Identification at the entrance: Collection of data by building management

Internet forums are flooded by questions related to the Chinese practice of personal data protection. One interesting topic is whether building management is allowed to collect personal information such as name, date of birth, ID number, home address etc. at the entrance of the building, whether the building is  a company or residential. We have thus investigated this issue from the legal point of view.

Whether the building manager is legally authorized to collect personal information?

Art. 5 of the PRC General Rules of the Civil Law (Chinese, 中华人民共和国民法总则) of 2017 prescribes for the basic principle of voluntariness during the daily activity of individuals and legal entities in China. Therefore, as a general rule, building management as legal entities have the right to ask visitors for information and the visitors as individuals have the right to decide whether or not to provide this information.

However, according to the Information Technology – Personal Information Security Specification (Chinese, “信息安全技术 个人信息安全规范”) GB/T 35273-2017, the collection of personal information must be conducted in an appropriate way. Specifically, building management shall at least fulfill the following obligations:

• Expressly notify the person about the scope and use rules of personal information to be collected and obtain the authorization and consent from the person before collecting such personal information. For basic personal information, such as names, oral consent would be acceptable in most cases. However, when it comes to sensitive personal information, such as ID number, address, and bank account information, explicit consent is required before collecting such information. Examples of explicit consent include signing a consent agreement or voluntarily clicking “yes” on electronic platforms. Exceptions apply in several cases when building managers have the right to gather the personal information in the absence of the visitor’s authorization and consent. For example, where the collection and use are in direct relation to the public security, public sanitation, or the information is that of a major public benefit.

• Establish an internal Private Policy which prescribes the procedures of gathering and the storage of personal information, and notify the person about their Private Policy as the explanation of the purpose for collecting such information as well as the confidentiality policy thereon.
• Gather limited information directly related to the purpose of gathering such information & keep highly confidential and only, use in means consistent with the purpose of the the initial information collection. For example, if the public building management claims that the information is collected for public safety purposes, they must keep such information highly confidential, without disclosing to any person unless certain safety accidents occurs and the police needs the information for security investigation purposes. Otherwise the building management shall be legally responsible for any information leakage.

 

Whether building management is allowed to refuse a visitor entrance to a building?

Building management typically refers to a legal entity which manages the property on behalf of a property owner. Art. 2 of the PRC Real Rights Law (Chinese, 中华人民共和国物权法) prescribes that such property owner enjoys the exclusive right of the direct control over a specific property. The control could have different forms including the restriction of the access of non-identified visitors of the building.

Therefore, the building managers would be entitled to refuse a visitor from entering the building only where the proper authorization from the owner exists.

Whether the visitor is legally protected when refusing to provide personal information?

If the building manager refuses to provide necessary documents and/or the information as stated above, which would be an infringement the right to know, the visitor may refuse to provide personal information and call the police for assistance if necessary.

In practice, public building managers typically use the public safety purpose as a reason to obtain personal information, including the name of visitors and companies to be visited. Where the building management claims the purpose of public safety, visitors can ask how the information would be used to fulfill this purpose. In case no explanation or an insufficient explanation is provided, visitors may also challenge the building management against their requests for the personal information to enter the building.

What about tenant’s interests?

There could be situations where the tenant rents the office in a business center which already implements identification rules or such regulations could be implemented after the conclusion of a renting agreement.

In the first situation, the company can verify with the lessor whether the building has such regulations and explicitly stipulate their main provisions in the contract. This question also can be discussed by the parties during the negotiation on the conclusion of the renting agreement. Where the lessor would like to keep such rules, the company would have to decide whether to rent the office in the building with such visitor identification requirements.

In the situation where these regulations are implemented after the conclusion of the contract, the lessor shall notify the company on such an amendment. Where such an amendment infringes the tenant’s interests (e.g., the company cannot use the office facilities for meeting with clients), the company may refer to the Art. 54 and 58 of the PRC Contract Law (Chinese, 中华人民共和国合同法) requesting the modification (reducing the rent fee) or revocation of the contract and reimbursement of all corresponding losses and expenses.

There are more chances that such a claim would be approved by the court if the leasing agreement would include the clear stipulation about the tenant’s renting purpose, such as using the facilities for meeting with the company’s clients and potential clients.

D’Andrea & Partners will continue to keep you updated on the further developments of Personal Data Protection in China. Should you have any enquiry, please don’t hesitate to contact us via info@dandreapartners.com.