According to People’s Daily, the Personal Data Protection Law (Draft) was recently submitted to the Standing Committee of the National Congress for deliberation. I believe it protects personal data better and offsets disadvantages of the Cyber Security Law in protecting offline citizens’ data, which could increase law violation risks to non-internet businesses, for example Focus Media that was criticized for its intention to gather images through cameras in advertising screens.
Focus Media, if using cameras in advertising screens to gather images for big data analysis, would violate the Personal Data Protection Law (Draft) providing that “image collection and identity recognition devices placed in public places should be necessary for public security”. Its gathering, processing, transmission and storage of personal data are controversial and accompanied by risks of being punished by regulatory authorities for personal data protection purposes. The worst possible outcome is a closure of that business. More details are as follows.
1.Are there cameras in Focus’s advertising screens?
I studied advertising screens of Focus Media in office buildings and elevators and found no signs of cameras in the screens. However, according to a public speech made by its chairman Jiang Nanchun, Focus used infrared face recognition technology mainly in studies of how many people watched adverts by calculating actual effective ratings based on whether passers-by looked up or down without taking photographs or recording face pictures. It can also be used to calculate ratings and make creative ideas for clients.
The listed company’s annual report 2019 of Focus Media showed that it enabled data to flow back through a passage to Alibaba’s backstage, which was important for customers’ brand digital assets to accumulate. Focus’s smart screens are everywhere in the city to analyze customers’ preferences for buildings by using big data and could be seen from all aspects in different building conditions.
I believe if no advertising screens gathered data, no data would flow back, let alone data analysis. Considering features of advertising screens, the most possible explanation was that they were images gathered by cameras. Therefore, I can say Focus might have put cameras in some of its advertising screens to gather images although it had not admitted doing so. Infrared images are other type of images except photos or face pictures. Recording acts of looking down or up at advertising screens means using cameras to gather persons’ images in public places.
2.Issues connected with use of advertising screens to gather personal data within the current legal framework
If Focus used cameras in advertising screens to gather persons’ images, even if as Jiang Nanchun said, they only gathered images of looking up and down, not recognizing persons’ faces, legal issues below would at least arise.
I.Using cameras to gather large-scale images for non-public purposes in public places threatens public security. Google street view cars with WIFI wires gathered WIFI data along roads years ago, which was stopped and fined by the French government after being uncovered. Although Focus gathered specific data, it was not allowed to gather data freely in public places.
II.Gathering a person’s data requires an explicit consent of the person, which means a written statement or active affirmative action to authorize other persons to process their personal data in a particular way. If Focus is gathering images, it has not obtained approval from or informed the person whose images are being gathered.
III.Persons whose personal data are gathered should be clearly informed ofwhich data will be gathered, what they will be used for and where and how long they will be stored and other matters under data gathering rules applicable. There is no notice on or near the advertising screens that informs the public that Focus gathers images.
IV.To gather images, Focus should fulfill its obligations connected with gathering and use of personal data under relevant regulations. People cannot know or monitor whether Focus only gathers data needed to calculate ratings and will not gather or store any sensitive or identity information of individual users, as its boss said. In addition, whether Focus has transferred data Alibaba is also a compliance issue.
It is unclear whether Focus could legally gather images. Current data related laws such as the Cyber Security Law, Decision of the Standing Committee of the National Congress to Give Stronger Protection of Online Information and MIIT Regulations on Protecting Personal Information of Telecommunication and Internet Users are mainly aimed at network service providers or internet businesses. The main business activities of Focus is broadcasting adverts on its advertising screens, so it is actually an offline advertising agency. There is no law by which the aforesaid data related laws and rules apply to Focus.
3.Challenges to activities of putting cameras in advertising screens afterthe Personal Data Protection Law is brought into action
Based on clauses in the Personal Information Protection Law (Draft), its application scope covers all activities intended to provide products or services to natural persons at home. Therefore, advertising activities of Focus should be governed by this law. Other parts of this draft will be a big challenge of the business of cameras in advertising screens.
The Personal Information Protection Law (Draft) provides image gathering and personal identity recognition devices in public places must be necessary to maintain public safety, comply with relevant national regulations and have noticeable signs on them. Personal images and data showing characteristics of a person’s identity gathered can only be used for public safety purposes and cannot be made available to the public or provided to others. If this provision is eventually approved, all the business of cameras in advertising screens will be against law.
If Focus collected images through advertising screens which were all placed in public areas for commercial interests, regulatory authorities might decide that image gathering devices with cameras are not necessary to maintain public safety, whether they could recognize faces in public places or not. Another problem is that images grabbed by these cameras were transferred to third parties for data analysis and violated the draft, by which they could only be used for public safety purposes.
Somehow, I think, even if this provision is approved, Focus or other companies that want to gather images by putting cameras in advertising screens could discuss with regulatory authorities to keep these cameras by changing them into a device whose hardware only allows them to recognize actions, not able to take pictures of facial details. Another provision thereof is that personal data are related to recognized or recognizable natural persons and recorded in electronic or other form, not including anonymized information. Devices directly taking anonymized information don’t gather images, do they?
Actually, this is, I think, the only way to do this business without violating any other clauses of the Personal Information Protection Law (Draft). Otherwise, it is even impossible to get explicit consent of persons whose data will be gathered. Advertising screens work in a way that does not enable users to express agreement. If advertisers require users agree, who would like to have others take their photos for data analysis with no good reasons?
My colleagues disagreed with my arguments in. They believed if cameras in advertising screens which only grabbed acts of nearby people looking up or down and how long they kept their heads up, data gathered were anonymous and should not be deemed as personal data, so what Focus did was safe. However, I think of it more as a political issue than as a legal one. If Focus did this business on a large scale, it would have nearly 2.5 million screens by the end of 2019. Supposing that 40% screens had cameras, Focus placed more than one million cameras in public areas as a private business. Is this worrying for the government?