(New York) – Chinese authorities in Xinjiang are collecting DNA samples, fingerprints, iris scans, and blood types of all residents in the region between the age of 12 and 65, Human Rights Watch said today. This campaign significantly expands authorities’ collection of biodata beyond previous government efforts in the region, which only required all passport applicants in Xinjiang to supply biometrics.
For all “focus personnel” – those authorities consider threatening to regime stability – and their family members, their biometrics must be taken regardless of age. Authorities are gathering the biodata in different ways. DNA and blood types are being collected through a free annual physical exams program called Physicals for All. It is unclear if the participants of the physicals are informed of the authorities’ intention to collect, store, or use sensitive DNA data.
“Xinjiang authorities should rename their physical exams project ‘Privacy Violations for All,’ as informed consent and real choice does not seem to be part of these programs,” said Sophie Richardson, China director. “The mandatory databanking of a whole population’s biodata, including DNA, is a gross violation of international human rights norms, and it’s even more disturbing if it is done surreptitiously, under the guise of a free health care program.”
The biometric collection scheme is detailed in an official document called “The [Xinjiang Uyghur Autonomous] Region Working Guidelines on the Accurate Registration and Verification of Population” (全区人口精准登记核实工作指南, “The Population Registration Program”), available in full on the government website of Aksu city in Xinjiang (an unofficial translation is available below).
The guidelines are undated, but the Aksu government’s notice distributing it to lower-level offices was dated July 2, 2017. According to state media reports, the Xinjiang government authorized the Population Registration Program in February 2017, and specified that it would be carried out “in stages.” A county government in Tacheng prefecture, for example, has a timetable that states it began collecting biodata around mid-June and completed it by end of November 2017. The Xinjiang-wide Physicals for All program started around July and was completed October 2017.
The guidelines were issued by the region’s Office of Population Service and Management and Real Name Registration Work Leadership Committee (自治区人口服务管理和实名制工作领导小组办公室). It is unclear precisely which government department this office reports to, though “population management” is usually under the supervision of the police.
Authorities state that the Population Registration Program is meant for “scientific decision-making” that promotes poverty alleviation, better management, and “social stability.” Authorities have offered the annual Physicals for All program since 2016, characterizing it as a benefit for the relatively economically poor region. The program’s stated goals are to improve the service delivery of health authorities, to screen and detect for major diseases, and to establish digital health records for all residents. Press reports about Physicals for All include testimonies from participants describing how they received treatments for previously undiagnosed illnesses, and in some cases saving their lives.
According to the guidelines, different authorities are responsible for different types of biometric collection. Party cadres and police officers are responsible for collecting pictures, fingerprints and iris scans, and “household registration” (or hukou) information using mobile apps designed for such purpose either during home visits, or by setting up central collection points. Local health authorities are responsible for collecting DNA and blood type information “as part of” the Physicals for All program, according to the guidelines. The collected blood type information is directly sent to the police, while the “blood cards for DNA collection will be sent to the county police bureaus for profiling.” All of this information is stored and linked to an individual’s national identification number.
The guidelines say the biometric collection will be comprehensive: officials have “to ensure that [information from] every household in every village, every person in every household, every item for every person” will be collected. There is no indication that people can opt out of the collection, or any requirement of informed consent.
While media reports and official implementing documents about Physicals for All outline a range of medical tests involved, including ultrasounds, electrocardiograms, and “routine blood works,” they give no indication that DNA will be collected as part of the tests. It also does not appear that the government has disclosed to the public or to participants the full range of how collected medical information will be used and disseminated or how long it will be stored. While official media reports stress that participation in the Physicals for All program should be voluntary, it appears that in practice people are expected – and sometimes pressured – to participate.
One Uyghur who participated in the 2016 Physicals for All program in Kashgar in western Xinjiang told Human Rights Watch that his neighborhood committee “had demanded that they [people in his neighborhood] must participate in the physicals.” He did not think he had a choice in the matter, as “not participating would surely be seen as a sign of ‘thought problem,’” a shorthand for “political disloyalty,” a dangerous label in the repressive region. He said the health authorities had not told him afterward the results of his physical.
