Provisions on Several Issues on the Application of Law in Hearing Civil Cases Related to the Use of Facial Recognition Technology to Handle Personal Information

Promulgation Date: 2021-7-28
Title: The Supreme People's Court's Provisions on Several Issues on the Application of Law in Hearing Civil Cases Related to the Use of Facial Recognition Technology to Handle Personal Information
Document Number:法释〔2021〕15号
Promulgating Entities: Supreme People's Court
Source of text: http://www.court.gov.cn/fabu-xiangqing-315851.html

These Provisions are drafted on the basis of the PRC Civil Code, the PRC Cybersecurity Law, the PRC Consumer Rights Protection Law, the PRC E-Commerce Law, The PRC Civil Procedure Law, and other laws, in consideration of actual trial practice conditions, so as to correctly hear civil cases related to the use of facial recognition technology to handle personal information, to protect parties' lawful rights and interests, and to promote the healthy development of the digital economy.

Article 1: These Provisions apply to civil cases arising from information handlers use of facial recognition technology to handle facial information or facial information generated based on the facial recognition technology in violation of laws and administrative regulations or agreement between the parties,

The handling of facial information includes the collection, storage, use, processing, transmission, provision, disclosure, etc., of facial information.

"Facial Information" as used in these Provisions belongs to "biometric information" as provided for in article 1034 of the Civil Code.

Article 2: in any of the following circumstances, the people's courts shall find that information handlers' handling of facial information is a violation of natural persons' personality rights:

(1) The use of facial recognition technology is in violation of laws or administrative regulations for face verification, identification, or analysis in business places or public venues such as hotels, malls, banks, transport stations, airports, stadiums, and entertainment venues;

(2) Where failing to disclose the rules for handling facial information or not clearly indicating the purpose, methods, and scope of handling;

(3) Where handling of facial information is based on individual consent, and the independent consent of the natural persons or their guardians is not obtained, or where the written consent of the natural persons or their guardians is not obtained as provided by laws or administrative regulations;

(4) Where the purpose, methods, scope, etc. for handling facial information, as clearly indicated by the information handler or agreed to by the parties, is violated.

(5) Where the failure to employ technical or other necessary measures for ensuring the security of collected or stored facial information causes leaks, alterations, or losses of facial information;

(6) Where facial information is provided to others in violation of the provisions of laws or administrative regulations or agreements between the parties;

(7) The handling of facial information contrary to public order and good custom;

(8) Other situations of handling facial information in violation of the principles of legality, propriety, and necessity.

Article 3: People's courts finding that information handlers bear civil responsibility for violating natural persons' personality rights, shall apply the provisions of article 998 of the Civil Code and comprehensively consider specific case circumstances such as whether the victim is a minor, circumstances of notice and consent, as well as the degree to which it is needed by the information handlers, and other such factors.

Article 4: In any of the following circumstances, the people's courts are not to sustain the information handlers' defense that they obtained the consent of the natural persons or their guardians:

(1) Where information handlers required natural persons to consent for the provision of products or services, other than where the handling of facial information is needed for the provision of goods and services;

(2) Where information handlers required natural persons' consent to the handling of their facial information by bundling it with other authorizations;

(3) Other situations where natural persons' consent to the handling of their facial information was coerced or indirectly coerced.

Article 5: In any of the following circumstances, the people's courts are to lawfully support the information handlers' claim that they do not bear civil responsibility:

(1) Where the handling of facial information is necessary to respond to public health incidents or to protect natural persons' security in their lives, health, and property in an emergency;

(2) Where the use of facial recognition technology in public places for the preservation of public safety is based on relevant state provisions;

(3) Where handling facial information within a reasonable range in order to carry out acts such as news reporting and public opinion oversight in the public interest;

(4) Where the handling of facial information is reasonable within the scope of the natural persons' consent or that of their guardian;

(5) Other situations eligible under laws or administrative regulations.

Article 6: Where parties demand that information handlers bear civil responsibility, the people's courts shall determine the parties' responsibility for producing evidence on the basis of Article 64 of the Civil Procedure Law as well as articles 90 and 91 of the Supreme People's Court's Interpretation on Applying the Civil Procedure Law of the PRC, and the relevant provisions of the Supreme People's Court's Several Provisions on Civil Evidence.

