购物时“刷脸”支付，用手机时“刷脸”解锁，上下班靠“刷脸”打卡考勤，就连进小区也要“刷脸”才能开门……曾几何时还只是出现在电影里让人叹为观止的人脸识别技术，如今已经“飞入寻常百姓家”，应用在了生活的方方面面。
诚然，在科技发展日新月异的今天，“刷脸”给人们的生活带来了不少便利。但与此同时，人脸数据等个人隐私信息也存在被过度分析和滥用的风险。就拿小区门禁系统来说，今年一些小区强制居民“刷脸”进出，个人姓名、性别与面部特征等大量信息都被采集并储存。若这些信息不慎被泄露，用户隐私就有可能处于“裸奔”状态。近日，《杭州市物业管理条例（修订草案）》提请浙江杭州市十三届人大常委会第三十次会议审议。该修订草案提出：禁止强制业主通过指纹、人脸识别等生物信息方式进入小区。如获通过，该管理条例将成为我国首部明确规定人脸识别禁止性条款的地方性法规。Hangzhou, a tech hub in eastern China that is home to e-commerce giant Alibaba Group Holding Ltd, has published a draft plan to ban facial recognition technology in residential areas. The draft law has now been submitted to the local legislation department and public opinion solicitation has begun. The revised draft of municipal property management regulations stipulated that property management companies are not allowed to demand residents submit to facial and other biometric scans when entering residential compounds.If the draft is passed, it will be the first local law in China to ban the use of facial recognition technology in residential areas.
提出这条建议的是浙江理工大学副教授郭兵，他研究个人信息保护的法律问题多年。郭兵还有另一个身份——“国内人脸识别第一案”主诉人。去年，他因杭州野生动物世界年卡由指纹识别“强制”升级为“刷脸”入园，将杭州野生动物世界告上法庭。无独有偶，清华大学法学教授劳东燕也曾有“不刷脸不能进小区”的经历。在上个月举行的一场座谈会上，劳东燕指出，在小区安装人脸识别装置并无必要，人脸识别技术给社会带来的巨大风险，远远大于其带来的各种便利。另一方面，不经同意收集人脸数据，也违反现行的法律规定。 The draft comes after Guo Bing, an associate professor at Zhejiang Sci-Tech University, filed a lawsuit last year against a wildlife park in Hangzhou for requiring the collection of facial data without asking for permission from customers.Guo, is the first person in China to sue a zoo due to facial recognition technology and as an expert in the personal information protection field, he later called for local legislation to ban the use of the technology to better protect people's information security.Lao Dongyan, a law professor at Tsinghua University who was required to scan her face when she entered her community, argued at a seminar last month that it's unnecessary to install facial recognition devices in residential compounds. She said compared to the convenience the technology brought, the risk to personal information was greater. She added that collecting personal data without consent is against existing laws.The upcoming deliberations are a sign that public opinion is starting to inform government policy.在新冠疫情期间，为了遏制疫情蔓延，社区、公园、动物园和商场等公共场所都采用了人脸识别技术来检测体温，极大提高了门卫的工作效率。法律专家认为，相比公安或国家安全部门，私营单位的数据使用情况较为模糊。一些企业利用这项技术来减少工作量，还有些企业则利用人脸识别获取用户的性别、年龄和情绪等信息，有针对性地推送广告以此获利。北京市京师律师事务所的熊超律师表示，目前我国对个人信息采集的主体没有明确的法律依据，存在极大的个人信息泄露风险和隐私安全问题。“正因为能够采集个人信息的主体尚不明确，所以现在一些商家、小区物业等为了便利化、提升管理效率，都在采集个人信息。”熊超说，“虽然没有明说是‘强制’，但如果不按照要求接受采集，就无法完成支付、无法进门等，这是一种变相的强制。”Guo and Lao's angst is not rare in China as many have voiced concerns about the potentially intrusive public use of facial recognition technologies.During the COVID-19 epidemic, in order to contain the coronavirus, public places like residential communities, parks, zoos and shopping malls across China adopted facial recognition technology to detect body temperatures, track people who are not wanted and reduce the tedious work of door guards.Law experts said that compared to data usage by the public security or national security departments, the situation in the private sector is murky. Some of these businesses use the technology to reduce their workloads, while others use it to earn money by serving up ads based on an estimate of one's gender, age and mood.Behind the ubiquitous use of the technology, capital is also a propelling factor as many producers are trying to expand their business share in the market