ICO imposes £7.5m monetary penalty on facial recognition database company and orders UK data to be deleted

The ICO also issued an enforcement notice against the company ordering it to stop obtaining and using the personal data of UK residents that is publicly available on the internet, and to delete the data of UK residents from its systems.

The company said the decision to impose any fine was “incorrect as a matter of law” as Clearview is not subject to the ICO's jurisdiction, and currently does no business in the United Kingdom.

The ICO found that Clearview AI Inc breached UK data protection laws by:

• failing to use the information of people in the UK in a way that was fair and transparent, given that individuals were not made aware or would not reasonably expect their personal data to be used in this way;
• failing to have a lawful reason for collecting people's information;
• failing to have a process in place to stop the data from being retained indefinitely;
• failing to meet the higher data protection standards required for biometric data (classed as 'special category data' under the GDPR and UK GDPR);
• asking for additional personal information, including photos, when asked by members of the public if they were on their database. This might have acted as a disincentive to individuals who wished to object to their data being collected and used.

The company provides a service that allows customers, including the police, to upload an image of a person to the company's app, which is then checked for a match against its database of over 20 billion facial images sourced from public-only web sources, including social media.

The app then provides a list of images that have similar characteristics to the photo provided by the customer, with a link to the websites from where those images came from.

Given the high number of UK internet and social media users, the database is likely to include a substantial amount of data from UK residents, which has been gathered without their knowledge, the ICO said.

Although the company no longer offers its services to UK organisations, the company has customers in other countries, so the company is still using the personal data of UK residents, the watchdog added.

John Edwards, UK Information Commissioner, said the company not only enables identification of people on its database "but effectively monitors their behaviour and offers it as a commercial service. That is unacceptable."

Mr Edwards added: "That is why we have acted to protect people in the UK by both fining the company and issuing an enforcement notice.

"People expect that their personal information will be respected, regardless of where in the world their data is being used. That is why global companies need international enforcement. Working with colleagues around the world helped us take this action and protect people from such intrusive activity.

However, Lee Wolosky, a Partner at law firm Jenner and Block and representing Clearview, said: “While we appreciate the ICO’s desire to reduce their monetary penalty on Clearview AI, we nevertheless stand by our position that the decision to impose any fine is incorrect as a matter of law. Clearview AI is not subject to the ICO's jurisdiction, and Clearview AI does no business in the UK at this time.”

Clearview’s CEO, Hoan Ton-That, said: “I grew up in Australia and have long viewed the UK as an important, majestic place—one about which I have the deepest respect. I am deeply disappointed that the UK Information Commissioner  has misinterpreted my technology and intentions. I created the consequential facial recognition technology known the world over. 

“My company and I have acted in the best interests of the UK and their people by assisting law enforcement in solving heinous crimes against children, seniors, and other victims of unscrupulous acts. It breaks my heart that Clearview AI has been unable to assist when receiving urgent requests from UK law enforcement agencies seeking to use this technology to investigate cases of severe sexual abuse of children in the UK."

He added: “We collect only public data from the open internet and comply with all standards of privacy and law. I am disheartened by the misinterpretation of Clearview AI’s technology to society. I would welcome the opportunity to engage in conversation with leaders and lawmakers so the true value of this technology which has proven so essential to law enforcement can continue to make communities safe.”

Adam Carey