On April 9th, according to domestic media reports, today, the State Council Information Office held a routine press conference on State Council policies, during which officials introduced the relevant situation regarding the "Regulations on the Implementation of the Consumer Rights Protection Law of the People's Republic of China."
According to You Xueyun, the head of the Cyber Law Enforcement Bureau of the State Cyberspace Administration of China, when operators provide goods or services, they are not allowed to excessively collect consumers' personal information. They are prohibited from using methods such as one-time blanket authorization or default authorization to force or indirectly force consumers to agree to the collection and use of personal information unrelated to business activities.
Yu Xueyun stated that the basic function of online shopping is to purchase goods. The necessary personal information includes the mobile phone number of registered users, which is our mobile number; the name, address, and contact number of the recipient; payment time, payment amount, payment channel, and other payment information.
"If it goes beyond these, such as facial recognition, then it is excessive collection and not necessary personal information," said Yu Xueyun.
It is understood that in August last year, "Cyberspace Administration of China" issued a document to solicit public opinions on the "Regulations on the Security Management of Facial Recognition Technology Application (Trial) (Draft for Soliciting Opinions)."
It mentioned that facial recognition technology can only be used to process facial information under specific purposes and sufficient necessity, and strict protection measures must be taken.
If there are other non-biological feature recognition technology solutions that can achieve the same purpose or meet the same business requirements, non-biological feature recognition technology solutions should be prioritized.
The use of facial recognition technology to process facial information shall obtain the individual's separate consent or obtain written consent in accordance with the law, except as otherwise provided by laws and administrative regulations that do not require individual consent.
Users of facial recognition technology in public places, or those storing facial information of more than 10,000 people, shall register with the cyberspace administration department at or above the municipal level within 30 working days.