Where information handlers claim that their conduct complied with the circumstances provided for in the first paragraph of Civil Code article 1035, they shall bear the burden of producing evidence on the factual basis for that claim.

Where information handlers claim that they do not bear civil responsibility, they shall bear the burden of producing evidence showing that their conduct complied with article 5 of these provisions.

Article 7: Where multiple information handlers handle facial information in violation of natural persons' personality rights, and that natural person argues that the information handlers are to bear responsibility for the tort in accordance with the degree of fault and the size of the resulting harm, the people's court is to support it in in accordance with law; and where the circumstances comply with the respective circumstances provided for in articles 1168, 1169 paragraph 1, 1170, 1171 and so forth, and the natural persons claims that multiple information handlers are to bear joint liability, the people's courts are to support it in accordance with law.

Where information handlers use online services to handle facial information infringing on natural persons' personality rights, apply civil code articles 1195, 1196, 1197, and so forth.

Where information handlers' handling facial information infringe on natural persons' personality rights causing a loss of assets, and the natural persons argue for compensation of the loss of assets on the basis of Civil Code article 1182, the people's courts are to support it in accordance with law.

Reasonable expenses paid by natural persons to stop the infringing conduct may be found to be asset losses as provided for by article 1182 of the Civil Code. Reasonable expenses include the costs incurred by the natural persons or their legal representatives in investigating and collecting evidence on the violating conduct. Based on the parties' demands and the specific case circumstances, the people's courts may include reasonable lawyers fees within the scope of compensation.

Article 9: Where natural persons have evidence showing that information handlers are using facial recognition technology to currently or imminently carry out violations of their privacy rights or the personality rights of others, and that their lawful rights and interests will suffer a harm that is difficult to repair the harm if it not promptly stopped, and they apply to the people's courts to order the information handlers to stop the relevant conduct, the people's courts may make an injunction on infringement of personality rights in accordance with law on the basis of the specific circumstances of the case.

Article 10: Where property management services or other building managers make facial recognition the sole means of identification for the owners or users of the property to enter or exit the managed area, and owners or users who do not consent request that they provide other reasonable methods of identification, the people's courts are to support them in accordance with law.

Where the circumstances provided for in article 2 of these Provisions exist in property management services or other managers, and a party demands that the property management service or other building managers bear responsibility for the tort, the people's courts are to support it in accordance with law.

Article 11: Where information handlers employ template language in concluding contracts with natural persons, requesting that the natural persons authorize the right to handle facial information for an unlimited time period, irrevocably, and fully transferrable, and so forth, and that natural persons demand a determination that the template language is invalid on the basis of Article 497 of the Civil Code, the people's courts are to support it in accordance with law.

Article 12: Where information handlers handle natural persons' facial information in violation of agreements, and the natural persons demand that they bear responsibility for breach of contract, the people's courts are to support it in accordance with law. When the natural persons demand that facial information be deleted when they are demanding that the information handlers bear responsibility for breach of contract, the people's courts are to support it in accordance with law; and where the information handlers object that the parties did not make an agreement on the deletion of facial information, the people's courts are not to support it.

Article 13: Where multiple victims separately initiate litigation in the same court based on the same dispute about an information handler's handling of facial information in violation of natural persons' personality rights, the people's courts may combine them for trial with the consent of the parties.

Article 14: Where information handlers handling of facial information meets the conditions of Civil Procedure Law article 55, Consumer Rights Protection Law article 47, or other laws on civil public interest litigation, and the organs prescribed by law or relevant organizations initiate civil public interest litigation, the people's courts should accept it.

Article 15: Where, after a natural person has died, information handlers violate laws and administrative regulations or agreements between the parties in handling facial information, and the relatives of the deceased demand that the information handler bear civil responsibility, these Provisions apply..

Article 16: These Provisions are to take effect on August 1, 2021.

Where information handlers' use of facial recognition technology to handle facial information or facial information produced based on the use of facial recognition technology occurred before these Provisions took effect, these Provisions do not apply.