Chinese electric vehicle maker Xpeng has been ordered to pay RMB 100,000 ($15,710) in fines by China’s local market watchdog for collecting customers’ facial data without consent, Chinese media reported, as Beijing looks to tighten rules over user data privacy.
Why it matters: The latest penalty reflects the Chinese authorities’ goal of tightening data privacy rules following a series of controversies over the use of consumers’ personal data. The moves are changing the way Chinese tech companies operate.
Details: A district office under Shanghai’s market regulator (Shanghai Municipal Administration for Market Regulation) has imposed a fine of RMB 100,000 on an Xpeng subsidiary for unlawfully gathering facial data without customers’ knowledge, state-owned media The Paper reported Tuesday, citing Tianyancha, a Chinese business data inquiry platform.
- The Alibaba-backed EV maker was handed the fine for installing a total of 22 facial-recognition cameras in seven showrooms in Shanghai, according to a penalty bill (in Chinese) viewed by state-owned media outlet China News Service.
- The company reportedly used these cameras to collect more than 430,000 facial images during the first six months of this year without declaring the practice to the public, thus breaching China’s consumer protection law, the report said, citing the market watchdog.
- Xpeng said in a Tuesday statement to local media that it used the technology to gather information such as traffic flows, hoping to improve sales and better customer service. The company added that it had deleted all collected facial data and will strictly comply with regulations and protect customers’ personal information in the future.
Context: Xpeng is not the first automaker in China to violate customers’ privacy. German automaker BMW was found using facial recognition technology on customers without their knowledge, state broadcaster CCTV reported in March.
- The Chinese government in August passed the Personal Information Protection Law, which came into effect on Nov. 1. The law requires companies to gain consent before collecting personal data.