal Information" issued by the Supreme People's Court, if the information processor processes facial information in any of the following circumstances, the people's court shall determine that it is an act that infringes on the personality rights and interests of natural persons: violating the law in hotels, shopping malls, banks, stations, airports, stadiums, entertainment venues and other business venues and public places, Administrative regulations provide for the use of facial recognition technology to verify, identify, or analyze faces, but do not disclose the rules for handling facial information or do not clearly indicate the purpose, methods, or scope of processing.
In addition, on August 8, 2023, the Cyberspace Administration of China (CAC) issued the Provisions on the Security Management of the Application of Facial Recognition Technology (Trial) (Draft for Comments), which clarifies that, in accordance with the requirements of the Personal Information Protection Law, facial recognition technology can only be used to process facial information when it has a "specific purpose" and sufficient necessity, and strict protective measures are taken, and it also proposes that "to achieve the same purpose or meet the same business requirements, non-biometric recognition technology solutions shall be preferred". Article 9 proposes to require that in hotels, banks, stations, airports, stadiums, exhibition halls, museums, art galleries, libraries, and other business venues, except where laws and administrative regulations provide that facial recognition technology shall be used to verify an individual's identity, individuals must not be forced, misled, fraudulent, or coerced to accept facial recognition technology to verify their personal identity on the grounds of handling business or improving the quality of services.
As the first supporting administrative regulation of the Consumer Rights and Interests Protection Law, the Regulations for the Implementation of the Consumer Rights and Interests Protection Law of the People's Republic of China (hereinafter referred to as the "Regulations"), will come into force on July 1, 2024. Article 23 of the Regulations stipulates that when providing goods or services, business operators shall not excessively collect consumers' personal information, and shall not use methods such as one-time general authorization or tacit authorization to compel or indirectly compel consumers to consent to the collection and use of personal information that is not directly related to business activities.
Chen Sainan, a lawyer at Beijing Jingjing Law Firm, said that with the continuous improvement of the mainland's personal information protection system, there is a risk that hotels forcing travelers to "brush their faces" will infringe on their privacy and leak personal information. In addition, the Provisions on the Security Management of the Application of Facial Recognition Technology (Trial) (Draft for Comments) and the Regulations for the Implementation of the Law on the Protection of Consumer Rights and Interests will be promulgated soon, which further emphasizes the importance of personal information protection, requiring that facial recognition technology must not be used without sufficient necessity and protection measures, and requiring priority to non-biometric recognition technology, which may be part of the factors driving the abolition of "mandatory face brushing" in some places.
Guo Bing believes that these regulations that have been promulgated and have not yet been introduced and implemented are enough to regulate the behavior of "mandatory face brushing" in hotels. Since hotels have been "mandatory" for many years, it may be difficult for hotels to remove the requirements for face brushing in the short term, as all places may not have clear internal requirements like Shanghai and other places, and actively promote the implementation of these requirements.
![Happy May Day safety first, pay attention to fire safety when staying in the hotel[fig]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)