The UK Information Commissioner’s Office fined Clearview AI £7,552,800 for collecting images of people in the UK from the internet and social media to build a global facial recognition database. The ICO also ordered the company to stop obtaining and to delete UK residents’ personal data.
What happened
- Clearview had collected billions of facial images without people’s knowledge and offered a search service to customers, including law enforcement.
- The ICO found it had no lawful basis for the processing, failed to be transparent, and had no process to stop data being kept indefinitely.
- The action followed a joint investigation with Australia’s privacy regulator.
- Clearview challenged the fine, leading to a long-running tribunal dispute over the ICO’s jurisdiction.
Why it mattered
The case became a landmark test of how data protection law applies to biometric data scraped from the public internet by a company based overseas. Regulators in Australia, Canada, France, Italy, and Greece also took action against Clearview over similar practices.
Lessons for organisations
Organisations using facial recognition or other biometric tools should carry out a data protection impact assessment and check the lawful basis for any data their suppliers have collected. Buying a tool from a third party does not transfer accountability for how its data was gathered.
Source: TechCrunch
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
