CHINA Trends and Developments Contributed by: Vincent Wang, Xinyao Zhao and Alfred Feng, Global Law Office
tion Technology (the “Measures on Facial Recognition Technology”) were jointly released by the CAC and the Ministry of Public Security (MPS) on 13 March 2025 and came into effect on 1 June 2025. Highlights of the Measures on Facial Recognition Technology are as follows. • All data processors should use facial recognition technology only for a specific purpose and of suf - ficient necessity. If there are recognition methods other than facial recognition to achieve the same purpose or meet the same business requirements, facial recognition technology shall not be provided as the only recognition method. • Prior to the application of facial recognition tech - nology, data processors shall inform the data subjects of certain information, including the name and the contact information of the data processor, purpose and method of facial information process - ing and the period for storage of the facial informa - tion, etc. • If the processing of facial information is based on consents of data subjects, the data processors should obtain voluntary, explicit and separate con - sents from the data subjects. • Unless otherwise stipulated by laws and adminis - trative regulations or with an individual’s separate consent, data processors should store facial infor - mation locally with the facial recognition equip - ment and should not transmit the facial information through the internet. • A data processor should make a filing to the authorities about its facial recognition activities if the amount of facial information processed by it reaches 100,000 people. After release of the Measures on Facial Recognition Technology, on 28 May 2025, the CAC released an Announcement about Filing of the Application of Facial Recognition Technology. Data processors meeting the filing threshold should make their filings on an officially designated website. In practice, some data processors may use facial rec - ognition technology for HR operation without a neces - sity check. For example, some companies adopt facial recognition technology for the purpose of checking on
employee attendance without any alternative. Such adoption bears compliance risk under the Measures on Facial Recognition Technology and should be reconsidered. For data processors using applications that store the facial information of more than 100,000 people, it is suggested that their compliance depart - ment start preparing for filing materials together with other internal departments such as IT and the relevant business units. Cross-border data transfers Certification of cross-border provision of personal information The Measures on Certification of Cross-Border Provi - sion of Personal Information (the “Measures on the Certification”) was released by the CAC on 14 Octo - ber 2025 and came into effect on 1 January 2026. It provides rules about certification, the most recently clarified mechanism for cross-border data transfer under Chinese law. Article 38 of the PIPL designed three mechanisms for cross-border data transfer, including: • security assessment; • standard contract filing; and • certification of cross-border provision of personal information. The rules on the first two mechanisms were released years ago; the rules on the certification of cross-bor - der provision of personal information have long been absent in practice. It seems that adding this mecha - nism does not cause any difference in practice. Highlights of the Measures on the Certification include the following. • The measures clarify the procedures required to qualify as a professional certification institution. Names of those qualified institutions will be pub - lished through official channels. • Data processors that transfer personal information overseas shall complete the personal information protection impact assessment (PIPIA) covering contents required by the Measures on the Certifi - cation.
66 CHAMBERS.COM
Powered by FlippingBook