How to balance public safety and personal information protection

An era of "looking at faces" seems to be coming quietly. With the development of technology, the application places of face recognition are more and more extensive. Especially during the epidemic prevention and control in COVID-19, in addition to shopping malls, supermarkets, railway stations, hospitals and other places, some residential areas also began to recognize the faces of people entering and leaving.

While technology brings convenience, speed and efficiency, it also brings more and more concerns about personal information security. Recently, the topic that #2 yuan can buy thousands of photos of private faces with money rushed to the hot search, which once again touched social nerves. Almost at the same time, a news that "Hangzhou intends to legislate to clarify that the property shall not force the owner’s face recognition into the community" has also aroused widespread concern.

How to balance the relationship between personal information protection and public safety? Just last month, the draft law on the protection of personal information, which attracted much attention, was submitted to the 22nd meeting of the 13th the National People’s Congress Standing Committee (NPCSC) for deliberation. The draft will deal with public health emergencies or protect the life and health of natural persons in emergencies as one of the legal situations for handling personal information.

How to coordinate the relationship between the needs of public interests such as epidemic prevention and information collection and processing, how to minimize the collection of personal information through legislative means and conform to the principle of proportionality, under what circumstances important information such as faces should be collected, how to keep them after collection, and who will be held liable once they are leaked, how to hold them accountable … In the opinion of some industry experts, the current provisions of the draft still need to be further improved, and a series of problems still need to be studied.

Clarify the exemption provisions in case of public health emergencies.

It should be noted that with the popularization and application of next-generation information technologies such as big data, cloud computing, Internet of Things and artificial intelligence, China’s overall digital transformation has been significantly accelerated, economic and social development has increasingly shown a new trend of data-driven, and various personal information processing activities have been continuously expanded.

It is particularly worth mentioning that collecting personal information and conducting big data analysis have become an effective way for efficient social management worldwide. In this response to the COVID-19 epidemic, the application of big data has played a very important role in monitoring, early warning and statistical analysis of key populations, providing strong support for joint prevention and control and resumption of work and production.

At present, many countries in the world have adopted the principle of giving priority to public interests in the event of public health emergencies, and it has become a practice to break through the barrier of personal information protection and track and disclose epidemic information.

Article 27 of the draft stipulates that the installation of image acquisition and personal identification equipment in public places should be necessary for the maintenance of public safety, comply with relevant state regulations, and set up obvious warning signs. Personal images and personal identity information collected can only be used for the purpose of maintaining public safety, and may not be disclosed or provided to others; Except with the individual’s separate consent or as otherwise provided by laws and administrative regulations.

At the same time, considering that some personal information has been spread out of order in practice, and even cases have occurred in which personal information such as the names, ID numbers, residential addresses and contact information of patients, close contacts and returnees from other places have been illegally spread, the draft notes specifically point out that in the above circumstances, personal information must also be handled in strict compliance with the processing rules stipulated in this Law and fulfill the obligation of personal information protection.

Strengthen the awareness and obligation of personal information protection of the collection subject.

The exemption provisions of the draft on the protection of personal information in case of public health emergencies have become the focus of many members of the National People’s Congress Standing Committee (NPCSC) during the group deliberation.

"Sufficient space should be reserved for the normal use of personal identification equipment in non-public safety fields, and norms and constraints should be given at the same time." Commissioner Lv Wei believes that it is necessary to define the scope of application of image acquisition, personal identification equipment and supervision rules, and it is suggested to specify the procedures required for installing image acquisition equipment in public places. In addition, Lv Wei believes that the draft should also stipulate when the information collected by camera facilities in public places can be used in non-public areas and how to make full use of existing information resources.

In the view of Committee member Liu Xiuwen, this provision does not mean that "public health" and "public safety" can directly become the universal reason for personal information protection exemption. "In the prevention and control of epidemic situation in COVID-19, migrant workers are faced with multi-level and multi-departmental information collection in the streets, communities, public security, and units where they work, which not only wastes administrative and social management resources, but also increases the risk of personal information management." Liu Xiuwen believes that by refining the operating norms of personal information sharing, we can reduce repeated collection, improve response efficiency, and prevent information leakage under the circumstance of personal information protection exemption.

