Law on the way

Li said that although there is no specific law on use of the technology and on protecting personal information, some Chinese legislation does relate to privacy protection.

For example, the Cybersecurity Law stipulates that people or institutions must make "legitimacy and necessity" a priority in collecting or using personal information, and should ensure transparency. The law also states that providers must be told how their information is used and why it is needed, and this should be based on an agreement with the suppliers.

Feng said, "The onus on providing facial recognition details should rest with the person concerned, instead of he or she being forced to do so."

Zhao said it was time China set a "threshold" for applying such technology and that supervision should be stepped up before the introduction of related laws.

In March, Zhang Yesui, spokesman for the second session of the 13th National People's Congress, the country's top legislature, placed legislation relating to protecting personal information on the agenda and said government departments and agencies were working on a draft law.

Gao Zicheng, a legislator and lawyer, said the drafting is a "must" but will require a significant amount of time, because it is difficult to define what personal data is and how much private information can be disclosed.

In addition, ensuring development of the technology while guaranteeing the security of personal information is a challenge, as there is no conflict between privacy protection and the legitimate collection or use of data, he said.