China drafts rules for using facial recognition technology. Does India need its own?

China’s cyberspace regulator said on Tuesday it has issued draft rules to oversee the security management of facial recognition technology in the country, following concerns raised in public about the overuse of the technology. The Cyberspace Administration of China (CAC) said facial recognition technology can only be used to process facial information when there is a specific purpose and sufficient necessity and with strict protective measures.

The use of the technology will also require an individual’s consent, the CAC said in a statement. It added that non-biometric identification solutions should be favoured over facial recognition in cases where such methods are equally effective. Biometric identification, especially facial recognition, has become widespread in China. In 2020, local media reported that facial recognition was used to activate toilet roll dispensers in public toilets, which triggered both public and regulatory concerns at the time.

Many Chinese courts and local governments have since ruled against and fined companies for facial recognition overuse, according to the South China Morning Post. CAC’s draft rules on Tuesday said image-capturing and personal identification devices should not be installed in hotel rooms, public bathrooms, changing rooms, toilets, and other places that may infringe upon others’ privacy.

The regulator added that image-capturing devices should be installed in public places for only public safety purposes and with prominent warning signs next to them. The draft rules come amid Beijing’s effort to tighten data regulation by issuing an array of rules and laws. Most notably, China introduced its first law focusing on user privacy, the Personal Information Protection Law, in 2021 in a bid to rein in companies’ overuse of user data.

Does India need its own laws on facial scanning?

Although several government institutions, as well as private organisations, use facial scanning technologies, there are no laws in place that legalise the deployment of such technologies in India. In the absence of a framework to guide the implementation of facial scanning technologies, the scope is not defined, which often leads to misuse of the technology. There is no legislation that mandates the safeguarding of the facial data collected by both government and private firms, often without consent.

As China accelerates the demand for legislation that makes seeking approval from the authority before implementing a facial scanning technology, it makes it more urgent for India to come up with its own laws for facial scanning. Since experts believe facial scanning technology falls under the technologies related to collecting sensitive personal data, there should be clauses concerning the technology, as well as the storage of personal data of users without their knowledge or consent.

— Written with inputs from Reuters