France: 20 million euro fine against Clearview AI

France has imposed the maximum fine allowed under the GDPR on Clearview AI, a company that unlawfully scanned faces and stored data collected in the process. Clearview proved uncooperative in the investigation.

Images collected from the Internet

Clearview collects photos of people found on websites, social networks or video platforms. To do this, the company systematically scans a considerable part of the Internet, extracts the data relevant to its purposes and stores them. With them, an image database was built. Furthermore, the photos were used to train a face recognition algorithm. Clearview offers access to its own database and algorithm primarily to law enforcement agencies, which are supposed to be able to identify wanted persons via a single photo. This does indeed seem possible, as the company probably has more than 20 billion photos at its disposal. The problem is that neither the websites scanned nor the people depicted in the photos have ever given their consent to the practice. Consequently, it is in effect a theft of data that is being put to unauthorized use, which in turn enables mass surveillance. Clearview has therefore been under criticism for some time.

Warning ignored

Since Clearview does not operate a branch in the EU, each EU country is itself responsible for prosecuting offenses that affect the scope of its laws. In France, the data protection authority CNIL is investigating, and according to its own information, it received its first complaints regarding Clearview’s practices as early as May 2020. The authority was approached by both private individuals and the Privacy International organization. In the course of the investigations that were initiated, CNIL determined that Clearview was in double violation of the GDPR. For example, the company is processing all the data it works with unlawfully, as there is no consent from the data subjects and no other legal basis. In addition, the company disregards the right of data subjects to access and delete data collected about them.

As a result, CNIL issued a warning against Clearview. The company was ordered to stop collecting and using the data of French citizens. It was also ordered to delete all existing data of French nationals. Clearview did not respond to the two-month deadline. This in turn set in motion a sanctions process in which Clearview did not sufficiently cooperate with the authority. For example, forms were said to have been incomplete or not filled out at all. Clearview thus once again violated the GDPR, which stipulates an obligation to cooperate with competent authorities.

Fine in maximum amount

The authority took all of this into account when determining the fine. Ultimately, Clearview has now been fined 20 million euros – the maximum penalty envisaged. Should the company fail to pay or otherwise respond, the penalty increases by 100,000 euros for each day the deadline is missed.

The French fine is not the first imposed on Clearview. The UK regulator already imposed a fine of around eight million euros. In Canada, the operation of the service was banned in some provinces. Clearview, however, does not seem to be impressed by any of this. Earlier this year, the company announced plans to increase its image database to 100 million images in order to soon be able to identify every person on Earth. The company also plans real-time facial recognition, license plate recognition and other surveillance tools that will enable seamless monitoring of every public and semi-public space.