“China has few meaningful privacy protections and Uyghurs are already subjected to extensive degrees of control and surveillance, including heavy security presence, numerous checkpoints, and routine inspection of smartphones for ‘subversive’ content,” Richardson said. “In this context, compulsory biodata collection has particularly abusive potential, and hardly seems justifiable as a security measure.”
An October 2017 report by the Ili health authorities says the government “has to ensure that those who should participate in the physicals do participate.” While a June 2017 report by the Ili Evening Post says “for those unwilling to participate in the physicals…cadres have to…work hard to convince them to participate,” suggesting that officials may put pressure on residents who refuse to take part. This practice is not consistent with international human rights norms which require that medical interventions, including medical tests, be conducted only with the free and informed consent of the individual.
A Xinhua article dated November 1, 2017, states that 18.8 million people participated in the Physicals for All program in 2017.
The guidelines suggest that biometric collection is a permanent measure. Police are now required to ensure that all such information is collected from anyone in Xinjiang before they conduct any “hukou-related business,” such as enrolling in public schools and applying for passports. Even people who have Xinjiang hukou but live outside the region are required to submit such information to “the Xinjiang Population Services and Management Committee(s) in the Mainland.”
A number of local governments in different parts of Xinjiang – Yining county, Tacheng prefecture, Tiemenguan city (which is part of the Xinjiang Military Corps), Korla city, and Jinghe county – have issued local versions of the directives instructing the collection of biometrics. The directives in Ili and Tacheng largely reproduce the provincial-level guidelines verbatim. In Tiemenguan, though, the collection of DNA is limited to those aged 14 to 65. The Tiemenguan directive also instructs the propaganda authorities to be responsible for “monitoring public sentiments on the internet” about the biometric collection and to “guide and handle negative information.”
Human Rights Watch has previously documented that the Xinjiang police had issued calls for tender in September 2016 for DNA sequencers that indicate its intention to build large-scale infrastructure to process DNA samples of and profile a large number of individuals.
Follow-up research by Human Rights Watch uncovered that a US-based company, Thermo Fisher Scientific, has supplied the Xinjiang police with some of these DNA sequencers. Human Rights Watch wrote to the company in June and August 2017, informing them that Chinese authorities are collecting DNA from individuals not suspected of crimes in Xinjiang as well as across China, and asking them to comment on a range of issues including their human rights policies and discussions they may have had with Chinese authorities about the intended use of DNA sequencing equipment. In Thermo Fisher Scientific’s response to the first letter, the company stated that it does not “share information about our customers or their purchases” and that “given the global nature of our operations, it is not possible for us to monitor the use or application of all products we manufactured.” The firm stated that they “expect all of our customers to act in accordance with appropriate regulations and industry-standard best practices.” Thermo Fisher Scientific did not reply to Human Rights Watch’s second, follow-up letter.
Companies like Thermo Fisher Scientific that supply DNA sequencing and related equipment have a human rights responsibility to avoid contributing to governmental human rights violations. Thermo Fisher Scientific should immediately investigate misuse of their products and suspend future sales or service in China pending such investigation.
Human Rights Watch has also documented the Chinese police’s searchable, nationwide DNA database with 40 million entries from people, including dissidents and migrants. A DNA database allows police not only to search for an exact match, but also for those who are related family members and could lead to discriminatory profiling.
Coercing people to give blood samples, or taking blood samples without informed consent or justification can violate an individual’s privacy, dignity, and right to bodily integrity; it can also in some circumstances constitute degrading treatment. Compelled DNA sampling of an entire region or population for purposes of security maintenance is a serious human rights violation in that it cannot be justified as necessary or proportionate.
The right to respect for confidentiality of medical information is also a core principle of the right to health. The UN Committee on Economic, Social and Cultural Rights (CESCR) has advised states that “[a]ll health facilities, goods and services must be … designed to respect confidentiality.” While the right to privacy does not establish an absolute rule of confidentiality of medical information, interference or breach of confidentiality must be strictly justified, which is not the case when such collection is intended to routinely be shared with the police and any other agency with access to the database.
