UK Hits Clearview With £7.5 Million Fine

The Information Commissioner’s Office (ICO) in the UK has handed down its final judgment in its investigation of Clearview AI. The privacy watchdog had threatened Clearview with a £17 million fine in a preliminary decision that was released in November, but has lowered that number to £7,552,800 in its final ruling.

The £7.5 million fine is a penalty for violations of UK privacy law. Clearview’s facial recognition database is put together with images pulled from platforms like Facebook, Google, Twitter, and even Venmo. Those images are often gathered in violation of the terms of service on those sites, and without the knowledge or consent of the people in the photos. That practice has led to multiple cease and desists for Clearview AI, and to several privacy judgments internationally.

In that regard, the UK’s decision echoes similar decisions in Australia, Canada, France, and Italy, though the UK and Italy are the only two to issue fines. All of those countries (including the UK) have ordered Clearview to stop collecting the data of their citizens, and to delete the images of anyone already in its systems. However, enforcement has been a persistent issue. Clearview claims that it does not need to comply with UK law because it does not do business in the country, and has made similar claims in other jurisdictions in which it has been censured.

In its investigation, the ICO found that Clearview breached the UK Data Protection Act of 2018 on multiple fronts. Most notably, the company did not have a written data storage policy, nor did it give people an easy way to opt out of the system. Those who wanted their data to be deleted were asked to submit even more personal information, even though no additional information should have been required under the Data Protection Act.

The ICO also ruled that Clearview was not “fair and transparent” about its use of personal data. The company could similarly not establish that it had a valid, lawful reason for collecting the data in the first place, and failed to meet the country’s unique standards for the processing of facial recognition data.

The law gives Clearview 28 days to appeal the ruling, and the company has another six months from that deadline to achieve compliance. In the meantime, Clearview recently settled its class action lawsuit in Illinois. The company is longer allowed to give private entities access to its facial recognition database, though it is still permitted to sell its facial recognition algorithm.

Source: CPO Magazine and Lexology

–

June 6, 2022 – by Eric Weiss