China's new facial recognition regulations: compliance challenges for workplace surveillance

These rules, developed jointly by the Cyberspace Administration of China and the Ministry of Public Security, represent one of the world's most rigorous frameworks for biometric data management. The updated policies aim to strike a delicate balance between enabling technological innovation and protecting individual privacy rights, while maintaining the government's ability to utilize facial recognition for public security purposes.

The regulations introduce several fundamental changes to how organizations can collect and use facial recognition data. Companies must now obtain explicit, written consent from affected individuals before gathering their biometric information, with clear dis-closures about how the data will be used, how long it will be stored, and who may access it. The rules specifically prohibit deceptive consent practices that have been common in some digital platforms, such as pre-checked boxes or buried consent language in lengthy terms of service agreements.

Certain applications of facial recognition technology will face outright bans under the new framework. Commercial systems designed to detect or analyze emotions, as well as those that attempt to classify individuals based on sensitive characteristics like race, religion, or health status, will no longer be permitted.

Data security requirements have been significantly enhanced. Organizations processing facial recognition data must store the raw information on servers located within China and implement specific encryption standards approved by regulators. Detailed access logs must be maintained, and any security breaches involving biometric data must be reported to authorities within 24 hours of discovery. Violations of the new regulations could result in substantial penalties, including fines of up to RMB 50 million or 5 percent of a company's annual revenue, whichever is higher.

The workplace emerges as a particularly challenging environment for compliance with the new regulations. Many businesses in China, from manufacturing plants to corporate offices, have come to rely on facial recognition systems for employee timekeeping, facility access control, and even productivity monitoring. Under the updated regulations, employers must provide alternative verification methods for staff who decline to use facial recognition systems. They also face new obligations to clearly explain how employee biometric data will be used and to establish procedures for handling deletion requests.

For example, a factory using facial recognition for worker attendance must now ensure all data is stored domestically, and retrain human resources staff on proper consent procedures. These changes come with significant costs and operational challenges, particularly for smaller businesses that had invested heavily in facial recognition-based systems.

The broader business implications extend across multiple sectors. Technology companies developing facial recognition algorithms must carefully review their training datasets to ensure compliance with the new consent requirements. Retailers can no longer use the technology for customer behavior analysis without explicit opt-in permission. International corporations operating in China face particularly complex challenges in adapting their global systems to meet the localization requirements while maintaining compatibility with their worldwide operations.

Affected companies should conduct audits of their facial recognition systems, update consent mechanisms and privacy notices, and establish clear protocols for handling data subject requests. The regulations mark a turning point in China's approach to biometric data, signaling that convenience and efficiency can no longer override privacy considerations. While facial recognition technology will continue to play an important role in Chinese society, its use will be subject to much greater scrutiny and regulation in the years ahead.