What is it about ? Clearview AI is an American company (with no establishment in Europe) which provides facial recognition services. Which services have regularly been under fire by DPAs and be considered as prohibited. Its database made with more than 30 billions of photos of faces is particularly criticized, all the more that such photos may have been scrapped, without any kind of consent or information of data subjects. Clearview offers specific facial recognition services to intelligence and investigative services, out of the strict limitations displayed by EU legislations (source).
Such sanction is a new clear signal made by DPAs against facial recognition in Europe. The Dutch DPA has then underlined the risks of such intrusive technology and the necessity to set up a specific framework.
In its sanction, the Dutch DPA has clearly stated that Clearview’s commercial practices are illegal and breaking the law and more specifically GDPR. The DPA also noticed that Clearview’s database has been built illegally (taking into account that the collection of fingerprints or biometric data was then prohibited). The absence of transparency to data subjects has also been pointed out, in addition to the lack of cooperation of Clearview to help people exercising their rights.
Once again, it should also be noted that Clearview had not made any decision to stop such violations (neither did Clearview with regards to the French CNIL investigations and its sanction in 2022).
Such sanction (as well as the former sanctions made by European DPAs) is a clear signal when looking at the geographical scope of GDPR. And a hallmark of the efficency (or not) of the sanctions provided for by GDPR.
Here, it is also interesting to highlight that the Dutch authority has considered other options (like challenging the personal responsibility of the members of the board of Clearview), which demonstrates the necessity to guarantee the effectiveness of sanctions. Even more when Clearview AI has not changed its behavior and continued to violate European privacy laws.
