Dutch Regulator Slaps Clearview AI with €30+ Millions in Fines and Penalties

Clearview AI has been fined €30.5 million ($33.7 million) by the Dutch Data Protection Authority (DPA) for creating what the agency described as an illegal facial recognition database. The DPA also imposed an additional penalty of up to €5 million for non-compliance. The company did not object to the decision, meaning it cannot appeal the fine.

The DPA’s chairman, Aleid Wolfsen, called facial recognition “a highly intrusive technology” and said that using Clearview’s services is illegal under Dutch law.

The fine follows a pattern of increased scrutiny by European regulators on companies violating data protection rules. Just last week, Uber was fined by the DPA for transferring the personal data of European taxi drivers to the United States, highlighting the region’s stringent data privacy regulations.

For its part, Clearview AI has faced numerous regulatory fines and sanctions across multiple countries for its data collection practices and violations of privacy laws.

Prior to this development in the Netherlands, in 2022, Clearview AI was hit with a series of fines from other European regulators. France’s privacy watchdog, CNIL, imposed a €20 million fine for unlawful data processing and failing to respect individuals’ rights. Similar €20 million penalties were issued by data protection authorities in Italy and Greece. The UK’s Information Commissioner’s Office also fined Clearview AI approximately £7.5 million ($9 million), though Clearview successfully appealed this decision.

Outside of Europe, Clearview AI reached a settlement in the United States in June 2024 over a lawsuit in Illinois alleging privacy rights violations. While not admitting liability, the settlement is estimated to be worth more than $50 million.

Despite these numerous fines, totaling around €100 million in the EU alone, there are concerns about the ability of regulators to collect these penalties from Clearview AI, as the company is based in the United States and does not have a physical presence in the EU. This has led some regulators, like the Dutch authority, to explore holding company executives personally liable for continued non-compliance.

Source: Reuters

September 3, 2024 – by Ali Nassar-Smith