Law note · China
Personal Information Protection Law, Sensitive Personal Information
Article 28 defines sensitive personal information as information whose leak or misuse would easily harm dignity or personal or property safety, expressly including biometric identification information (covering both faceprint and voiceprint as instances of the same category) alongside religious belief, specific identity, medical health, financial accounts, and location tracking, and extends automatically to a minor's information under 14.
Article 29 requires separate, explicit consent before processing any sensitive personal information, layered on top of the general lawful-basis requirement, Article 30 requires advance notice of necessity and impact, and Article 31 requires guardian consent for a minor's data. The biometric definition carries no exclusion for an identifier extracted from an existing photo, video, or audio recording.
What it asks of an app
- Obtain the individual's separate, explicit consent before processing any sensitive personal information, including a biometric identifier such as a faceprint or voiceprint, in addition to any general consent already collected.
- Notify the individual of the necessity of the processing and its impact on their rights before collecting sensitive personal information.
- Process biometric identifiers only for a specific, necessary purpose and under strict protective measures, and obtain guardian consent before processing a minor's data.
- No dedicated voiceprint statute exists as of this date; voiceprint is covered under this same sensitive-category duty rather than a separate biometric-specific rule.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: official CAC-published full Chinese statutory text