China cracks down on facial recognition payments

Businesses in China dealing with facial recognition payments will have to comply with a new set of security standards released by the country’s cybersecurity standards agency.

The new guidelines cover not only payment service providers and facial verification companies but also venue managers and equipment operators, showing the country’s desire to crack down on the explosion of biometric-based systems among commercial venues and services.

China has been seeing more biometric-based technology at hotels, supermarkets, fitness centers and even safari parks, prompting public concerns and a legislative pushback from the state. The new rules focus on facial recognition used by banking and payment apps as well as devices deployed by commercial entities such as ATMs and vending machines.

The guidelines were issued on January 28th by the National Technical Committee 260 on Cybersecurity of Standardization Administration of China (SAC/TC260).

The rules outline security requirements for handling data obtained through facial recognition payment use cases. Equipment operators and venue managers, for instance, are prohibited from processing facial recognition data generated through payments. Payment service providers and equipment operators are also banned from storing facial recognition data, except in cases required by law.

The guidelines also introduce stricter rules for obtaining consent and transferring data to third parties. Face verification services should collect minimal data and not use facial recognition data for any purpose other than identity verification. Both facial recognition payment providers and facial verification service providers must conduct Personal Information Protection Impact Assessments (PIPIA), according to an analysis by Mlex.

China’s crackdown on biometric data collection comes amid increasing news of data leaks and privacy issues.

Last year, regulators ordered the Shanghai metro to suspend facial recognition payments offered by more than 800 of its vending machines after concerns over personal data violations. City authorities in Shanghai have also conducted a cleanup of commercial venues using facial recognition systems, including 600 supermarkets, 6,300 hotels, 1,200 swimming facilities and fitness centers as well as 2,900 public restrooms.

Article Topics

biometric payments  |  biometrics  |  China  |  data protection  |  facial recognition  |  regulation