Photo-Scraping Business Ignores $39M Privacy Fine

A US company that used billions of online photos without permission for facial recognition faces a fine of more than $35 million. Regulators say they may hold directors of Clearview AI personally responsible after the company said the fine was unenforceable.

Clearview has attracted the attention of regulators in several companies for the way it does business. It produces and licenses facial recognition software to law enforcement agencies, for example, to identify alleged offenders from crowd photos or live video.

The software works thanks to a massive database of pictures which Clearview scraped from websites including social media sites. It argues that pictures online are public information and thus come under the First Amendment, giving it the right to use the pictures without permission.

Permission Required

Regulators in European countries disagree and say it violates the EU's General Data Protection Regulation (GDPR). They say photos count as personal data and that it's not usually lawful to collect or use photos without the subject's permission.

This permission must cover the specific way the image is used and the fact they've already put the image on a website isn't relevant. Although there's a "legitimate interest" defense that can cover some business use, this can't outweigh the individual's privacy rights.

Netherlands data regulators have now issued the biggest ever fine against Clearview, €30.5 million plus another €5.1 million for continuing to breach GDPR after learning it was under investigation. That's the equivalent of US$39.3 million. (Source: theverge.com)

Clearview's Views Clear

Clearview has issued a media statement reading "Clearview AI does not have a place of business in the Netherlands or the EU, it does not have any customers in the Netherlands or the EU, and does not undertake any activities that would otherwise mean it is subject to the GDPR. This decision is unlawful, devoid of due process, and is unenforceable."

Despite the location of Clearview and its customers (the police), it does come under GDPR because its database includes pictures of users from EU countries. However, it may indeed be difficult to enforce the fine given it doesn't have an EU presence.

The regulators say they will now investigate "if the directors of the company can be held personally responsible for the violations." That's legally uncertain and again would have enforcement problems, unless the directors wanted to visit an EU country in person or expand their operations and client base. (Source: theregister.com)

What's Your Opinion?

Should Clearview's operations be legal in the US? Do you agree with their argument that people who put photos on a website lose the right to control how they are used? Does it make a difference that their product is used for law enforcement?