When we quickly pass through the "face recognition" channel and allow financial institutions to use face recognition to confirm their identity, when we see that all the smart cabinets of rookie stations with cameras in China have opened the function of brushing their faces and taking them away, many people begin to worry about the "face recognition" technology. People are worried about whether face recognition technology will provide unprecedented power for the government to track people's daily lives and invade people's privacy; Moreover, the face recognition technology is still immature. Some people get someone else's courier through the function of "brushing their faces to get the courier" and using simple operations such as equal-scale color photos. If this technical loophole is exploited, they can steal other people's property.
Moreover, face feature information is highly sensitive and easy to be read, and there is a high risk of face information disclosure. If criminals try to obtain this information by illegal means and use it, the consequences will be unimaginable.
Face recognition technology was originally used to verify "whether you are really who you say you are". In the case of remote control transaction or identity confirmation, it is the most effective technical measure to confirm that an action is carried out by myself. It is the most effective technical measure to solve identity security problems such as electronic payment, online transaction and online application for public services. However, once the easily obtained "biological password" of face information is lost or changed at will, or others can really impersonate themselves through face technology, it becomes a lie to verify the true identity by using face recognition technology.
Facial features are unique and unchangeable for life. People can change their passwords frequently, but it is difficult to ensure the security of their accounts by changing their faces frequently. Once personal information is leaked, it is not only a problem of privacy leakage, but also a safety hazard to individuals and property. Once someone else has the same data as your facial features, he can wear a high-definition 3D mask and make corresponding actions with the system instructions, so he can implement various frauds, which is very harmful to society.
Legal Boundary of "Face Recognition"
The continuous development of technology is an irreversible social trend. Fear should not be a reason to limit the development of technology. Only by making good use of technology and effectively guiding it is a rational choice. Nowadays, face recognition technology can be used in personnel access management and urban security, including public security arresting fugitives, enabling face brushing system in community access control, VIP management of some businesses, "face brushing sign-in" in university classrooms, party identity verification, delivery and other legal enforcement and judgment enforcement fields. It is used in the business field, such as detecting the characteristics of potential customers (such as age, gender, etc.). ) to advertise more accurately, and there are a large number of "face-changing" applications, such as face-changing entertainment software. In fact, all the above applications are at risk of infringement. Personal information, including face information, belongs to the category of citizens' privacy, and illegal collection, use or transaction will bear legal responsibilities including criminal, civil and administrative responsibilities. So, what are the provisions of China law on face data?
(1) According to the Constitution of People's Republic of China (PRC):
Article 38 The personal dignity of People's Republic of China (PRC) citizens shall be inviolable. It is forbidden to insult, slander, falsely accuse or frame citizens in any way.
Fortieth the freedom and privacy of communication between the people of China and the citizens of People's Republic of China (PRC) shall be protected by law. When public security organs and procuratorial organs check communication according to the procedures prescribed by law, no organization or individual may infringe upon citizens' freedom and privacy of communication for any reason, except for the needs of national security or criminal investigation.
(2) According to the Criminal Law of People's Republic of China (PRC):
Article 246 Whoever publicly insults others by violence or other means or fabricates facts to slander others, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention, public surveillance or deprivation of political rights.
The crimes mentioned in the preceding paragraph shall be dealt with only if they are told, except those that seriously endanger social order and national interests. If the victim informs the people's court of the acts specified in the first paragraph through the information network, but it is really difficult to provide evidence, the people's court may request the public security organ to provide assistance.
Article 252 Whoever conceals, destroys or illegally opens other people's letters and infringes upon citizens' right to freedom of correspondence, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than one year or criminal detention.
Article 253 Postal personnel who open, conceal or destroy mail and telegrams without permission shall be sentenced to fixed-term imprisonment of not more than two years or criminal detention. Whoever commits the crime of stealing property mentioned in the preceding paragraph shall be convicted and given a heavier punishment in accordance with the provisions of Article 264 of this Law.
Article 253-1 Whoever, in violation of the relevant provisions of the State, sells or provides personal information of citizens to others, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention and shall also, or shall only, be fined; If the circumstances are especially serious, he shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years and shall also be fined.
Whoever, in violation of the relevant provisions of the state, sells or provides others with personal information of citizens obtained in the course of performing their duties or providing services shall be given a heavier punishment in accordance with the provisions of the preceding paragraph.
Whoever steals or illegally obtains citizens' personal information by other means shall be punished in accordance with the provisions of the first paragraph. Where a unit commits the crimes mentioned in the preceding three paragraphs, it shall be fined, and the persons who are directly in charge and other persons who are directly responsible shall be punished in accordance with the provisions of the preceding three paragraphs.