DNA information is highly sensitive and can facilitate a wide array of abuses if it is collected or shared non-consensually. Any compelled collection or use by the government is a serious intrusion on the right to privacy. While the government’s collection of DNA is sometimes justified as a permissible investigative tool, this type of interference with the right to privacy must be comprehensively regulated, narrow in scope, and proportionate to meeting a legitimate security goal. Yet the program described collects DNA information from all individuals, regardless of whether they are in any way linked to a criminal investigation, and does not appear to require informed consent or explanation of why DNA samples are sought. Mandatory and disproportionate collection of other sensitive biometrics, like iris scans, also raises serious human rights concerns about how such data will be secured and used for undisclosed and potentially rights-violating purposes, including surveillance of persons because of ethnicity, religion, opinion or other protected exercise of rights like free speech.
Xinjiang, in northwestern China, is home to 10 million Uyghurs and other predominantly Muslim ethnic minorities. The Chinese government has imposed pervasive restrictions on their fundamental human rights, including freedom of religion. Since the appointment of Party Secretary Chen Quanguo in August 2016, the Xinjiang regional government has enacted further repressive policies, including restricting foreign travel and forcing those studying abroad to return, detaining thousands in political education facilities, and hiring thousands more as security personnel to monitor the population. Authorities have also ramped up surveillance measures, including by integrating other biometric technology like facial recognition with surveillance systems. Across China, Human Rights Watch has also documented the authorities’ efforts in implementing new technological systems for mass surveillance, including the use of big data, cloud computing, and biometrics.
“Chinese authorities seem to think they can achieve ‘social stability’ by placing people under a microscope, but these abusive programs are more likely to deepen hostility towards the government,” said Richardson. “Beijing should immediately stop these programs, and destroy all data gathered without full, informed consent.”
The [Xinjiang Uyghur Autonomous] Region Working Guidelines on the Accurate Registration and Verification of Population
These guidelines are based on “The [Xinjiang Uyghur Autonomous] Region Working Plan on the Accurate Registration and Verification of Population” and are written to systematically and scientifically promote the work of Accurate Registration and Verification of Population, and to accurately verify Xinjiang’s actual population data and to collect multidimensional biometrics information.
- Target Mission
The main goal is to fully and accurately verify the real number of Xinjiang’s population, to collect the images, fingerprints, iris scans, blood types, and DNA biometrics of those between the age of 12 and 65. For “focus personnel” and their immediate families, such information must be collected from everyone regardless of age. Regulating the management of identification cards is the foundation to creating a basic population database, based on one’s ID numbers, for the autonomous region. [This will also] realize the exchange of population information across government agencies, and achieve precise identification and real name registration management.
- Work Responsibilities
i. All prefecture and city governments should follow the general requirements set out by the regional government, to develop implementation plans and to prepare human, physical, and financial resources to ensure the [implementation of] the work. All county governments will be responsible for carrying out the policy by developing specific measures and by leading and coordinating the work.
ii. All township governments and neighborhood committees are responsible for organizing the personnel responsible for verifying household registration (hukou) information and collecting biometric data.
iii. All county governments, township governments, and neighborhood committees should provide training to staff on verification work and require them to be certificated.
iv. Village and neighborhood Party branch, Party cadres of the “Visit, Benefit and Gather” (访惠聚) program, and police station will form a joint team, led by the village or neighborhood committee’s first Party secretary (for those without a first secretary, the village or neighborhood committee’s Party branch secretaries should be responsible), to carry out the tasks of verifying hukou information and the collection of biometrics using home visits and in a centralized manner.
