Clearview AI data use deemed illegal in Austria, however no fine issued
The Austrian data protection authority has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed to process biometric data of the complainant and must delete their existing data. The US based company scrapes photos from websites to create a permanent searchable database of biometric profiles. The decision follows similar decisions in Italy, the UK, France and Greece, however no fine was issued.
Clearview must comply with GDPR. The decision is clear: Collecting images of the complainant for a biometric search engine is illegal, as the GDPR applies to such scraping and selling of personal data from Europeans. Clearview AI uses its software to monitor the behavior of people in Austria, even though the company is based in the U.S. and does not offer its services in Austria. Not only does Clearview have to delete all personal data of the complainant, but the data processing lacks a valid legal basis.
No general ban, no fine: Contrary to the other data protection authorities, the Austrian DPA did not issue a fine. This comes as a surprise as the French, the Italian, the Greek and the UK data protection authority issued a fine. Recently, the French data protection authority fined Clearview again over 20 Mio Euro. Moreover, the Austrian DPA did not consider it necessary to order a general ban of Clearview, but mentioned that it might do so later on.
"It is unfortunate that no general ban was issued. The case of the complainant is likely the same for everyone else in Austria. It seems that Clearview’s processing is only considered illegal if you complain to the data protection authority.“ -Felix Mikolasch, data protection lawyer at noyb
Complaints in five countries. An alliance of organizations, including noyb, Privacy International (PI), Hermes Center, and Homo Digitalis, filed a series of complaints against Clearview AI Inc. in May 2021. The company claims to have "the largest known database of more than 10 billion facial images" and is aiming to reach 100 billion to make almost every person worldwide identifiable. The images for this come from social media accounts and other online sources. Complaints have been filed with data protection authorities in France, Austria, Italy, Greece and the United Kingdom.
Representation in the EU. The Austrian authority also ordered Clearview to appoint a representative in the EU, to enable EU citizens to exercise their rights more easily and for regulators to have a contact person in the EU.
Things are getting tight for Clearview. This decision follows the decision by the French authority on Clearview in December 2021, the decision by the Italian authority in March 2022 and the decision by the Greek authority in June 2022: these authorities prohibited the collection and processing of data by Clearview.
