Facial recognition: 20 million euros penalty against Clearview AI

Following a formal notice which remained unaddressed, the CNIL imposed a penalty of 20 million euros and ordered Clearview AI to stop collecting and using data on individuals in France without a legal basis and to delete the data already collected.

As of May 2020, the Commission nationale de l'informatique et des libertés, CNIL received complaints from individuals about Clearview AI's facial recognition software and opened an investigation. In May 2021, the association Privacy International also warned the CNIL about this practice.

On 26 November 2021, the Chair of the CNIL decided to give Clearview AI formal notice to cease the collection and use of data of persons on French territory in the absence of a legal basis to to facilitate the exercise of individuals' rights and to comply with their requests for erasure.  Clearview AI had two months to comply with the injunctions formulated in the formal notice and to justify them to the CNIL. However, it did not provide any response to this formal notice.

The Chair of the CNIL therefore decided to refer the matter to the restricted committee, which is in charge for issuing sanctions.

The Commission found:

  • Unlawful processing of personal data (breach of article 6 of the GDPR)
  • Individuals' rights not respected (articles 12, 15 and 17 of the GDPR)
  • Lack of cooperation with the CNIL (Article 31 of the RGPD)

On the basis of the information brought to its attention, the restricted committee decided to impose a maximum financial penalty of 20 million euros, according to article 83 of the GDPR.

Regarding the very serious risks to the fundamental rights of the data subjects resulting from the processing carried out by the company, the restricted committee decided to order Clearview AI to stop collecting and processing data of individuals residing in France without a legal basis and to delete the data of these persons that it has already collected, within a period of two months. The restricted committee added to this injunction a penalty of 100,000 euros per day of delay beyond these two months. (edpb.europa.eu/photo: freepik.com)

More information here

Comments

Popular posts from this blog

Excessive formalism as a restriction on the right of access to justice

The EU’s Data Act: Data protection must prevail to empower data subjects

Significant numbers of young lawyers want to leave their current job: New report by International Bar Association