before a national law increases regulation.Xinhua reported that one neighborhood which installed the facial recognition system to contain the coronavirus didn't even know where residents' personal data was stored and whether it's safe. "Currently, there is no clear stipulation on who can collect personal information like facial data, so in reality, in order to improve the efficiency of work, some stores and property management companies are collecting people's facial data without getting consumer's consent. Of course, they didn't say this is compulsory, but if you don't accept that, you can't enter the door or you can't pay your bill, which is a disguised form of compulsion," Xiong Chao, a lawyer at Jingsh Law Firm, said.尽管我国目前还没有专门针对人脸识别技术相关的法律法规，但2017年实施的《中华人民共和国网络安全法》规定，网络运营者收集、使用个人信息，应当遵循合法、正当、必要的原则，公开收集、使用规则，明示收集、使用信息的目的、方式和范围，并经被收集者同意。此外，今年10月中旬，个人信息保护法（草案）公布并公开征求社会公众意见。草案规定，基于个人同意处理敏感个人信息的，个人信息处理者应当取得个人的单独同意。
草案中明确：敏感个人信息是一旦泄露或者非法使用，可能导致个人受到歧视或者人身、财产安全受到严重危害的个人信息，包括种族、民族、宗教信仰、个人生物特征、医疗健康、金融账户、个人行踪等信息。Though China does not have regulations specifically on facial recognition, the China CyberSecurity Law, which came into effect in 2017, stipulated that personal information can only be collected when individuals are informed and agree to the aims and scope of the collection.And in the middle of October, China published a draft law on personal information protection, which clearly requires the information processor to obtain separate consent when it comes to processing personal information as "such information may pertain to race, ethnicity, religious belief, biological traits, medical records, financial accounts and personal whereabouts," and may lead to abuse of facial data, resulting in personal privacy violations.中国电子信息产业发展研究院网络安全研究所副所长闫晓丽表示，目前，我国确立了数据安全的基本制度，包括数据分类分级、重要数据出境安全评估、个人信息安全保护等。相关部门落实法律要求，通过个人信息专项治理、数据安全合规性评估等工作，促进了企业和机构数据安全管理能力的提升，以及社会各界数据安全意识的提高。但她同时也指出，整体来看，我国数据安全保护还处于较低水平。针对数据流通各环节的安全风险，相关企业的数据安全保障能力有待提高。Yan Xiaoli, deputy director of the Institute of Cyber Security in China Electronic Information Industry Development Research Institute, said that so far China has established a basic system of data security, including data classification, personal data protection and data assessment when it's transferred to foreign countries, which to some extent, have improved the data management capacity of businesses and organizations, as well as the awareness of the whole society."However, China's data security protection is still not good enough," Yan said, adding data security is not only about personal privacy, but also vital for national security. Some important industries pertaining to the national economy and people's livelihoods have not yet established a complete data security management system, and their data management capacity is still weak.
从全球范围来看，尽管没有相关法律和政策允准私企或公共设施使用人脸技术，但这项技术仍被广泛应用。许多国家开始呼吁全面禁止人脸识别系统在公共场所的应用，但由于这是一项新技术且法律还存在漏洞，如何平衡使用新技术与隐私保护，对各国来说仍然是一个难题。Globally, facial recognition technology has spread prodigiously though there is no law that gives private sector companies or some public facilities the power to use facial recognition and no government policy on its use.In many countries, parties, public organizations and critics have begun calling for a complete ban on live facial recognition systems in public spaces, arguing that it destroys privacy, but since the technology is novel and there are loopholes in laws, how to find a balance in embracing new technology and protecting privacy is still a legal and ethical conundrum for governments around the world.