Potential £17 million fine for facial recognition company Clearview AI
Key Contact: Rachelle Sellek
Author: Rachel McCulloch
In July 2020, the UK’s Information Commissioner’s Office (ICO) joined forces with the Australian Information Commissioner (OAIC) and began to jointly investigate Clearview AI Inc and their data scraping techniques. This investigation has now concluded and both the ICO and OAIC have issued statements in relation to their findings.
What is Clearview AI?
Clearview AI describes itself as the “world’s largest facial network’. It is an American facial recognition company which allows paying customers to upload a photograph and Clearview will use artificial intelligence to identify the person and match it to other public photographs of them. Clearview will also provide links to where the matching photographs have come from. Clearview AI claims to have banked over ten billion photographs and have taken these images from various websites including Facebook, Instagram and Twitter.
Clearview AI focused on promoting its services to law enforcement, and various police forces and governments around the world have used the services to help identify suspects in photos. It is understood that the services were trialled by multiple UK law enforcement agencies, but the trial was discontinued. At present, Clearview does not have any UK customers.
Trouble for Clearview AI
There has been outrage over Clearview’s data scraping techniques and critics say they are invading people’s personal privacy. In January 2020, Twitter sent Clearview a cease-and-desist letter, demanding they stop taking images from their website. Google, YouTube, Venmo and LinkedIn subsequently also sent cease-and-desist letters, and Facebook demanded they stop scraping Facebook and Instagram for images.
In 2020, Clearview was sued by the American Civil Liberties Union in Illinois. An Illinois court denied Clearview’s motion to dismiss the lawsuit. This case has led to Clearview’s decision to stop selling its product to private US companies. Clearview is facing a number of lawsuits in America, including California and New York.
In February 2021, Canada’s privacy commissioners determined that Clearview AI was illegal and they should delete Canadian’s faces from its database. Following an investigation which found that the Swedish police had used Clearview AI on a number of occasions, the Swedish Authority for Privacy Protection fined the Swedish police and ordered further training and education to avoid future breaches of data protection rules.
In March 2021, Privacy International and several other European privacy and digital rights organisations filed legal complaints in France, Austria, Greece, Italy and the UK. Their reason was that Clearview was violating European privacy laws, specifically GDPR rules around lawfulness, transparency and purpose.
Following the OAIC’s joint investigation with the ICO, the OAIC ordered Clearview to stop collecting photographs taken in Australia and remove the ones they already have. The OAIC found Clearview breached the Australian Privacy Act
ICO’s preliminary view
Even though the services are not currently being used in the UK, the ICO has said that Clearview’s database is still “likely to include the data of a substantial number of people from the UK and may have been gathered without people’s knowledge from publicly available information online, including social media platforms.”
The ICO has recently announced it intends to impose a fine exceeding £17 million. It has also issued a provisional enforcement notice requiring Clearview to stop processing the personal data of individuals in the UK, and delete the date it holds, following alleged serious breaches of the UK GDPR and Data Protection Act 2018.
The ICO’s preliminary view is that Clearview has failed to comply with UK data protection laws by:
- failing to process information of people in the UK fairly,
- failing to have processes in place to stop the data being retained indefinitely,
- failing to have a lawful reason for collecting the information, and
- failing to inform people in the UK what is happening with their data.
Hoan Ton-That, chief executive of Clearview AI has said he was “deeply disappointed” and “my company and I have acted in the best interests of the UK and their people by assisting law enforcement involving heinous crimes against children, seniors and other victims of unscrupulous acts”.
The ICO’s final decision is anticipated mid-2022.
If you have any queries about data protection, please contact our commercial and technology team.
