Facing Up to Data

The platform economy – and the labor conditions that allow its staffing – mean hot food, shower heads and cases of beer are available for delivery at any hour. We pay our bills, book our tickets and hire movers all on the WeChat app. We pay for our subway ride with our phone, then scan a QR code to ride a bike for the last mile to our destination. 　

But along with this convenience comes an anxiety. All that scanning and buying creates a lot of data which ends up… somewhere? 　

This issue of digital surveillance has to an extent been thrust in our face by the antiepidemic health codes. But while these codes are undeniably intrusive and inconvenient – rendering many places and services essentially off-limits to those without a well-charged phone – we all understand that they’re temporary and serve an important purpose. 　

While most people can feel OK about handing over their personal data to the authorities to keep a deadly virus in check, having to submit to a form of corporate surveillance by handing over personal information to buy a soda does feel different. 　

This is part of a longer term trend, with no clear end in sight, of technology and data gathering being introduced into activities which we were managing just fine already, often with no way to opt out and no way to find out what happens to the data. 　

For example, the aforementioned soda. I took my chosen sugar-water to the counter, but found it unmanned. Adjacent were a few self-service tills, so I scanned the product, and began to wave my payment QR code around to pay. After I began to accompany the phone-waving with a confused head-waving, a staff member appeared from behind the crisps to tell me I needed to pay with a WeChat mini program. 　

On doing so, I was informed that to win the right to pay for my drink, I’d have to hand over a checklist of data including my phone number, real name and gender. 　

Why was this data being collected? Who’d have access to it? How long would it be stored for? No mention. No way to opt out either. 　

In this particular instance, I was able to bother the staff into checking me out and letting me pay the old-fashioned way, in which only WeChat gets to collect my shopping data. But I’ve been told in several shops that using these data-hoovering mini programs is the only way to pay, including at milk tea joints and cosmetics shops. My concerns have left me thirsty and un-beautified. 　

The other way in which this data collection has become increasingly common in China is the growing prevalence of facial recognition. 　

On a recent walk, I came across metal versions of the four dumpster types that have been rolled out across the capital amid the latest push for trash-sorting, each for a different class of rubbish. To deposit your trash, you had to either use a WeChat mini program, or register your face. 　

Just as with the coke, the purpose of this technology was not explained, nor was what would be done with the data. Nor was any attempt made to justify why you should hand over this data to be able to toss your garbage. The security of your facial data is obviously a concern, especially as more services begin to demand it. This was seemingly a sentiment shared by at least some of the local residents, judging by the bags of refuse sitting at the base of the dumpsters. 　

There is some precedent that this may not be technically legal – a Hangzhou court ruled in November that a local zoological park breached a customer’s rights when it required him to submit to face scanning to retain his annual pass. But the court did uphold the park’s right to use the technology generally. 　

This is far from just a Chinese issue. But in some jurisdictions, there are unified regulations that emphasize individuals’ consent and control over their data. By contrast, there is no overarching law on personal data in China. There is a draft law that would define some principles in this area, and could go a long way to adding consent and control. But four years into its drafting, it still seems nowhere near being passed, as lawmakers struggle to balance corporate, government and individual interests over this crucial modern resource. 　

Privacy protection is now split up among a patchwork of agencies. Local media reports say that there are at least 20 central government agencies that have some related duties. 　

So for the time being, it might pay to watch where you point your face.