Clearview AI’s biometric photo database deemed illegal in the EU, but only partial deletion ordered
Clearview AI is a US company that scrapes photos from websites to create a permanent searchable database of biometric profiles. US authorities use the face recognition database to find further information on otherwhise unknown persons in pictures and videos. Following legal submissions by noyb, the Hamburg Data Protection Authority yesterday preliminarily deemed such biometric profiles of Europeans illegal and requested Clearview AI to delete the biometric profile of the complainant.
“Right to your face”. A Hamburg resident and member of the Chaos Computer Club, Matthias Marx, discovered that Clearview AI, a face-tracking company based in the US, had added his biometric profile to their searchable database without his knowledge. The Clearview AI system can be used track and find persons in CCTV footage, pictures and alike – leading to an Orwellian surveillance system. Database access was sold to private companies and is now sold to U.S. law enforcement. The database is claimed to have over 3 billion images, partly gathered from sources like websites and social media and generally without the affected people knowing.
Mr. Marx submitted a complaint to the Hamburg Data Protection Authority (DPA) asking for the deletion of his pictures and the mathematical hash values representing the biometric profile. Following an investigation that lasted over 11 months with submissions by noyb, the Hamburg DPA today preliminarily affirmed the right of every EU resident to not end up in Clearview AI’s database. The DPA however only requested Clearview AI to delete the mathematical hash values representing the biometric profile and to confirm the deletion as part of a consultation prior to an intended order. There was no request made in relation to the captured pictures of Mr Marx. Clearview AI is being given the opportunity to comment on the intended order by February 12, 2021.
“Imagine a world where every time you are caught on video camera, systems don’t just have your picture, but can directly identify you. That’s horrifying.” – Alan Dahi, privacy lawyer at noyb.eu
Clearview AI has to comply with the GDPR. The GDPR applies to anyone that processes personal data on the European market. Even though Clearview AI is based solely in the US, the GDPR applies to their activities affecting European residents – for example when collecting pictures of Europeans. While Clearview AI denied that EU law applies to it, the Hamburg DPA claifies that is has jurisdiction and issued a decision.
“If a US company’s actions affect Europeans, the company needs to play by European rules. It’s like an American tourist driving on the German Autobahn – they need to follow local rules." – Alan Dahi, privacy lawyer at noyb.eu
Hamburg DPA did not issue pan-European order. Unfortunately, the Hamburg DPA issued a narrow request protecting only the individual complainant instead of an order banning the collection of any European resident’s photos, as noyb had argued for. Any European DPA has the right to issue general orders that go beyond the individual complaint. Lacking such a general order, every European would have to submit their own complaint against Clearview AI in order to not be included in the search results of their biometric database. Not only is this inefficient, it is also an unnecessary burden for Europeans who must actively take steps to have their profile removed from Clearview AI’s biometric database, even though the collection of such data is already illegal from the get go. Moreover, the Hamburg DPA failed to request the deletion of Mr. Marx’s photos and limited the intended order to the mathematical hash values representing the biometric profile of Mr Marx.
“This surveillance machine is terrifying. Almost one year after my initial complaint, Clearview AI doesn't even have to delete the pictures that show me. And even worse, every individual must submit their own complaint. This shows that our data is not yet sufficiently protected and that there is a need for action against biometric surveillance.” – Matthias Marx, complainant
What you can do? We encourage everyone to ask Clearview AI for a copy of their data, to delete any data Clearview AI has on them, and to object to being included in Clearview AI’s database. The forms to do so are available on Clearview AI’s website. You should also submit a complaint against Clearview AI with your local data protection authority if you are in Clearview AI’s database.
Next Steps. Clearview AI will have until February 12 to reply. Clearview AI and the complainant have the right to an appeal and actual decision. noyb is reviewing such an option, to ensure that all the rights of the data subject are upheld and his pictures are equally deleted, not just the mathematical hash values.
