Policy designs for adaptive governance of disruptive technologies: the case of facial recognition technology (FRT) in China

Figures & data

Table 1. Number of patents about FRT.

Year	Utility models	Inventions
2011	54	26
2012	74	56
2013	148	49
2014	84	32
2015	235	56
2016	345	155
2017	416	199
2018	884	254
2019	1178	379
2020	2279	568
2021	3228	861

Table 2. Regulatory responses to FRT in China.

Title	Type	Issuing authority	Time	Remark
Cybersecurity Law of China	National Law	Standing Committee of the National People’s Congress	Enacted in November 2016. Implemented on 1 June 2017.	The concept of personal information was first legally defined.
General Rules of the Civil Law of the People’s Republic of China	National Law	National People’s Congress	Adopted and implemented in 2017. Replaced by the Civil Code on 1 January 2021.	Shall not illegally collect, use, process or transmit personal information of others, or illegally trade, provide or disclose personal information of others.
E-Commerce Law	National Law	Standing Committee of the National People’s Congress	Enacted on 31 August 2018. Implemented on 1 January 2019.	It regulates the information protection obligations of operators in e-commerce activities, the related positive rights of users and the rights of operators to the use and flow of e-commerce data.
Guideline of Internet Personal Information Security Protection	Guideline	Ministry of Public Security, Beijing Network Industry Association & the Third Research Institute of the Ministry of Public Security	Posted on 19 April 2019	This guide serves as a reference for Internet service units in their personal information protection work.
Information Security Technology — Personal Information Security Specification	National recommended standard	NISSTC (National Information Security Standardization Technical Committee) together with research institutes and enterprises	Released in March 2020. Implemented on 1 October 2020.	Give special protection to personal biometric information for the first time and does not have legal compulsory power.
Civil Code	National Law	National People’s Congress	Enacted on 28 May 2020. Implemented on 1 January 2021.	It explicitly listed biometric information as a kind of personal information in law for the first time.
Data Security Law	National Law	Standing Committee of the National People’s Congress	Enacted on 11 June 2021 and came into force on 1 September 2021.	The principles for conducting data activities must be conducive to economic and social development, promote people’s well-being, and comply with social ethics.
Information security technology — Security requirements of face recognition data	National recommended standard	NISSTC together with research institutes and enterprises	Issued in April 2021	This standard specifies the basic security requirements, security processing requirements, and security management requirements for face recognition data.
Personal Information Protection Law (PIPL) of China	National Law	Standing Committee of the National People’s Congress	Enacted on 20 August 2021 and came into force on 1 November 2021.	The PIPL specifically identifies biometric information as the primary type of 'sensitive personal information’.

Table 3. Business registration and patent applications related to face recognition in China.

Source: Qichacha, Intelligence Research Group