The city’s Putuo District is urging private businesses to stop collecting unnecessary consumer data.

With more public awareness of data security, China’s legal authorities are urging private business owners to remove facial recognition cameras in private facilities to avoid the unauthorized and excessive collection of consumers’ personal data.

The procuratorate of Shanghai’s Putuo District has issued a recommendation for relevant law enforcement departments to rein in private business operators from “illegally” collecting and storing customers’ private data, local media reported Tuesday. Private businesses such as supermarkets and shopping malls have been urged to remove cameras with face recognition features, while security camera manufacturers have been ordered to strengthen their product review processes, while informing their clients of relevant regulations.

A government inspection in a Putuo District supermarket showed that facial recognition cameras installed in its entrance scanned customers’ facial features, along with their age, gender, mood, and shopping history, within seconds. A representative from the supermarket told local media that they installed the cameras to spot shoplifters and other criminals, although such data is also commonly used by business owners to generate customized marketing plans to drive revenue.

“The supermarket’s camera system stored more than 200,000 mugshots of customers with more than 3,000 of them collected daily,” He Jiahui, the assistant prosecutor at Putuo District Procuratorate, told local media, adding that more images may have been erased due to the limited storage space. “The supermarket is collecting personal information for their own benefit rather than for public welfare.”

As security cameras become ubiquitous in Chinese cities, both in public and private spaces, accompanying discussions on personal data security issues have made frequent media headlines over the past few years.

In a high-profile case in 2020, a law professor sued Hangzhou Safari Park for requiring him to provide his biometric data for entering the facility. Similarly, state broadcaster China Central Television called out companies including American home manufacturing company Kohler for using facial recognition cameras to collect biometric information from their customers without their consent.

Amid complaints of mismanagement and misuse of private data, China rolled out its Personal Information Protection Law in 2021. The law stipulates that the handling of personal information must have a clear and reasonable purpose, and consumers should give informed consent before their information is collected.

Under the law, the city of Wuxi in the eastern Jiangsu province deleted more than 1 billion pieces of personal information this month that were collected when COVID-19 protocols were in place.