(3) According to the General Principles of Civil Law of People's Republic of China (PRC):
Article 100 Citizens shall enjoy the right to portrait, and shall not use their portraits for profit without their consent.
Article 101 Citizens and legal persons enjoy the right of reputation, and their personal dignity is protected by law. It is forbidden to damage the reputation of citizens and legal persons by insulting or slandering.
(4) According to the Tort Liability Law of People's Republic of China (PRC):
Article 2 The civil rights and interests mentioned in this Law include personal and property rights and interests such as the right to life, health, name, reputation, honor, portrait, privacy, marital autonomy, guardianship, ownership, usufructuary right, security right, copyright, patent right, trademark exclusive right, discovery right, stock right and inheritance right.
(5) According to the Interpretation on Several Issues Concerning the Application of Laws in Handling Criminal Cases of Infringement on Citizens' Personal Information:
In the Interpretation of Several Issues Concerning the Application of Laws in Handling Criminal Cases of Infringement of Citizens' Personal Information, which was officially implemented in June 1 2007, the Supreme People's Court and the Supreme People's Procuratorate defined the specific standards and types of crimes of infringing citizens' privacy, placed the security of citizens' personal information at the highest level of legal protection, and set the bottom line for infringing citizens' data rights in criminal law. However, the judicial interpretations of the two courts focus on cracking down on "stealing openly" and "robbing openly" that infringe on citizens' personal information, and have little influence on "stealing secretly" and "robbing secretly" that abuse standard clauses and infringe on citizens' privacy rights.
This is because, as a civil right, users also have the right to punish themselves. Once the website moves out of the "privacy clause" that has been authorized by the user as a defense, it is difficult for criminal law to identify it as a criminal act.
(6) According to the provisions of the Cyber Security Law:
It must be emphasized that personal information and big data are different in nature, and the applicable laws are different. According to Article 76 of China's Cyber Security Law, personal information refers to all kinds of information recorded by electronic or other means that can identify the identity of a specific natural person or reflect the activities of a specific natural person alone or in combination with other information.
The nature of personal information belongs to the category of citizens' privacy, and illegal collection, use or transaction will bear legal responsibilities including criminal, civil and administrative responsibilities. Big data information is data information that cannot directly or indirectly identify the specific identity of natural persons, and belongs to the category of intellectual property in legal nature.
From a practical point of view, the right to data in the Internet era is more prominent than the right to privacy, highlighting the "control" of users over their own data. In addition to ethical rights such as users' right to know, China's cyber security law also specifically clarifies users' "independent decision-making power" over their own data. Article 43 of the Law stipulates that if an individual discovers that a network operator has collected or used his personal information in violation of laws, administrative regulations or the agreement of both parties, he has the right to ask the network operator to delete his personal information; If it is found that the personal information collected and stored by the network operator is wrong, it has the right to ask the network operator to correct it. Network operators should take measures to delete or correct them.
Article 44 of the Network Security Law: No individual or organization may steal or obtain personal information by other illegal means, or illegally sell or provide personal information to others.
(7) According to the information security technology personal information security specification:
Personal information is defined as "all kinds of information recorded by electronic or other means, which can identify the identity of a specific natural person or reflect the activities of a specific natural person alone or in combination with other information." Note 1: Personal information includes name, date of birth, ID number, personal biometric information, address and contact information ",especially emphasizing that personal biometric information belongs to personal information.
Biometric information is not only personal information, but also personal sensitive information. Once personal sensitive information is leaked, illegally provided or abused, it may endanger personal and property safety and easily lead to personal reputation, physical and mental health damage or discriminatory treatment.
According to the personal information security standard of information security technology, personal information refers to all kinds of information recorded by electronic or other means that can identify the identity of a specific natural person or reflect the activities of a specific natural person alone or in combination with other information, such as name, date of birth, ID number, personal biometric information, address, communication contact person, communication record and content, account password, property information, credit information, whereabouts track, accommodation information, health physiological information, transaction information, etc. To judge whether a piece of information belongs to personal information, we should consider the following two paths: first, identification, that is, from information to individuals, to identify specific natural persons through the particularity of information itself, and personal information should help identify specific individuals. The second is relevance, that is, from individuals to information, such as known specific natural persons, information generated by specific natural persons in their activities (such as personal location information, personal call records, personal browsing records, etc.). ) is personal information. Information that meets one of the above two conditions should be judged as personal information. The collection of personal information requires the consent of the subject of personal information. Personal information shall not be transferred, * * enjoyed or processed without consent. See Information Security Technology Personal Information Security Specification for details.