Liu Xiuwen suggested that the damage to personal information should be limited to a minimum according to the principle of proportionality. Specifically, it includes: as far as possible, defining the subject who has the right to collect personal information in public health emergencies or emergencies; Strengthen the awareness and obligation of personal information security protection of the collection subject to reduce the risk of information exposure; Clarify the norms of personal information data sharing and the subsequent personal information processing mechanism in public health emergencies or emergencies.

Legislation should balance the relationship between public safety and personal privacy.

Face recognition system will invade privacy for most people who don’t need it, but it will be very necessary for a few people who need help, such as lost old people and children. Obviously, how to balance is a problem that must be considered.

"We must recognize the particularity of biometric information including fingerprints and faces." Shi Jiayou, a professor at the Law School of Renmin University of China and executive director of the Civil and Commercial Law Science Research Center, pointed out that biometric information is not only sensitive, closely related to the basic rights and freedoms of individuals, but also permanent and irreplaceable. "This means that once these personal information are leaked or illegally stolen, it will cause great harm to personal and property safety."

In Shi Jiayou’s view, the "public places" and "public safety" stipulated in the current draft are still relatively principled and broad. It is suggested that "for the purpose of preventing, investigating illegal and criminal acts" be added before "necessary for maintaining public safety", so that property management enterprises can be prevented from arbitrarily setting face recognition requirements.

Shi Jiayou also pointed out that for the collection and processing of personal information, the network security law clearly puts forward three principles: legality, legitimacy and necessity. "When dealing with the boundary between public safety and personal privacy, the legislation of personal information protection law should also consider these three points."

It is noteworthy that Article 32 of the draft stipulates that if laws and administrative regulations stipulate that the handling of sensitive personal information should be subject to relevant administrative licensing or stricter restrictions, such provisions shall prevail.

"At present, the problem may be more focused on how law enforcement agencies enforce the law. In other words, who should supervise it? " Shi Jiayou said that the pattern of law enforcement has always been scattered, which is also an old problem. Multi-head law enforcement will not only lead to "subjective emptiness", but even form a "vacuum zone" of supervision, making law enforcement unable to be effectively put in place.

"In short, in the context of comprehensively governing the country according to law, both public power and private rights should have their own boundaries. How to draw this boundary? Only by law, this is the most basic experience of modern social governance. " Shi Jiayou said.

Further Construction of Biometric Personal Information Protection Mechanism

Wu Shen Kuo, executive director of the International Center for Network Rule of Law of Beijing Normal University and secretary-general of internet society of china Research Center, pointed out that on the one hand, the collection and processing of personal biological information, including face recognition information, has significant social benefits, including supplementing identification sources and improving the accuracy and reliability of various digital verification methods, helping social public governance such as epidemic prevention and control, and industrial research and development to expand new businesses and applications; On the other hand, security incidents such as illegal collection, malicious use and illegal trading of personal biological information frequently occur, and the associated telecommunication network fraud and even vicious personal injury cases are common, which makes the public widely expect stronger legal protection.

At present, there is no uniform standard for the storage of a large number of collected personal information, including faces, and laws and regulations have not clearly defined the use of these data. Talking about how to further build a biometric personal information protection mechanism, Wu Shen Kuo thinks that it can be improved in many ways.

Wu Shen Kuo explained that the first step is to improve and strengthen the supervision and law enforcement through the refinement of law enforcement rules, improve the coordination and linkage level of various functional organs, and realize the full coverage of supervision in all aspects of information collection and processing. Secondly, promote the introduction of administrative handling guidelines and judicial interpretations for specific application scenarios of face recognition information, and maximize the order of judicial adjudication and administrative supervision. Thirdly, encourage research and development to upgrade personal bio-information protection application technology, and enrich specialized technical support. Finally, a special mechanism design of risk early warning and security response for special high-risk scenarios is constructed to effectively deal with serious security practices such as face recognition information disclosure. In addition, we should also pay attention to improving the intervention level of third-party social supervision, and promote the formation of multi-party participation in governance ecology covering complaints, reports and public interest litigation. (Reporter   Zhu Ningning)