- Work Requirement
i. Protect people’s legal rights, guide them to cooperate, and support the work of Accurate Registration and Verification of Population.
ii. Organize meticulously and carefully make arrangements to ensure that the hukou information for everyone in every household, in every village is completely verified in Xinjiang. No one is to be missed.
iii. The principle of biometric collection is to proceed from easy to difficult, to promote it from pilot areas, from villages to towns, and from focus personnel to the ordinary masses. The goal is to collect information where information should be collected, and to collect as much data as possible.
iv. Strictly enforce the requirements of the Working Guidelines. To accurately collect biometric data, ensure that the collected biometrics match with the personal information [of the right person].
v. The principle is whoever collects the information, that person should be responsible; whoever inputs the information, that person should be responsible; whoever manages the information, that person should be responsible. After collecting and verifying the information, the staff must sign their names in the documents to ensure the quality of the collected information and to strengthen responsibility and accountability.
vi. Staff responsible for verifying information are not to fabricate, or to tamper with the collected data, nor to share data with outside sources or otherwise leak data unless legally authorized.
vii. In areas that do not have mobile network coverage, staff can record data on paper or temporarily store the information on mobile devices. When the situation allows, log onto the relevant platforms and databases to upload the data.
viii. After a long-term data collection system is established and the work of verifying and registering population information has been started in a comprehensive manner, when police agencies handle any hukou-related matters, they should first check to see if biometrics have been collected. Any missing or incomplete information should first be collected before any hukou matters can be conducted.
- Rules on Hukou Information Verification and the Collection of Multidimensional Biometrics Information
i. Verifying the Hukou Information of Individuals
- Staff conducting verification work will use handheld devices and log on to Accurate Registration and Verification of Population platforms using previously given account information. They will key in the identification numbers of those registered in the administrative area to generate information collection charts for [each] individual.
- Staff should verify the name, gender, ethnicity, date of birth, ID number, education level, employer information, and other information of the individual.
ii. Collecting Multidimensional Biometric Data
- Multidimensional biometric data includes: images, fingerprints, iris scans, blood types, DNA samples, and others.
- The collection of biometrics, like images, fingerprints, and iris scans can be done by visiting individual households with biodata collection equipment, or by setting up central collecting points based on geographic and population distribution.
- The collection of biometrics like blood types and DNA samples should be carried out by county (city and district level) Health and Family Planning Bureaus at the basic levels as part of the Physicals for All Programs, to ensure the professional collection of blood type and DNA blood cards. The blood type information should be sent to the county level police bureaus while blood cards [for DNA collection] should be sent to the county police bureaus for profiling.
- Handling Various Situations When Verifying Hukou Information
i. While verifying hukou information, for errors found in the main items (name, gender, ethnicity, date of birth, ID number), the staff should inform the person to bring supporting documents to make corrections at their local police station. Errors found in the supplementary items (education level, employment) can be edited by police officers after gathering supporting documents on the spot, and logging onto the Accurate Registration and Verification of Population platform.
ii. When verifying the information of people who have moved away from the areas where their hukous are registered, if any mismatched information is found between the information they provided and the information on the Accurate Registration and Verification of Population platform, inform the individuals to go back to the police station where their hukou is registered to make the amendments.
iii. For the migrant population in Xinjiang, register their information according to the relevant requirements for the management of migrant population, verify their hukou information, and through the Accurate Registration and Verification of Population platform, report the verification results and the status of their biometric collection to the local police stations where their hukous are located for examination and approval.
iv. For those without hukous, input their hukou information according to the requirements, collect their photos, biometric data, and then inform them or their guardians to report, within a certain time limit, to the police station in their area of residence or where they were born to process their hukou registration according to the relevant policies concerning people without hukous.
v. For those whose information cannot be verified on the spot, after collecting their pictures and multidimensional biodata, report their situation to the police station in the areas where they said their hukous are located, and the latter will verify their information. If verified, connect their biometric data with their hukou information. If not verified, make a note on the data collecting system and try to match it later.
vi. For migrant populations whose hukou is located outside of Xinjiang, register them according to the relevant regulations concerning the management of migrant populations.
- The Collection and Verification of Information for those with Xinjiang Hukous but Living in the Mainland
The work of verifying hukou information and collecting biometrics of those with Xinjiang hukous but living in the mainland is the responsibility of the local offices of the Xinjiang Population Services and Management Committees in the mainland and of the local people’s governments entrusted by the Xinjiang government. The Xinjiang Population Services and Management and Real-Name Registration Work Leadership Committee is responsible for the training of personnel, distribution of equipment, and the launching of special accounts for Accurate Population Registration and Verification.
