LOSING FACE
Facial recognition technology surges in China, but privacy protections fail to catch up
You wake up and stare at the phone screen to unlock it. You peer into a camera to exit your apartment complex, to clock in at work, and to pay for lunch at the convenience store. On the subway, the faces of commuters are displayed—along with their body temperatures—at the security checkpoint. Later, on the news, you see that two fugitives have been arrested after their faces were scanned by security cameras in a crowd at a concert.
This is not an imagined future, but a reality many cities across China are hoping to achieve as governments and companies pour money into facial recognition technology. But though facial recognition cameras have quietly become pervasive, especially since the Covid-19 pandemic, news of data leaks and scams have fueled debates around the safety of user information, citizens’ rights to privacy, and the opaque ways in which government and companies are using sensitive biometric data.
Facial recognition has become widespread in the last two or three years in China as the AI technology behind it has improved. Now, China is home to some of the world’s largest facial recognition companies. Hangzhou’s Hikvision, for example, is the world’s largest producer of surveillance cameras.
Facial recognition systems use “deep learning” algorithms to identify a person by analyzing images and measuring the contours of their face in minute detail, from the distance between their ears to the size of their nostrils, in order to find a match in a database of images.
The Chinese facial recognition market could exceed 5 billion RMB by 2021, with the vast majority of this demand driven by law enforcement and public security. Around 350 million surveillance cameras monitored China’s streets in 2018, according to research by AmericanBritish firm IHS Markit, and Chinese authorities had previously suggested that number would increase to 626 million by 2020. Eight of the ten most surveilled cities in the world, as measured by the number of security cameras per person, are in China.
Not all of these cameras have facial recognition capabilities, but an increasing number do. Even those that don’t can capture images that can be used to build a database for facial recognition technology. The “Sharp Eyes” program launched in 2015 by the National Development and Reform Commission, which invests billions of RMB into AI technologies to digitize surveillance and improve intelligence collection, has pushed facial recognition to the forefront of law enforcement.
This vast surveillance network promises increased safety and public order, and fewer places for criminals to hide. But there is growing concern that facial recognition software has become pervasive without the public being fully aware of what giving up
their facial data means. “Every day there are about 500 opportunities for cameras to capture our image, but how many of those have facial recognition capability, or are collecting our facial data—we have no way of knowing,” Lao Dongyan, a professor of criminal law at Tsinghua University, told People magazine.
Zang Yuqi, a 26-year-old from Beijing, uses facial recognition every day for shopping or just unlocking her phone. “When I walk on the street, the CCTV can recognize my face, so I probably don’t have any privacy in public spaces, maybe not even in my home because my phone has facial recognition functions,” she muses to TWOC. “Maybe I don’t have privacy at all. That’s the part that worries me.”
Zang is not alone. Back in 2018, Robin Li, CEO of internet firm Baidu, suggested Chinese people didn’t care about privacy and were willing to give it up for convenience. But his view was met with a barrage of negative comments online, and a survey in 2019 by Nandu Personal Information Protection Research Center, a research institute associated with the Southern Metropolis
Daily newspaper, found that 80 percent of over 6,000 respondents were concerned about their facial information being leaked.
Another survey of 20,000 respondents last year found that 60 percent felt facial recognition technology was being abused. Still, 65 percent also believed that the benefits of the technology outweighed the drawbacks. Zang is still willing to use the technology, despite her worries. “It’s really convenient, and during the pandemic, people don’t want to touch anything because they are worried about the virus…so it’s probably safer,” she says.
Another source of concern comes from the use of facial recognition technology by private companies. In the second half of 2020, it emerged that a number of real estate companies had installed facial recognition cameras in their showrooms to establish whether prospective buyers were first-time customers (thus eligible for discounts that amounted to 300,000 RMB at one showroom), and to work out how the customer had been referred to the company.
These cameras were installed and captured facial data without clients’ knowledge or consent. Similarly, there have been reports of property management companies installing facial recognition software at the entrances to apartment complexes without the residents’ permission, heightening citizens’ awareness of the dangers of losing their face.
Facial data is biometric, and unique to every individual, like a fingerprint. Unlike a fingerprint, however, it is contactless. “There’s no way to escape
“YOU CAN CHANGE YOUR ID NUMBER, PHONE NUMBER, AND ADDRESS; BUT YOU CAN’T CHANGE YOUR BIOMETRIC DATA”
it. If that information is leaked, there’s no way to get it back,” says Zhou Wang, associate professor at Nankai University’s Zhou Enlai School of Government. “You can change your ID number, phone number, and address; but you can’t change your biometric data.”
Not only is there a worrying trend of companies taking facial data without permission, it is also not clear how these companies protect the data—or if they can. “Property management companies have basically no incentive to update their systems or protect the data they collect,” according to Professor Lao.
Jia Qi (pseudonym), a university student in Beijing, recalls when her school installed facial recognition cameras in the dormitories around two years ago. “It felt like I was suddenly living in a sci-fi novel,” she tells TWOC. “No one asked if we agreed to give up our facial data…they didn’t tell us about data protection, or get us to sign a privacy agreement.”
Similarly, there are facial recognition cameras in the teaching buildings at Professor Zhou’s university, but no one ever asked if he consented to sharing his facial data: “If they install it, they install it; everyone just accepts it,” he says.
This is in part because there is no dedicated law for biometric data
yet in China, so it is unclear who is responsible for managing, storing, and keeping data safe. There is no comprehensive law equivalent to, for example, the EU’S General Data Protection Regulation. This law, which took effect in 2018, gives citizens the right to have their data deleted and requires companies to obtain explicit consent to collect user data.
At present, China’s data privacy regulations exist only at the city or industry level, and usually refer to standards rather than legally binding rules. This has led to a scenario where regular people, consciously or not, are giving up their facial data without knowing where or how it is stored or used, often to companies with little expertise in safeguarding the data.
This makes them easy targets for hackers or unscrupulous employees. In October 2019, a group of primary school students managed to hack a facial recognition security system used by mail storage lockers. Last year, around a dozen property owners in Nanning were tricked into giving their facial data to a real estate agent, who then sold their property without their knowledge and pocketed 10 million RMB from the scam.
In China’s first lawsuit over facial recognition, Guo Bing, a law professor from Hangzhou, took a local safari park to court in 2019 for taking his facial data without permission and insisting he scan his face to enter the park with his annual pass. In October of last year, the court ruled that the company had to delete Guo’s data, but failed to make a statement about the legality of the data collection.
The development and rollout of the technology has outstripped legislation by a long way.
The threat of data being misused, leaked, or obtained by hackers, is a real one. Personal data theft is rampant in China, with ID card numbers and phone numbers available for purchase on the internet for as little as 0.1 RMB. In November 2019, a massive data leak from financial lending platforms led to the loss of 468 million pieces of personal data.
To illustrate this, Deng Yufeng, an artist from Hubei province, purchased the personal data of 346,000 individuals on the internet for his installation 346,000 Wuhan Citizens’ Secret in 2018. “I’m just a regular person, who searched a few words online, and I could buy it; it was that easy,” Deng tells TWOC, speculating that it is probably just as simple to buy facial data online today.
Hoping to start a conversation about surveillance and privacy in China, Deng and a group of volunteers