The Dutch Data Protection Authority (Dutch DPA) imposed a 30.5 million euro fine on US company Clearview AI on Wednesday for building an “illegal database” containing over 30 billion images of people.
The Dutch DPA issued the fine following an investigation into Clearview AI’s processing of personal data. It found the company violated the European Union’s General Data Protection Regulation (GDPR). This fine cannot be appealed, as Clearview did not object to the Dutch DPA’s decision. The data watchdog also imposed four orders on Clearview subject to non-compliance penalties of up to 5.1 million euros in total, which Clearview will have to pay if they fail to stop the violations.
The Dutch DPA asserted that the fines are a necessary measure, claiming that through the unlawful processing of personal data, including biometric data, Clearview “violated the rights and freedoms of citizens by not fully informing citizens about such processing, by not responding to access requests by citizens and by not designating a representative in the European Union.”
According to the watchdog, Clearview has violated several provisions of the GDPR. The Dutch DPA notes Clearview has violated parts of Article 5(1) concerning the lawful, fair and transparent processing of personal data and Article 6(1), which sets out the conditions for lawful processing. Additionally, Article 12(1) and Articles 14(1) and (2) requiring that data subjects be provided information and communication regarding processing were also breached alongside several other provisions.
Clearview AI asserts its technology is “entirely lawful,” specifying it is “only available for government agencies and contractors.” Its website explicitly notes, “Clearview AI does not offer its technology in the EU, UK, Australia and Canada.” Aleid Wolfsen, chairman of the Dutch DPA, warns that fines may be imposed on Dutch organizations found using Clearview, reiterating, “Clearview breaks the law, and this makes using the services of Clearview illegal.”
Based in the US, Clearview AI is a privately-owned company claiming its mission is to “create and deliver identification technology that helps combat crime and fraud, keep communities safe and industry and commerce secure, protect victims and promote justice.” Operating as a “search engine of publicly available images” Clearview AI works to “support investigative and identification processes by providing for highly accurate facial recognition.”
Wolfsen recognizes the importance of facial recognition in facilitating safety and criminal detection but rejects the notion that a commercial business should conduct it. Wolfsen notes, “Facial recognition is a highly intrusive technology, that you cannot simply unleash on anyone in the world.”
The Dutch DPA launched the investigation into Clearview AI on March 6, 2023, following a series of complaints received from data subjects included in the database. Clearview AI was sent the investigative report on June 20, 2023 and was informed of the Dutch DPA’s enforcement intention. Watchdogs from Italy, Greece and France have also imposed fines on Clearview AI.
