A Fundamental Re-evaluation of Mandatory Facial Recognition for Mobile Service Registrations is Required
- Biometric data is uniquely sensitive: strict protections are vital due to the irreversible nature of data breaches -
- Clear legal grounds and alternative verification methods must be established to ensure the right to choice -
□ On March 11, 2026, the National Human Rights Commission of Korea (Chairperson Ahn Chang-ho; hereinafter "NHRCK") issued a recommendation to the Minister of Science and ICT, calling for a cautious re-evaluation of the policy mandating facial recognition for mobile phone registration. To protect the public’s right to informational self-determination, the Commission urged the following improvements:
- Establish a Statutory Basis: In the event that mandatory facial recognition is introduced, clear legal provisions governing the collection, use, retention, and disposal of biometric data, including facial images captured during registration, must be incorporated into the Telecommunications Business Act and other relevant statutes.
- Provide Meaningful Alternatives: To guarantee the right to choose, the government must offer alternative identity verification methods for persons with disabilities, older persons, and other digitally marginalized groups who may be unable or unwilling to provide biometric data.
- Ensure Transparency and Public Trust: The government must provide comprehensive information on the lifecycle of biometric data prior to implementation. Following its introduction, the safety of facial recognition technology must be disclosed transparently, supported by regular and public security audits covering every stage of data management.
□ Background
In response to the rising threat of telecommunications fraud, such as voice phishing involving illicitly registered mobile phones (commonly known as "daepo-phones" in Korea), the Ministry of Science and ICT is pursuing a plan to mandate facial recognition for mobile service registrations across all major carriers and MVNOs. A pilot program was launched on December 23, 2025, with full-scale implementation scheduled for March 23, 2026.
□ The Irreversible Risks of Biometric Data
Facial recognition operates by comparing a government-issued ID photo with a real-time facial scan. While this may deter identity theft or the use of forged documents, the NHRCK emphasized that biometric data is exceptionally sensitive. Unlike passwords, these unique physical identifiers are effectively immutable; once compromised, the harm is irreversible, necessitating the highest standards of protection.
○ The Commission further noted that mobile phones have become essential infrastructure for modern life, serving as the primary gateway for everything from financial transactions and public services to mobile identity verification and platform-based work. Consequently, making facial recognition a mandatory prerequisite for access risks infringing not only on the right to informational self-determination but also on fundamental rights such as the freedom of communication, expression, and the right to information.
□ Absence of Legal Authorization
The Commission highlighted a significant legal vacuum: while the Immigration Act and the Electronic Financial Transactions Act explicitly authorize the collection and use of biometric information, the current Telecommunications Business Act lacks any such provision. Existing laws only recognize the "presentation of certificates or documents," such as a resident registration card, as a valid method of identity verification and do not provide for the use of biometric data.
□ Policy Limitations and Social Exclusion
The NHRCK also pointed out that facial recognition is not a panacea for fraud. It remains ineffective against cases where the nominal owner is physically present during registration, such as "internal credit loans" (where individuals participate in exchange for high-interest loans) or registrations under corporate names. Despite these limitations, the policy would mechanically demand sensitive data from the vast majority of law-abiding citizens.
○ Furthermore, mandating facial recognition without providing adequate alternatives places a disproportionate burden on persons with disabilities, older persons, and those with limited digital access. The Commission also emphasized that the inherent risk of authentication failures in facial recognition technology warrants serious consideration.
□ Building Public Trust
Because biometric data is derived from unique physical characteristics, it requires a far more stringent level of protection than ordinary personal information. The potential risk of mass data collection places a significant burden on the individuals concerned.
○ Accordingly, the NHRCK underscored that the government must build public trust by being transparent about how biometric data is handled, disclosing the safety of the technology used, and publishing the results of regular security audits.
□ Implementation Put on Hold Following NHRCK Recommendation
Following the NHRCK’s formal recommendation, the Ministry of Science and ICT has effectively suspended the immediate rollout of the mandatory facial recognition policy to undergo a comprehensive re-evaluation. The Ministry is currently gathering final feedback from telecommunications carriers and distributors to determine whether the nationwide implementation, originally scheduled for March 23, will be officially postponed. While the government maintains that its review is a separate matter from the NHRCK's stance, it has committed to formally responding to the Commission’s human rights concerns within the 90-day statutory period.
□ Outlook
The NHRCK remains committed to monitoring policy developments in the rapidly evolving digital landscape, including the use of artificial intelligence, to ensure that the human rights of all individuals in Korea are robustly protected.
