£7.5 million fine makes the ICO’s view crystal clear

Clearview AI Inc, a company which produced a facial recognition database containing 20 billion images of people’s faces which were harvested from open sources, has been fined more than £7.5 million by the ICO in an enforcement notice.

The company’s software allows customers to provide an image of an individual, which will then be matched with other sufficiently similar images in the gigantic database. The company used to operate in the UK but does not do so any more. However, the ICO took the view that the database is likely to include UK residents whose images have been gathered without their knowledge or indeed consent.

 The investigation was run jointly with the Office of the Australian Information Commissioner (“OAIC”).

 The ICO found that Clearview AI Inc was in breach of UK legislation by:

• “failing to use the information of people in the UK in a way that is fair and transparent, given that individuals are not made aware or would not reasonably expect their personal data to be used in this way;
• failing to have a lawful reason for collecting people’s information;
• failing to have a process in place to stop the data being retained indefinitely;
• failing to meet the higher data protection standards required for biometric data (classed as ‘special category data’ under the GDPR and UK GDPR);
• asking for additional personal information, including photos, when asked by members of the public if they are on their database. This may have acted as a disincentive to individuals who wish to object to their data being collected and used.”

---

Authors

Aaron Moss

Call 2013

John Goss

Call 2015

Other articles in this edition

This Article Will Self-destruct in 3…2…1…

---

Retaining Acquittal Information on the PNC (Still) Lawful

---

Looking Behind the Curtain

---

Data Extraction Government Consultation

---