Facial recognition: 20 million euros penalty against Clearview AI

Following a formal notice which remained unaddressed, the CNIL imposed a penalty of 20 million euros and ordered Clearview AI to stop collecting and using data on individuals in France without a legal basis and to delete the data already collected.

As of May 2020, the Commission nationale de l'informatique et des libertés, CNIL received complaints from individuals about Clearview AI's facial recognition software and opened an investigation. In May 2021, the association Privacy International also warned the CNIL about this practice.

On 26 November 2021, the Chair of the CNIL decided to give Clearview AI formal notice to cease the collection and use of data of persons on French territory in the absence of a legal basis to to facilitate the exercise of individuals' rights and to comply with their requests for erasure.  Clearview AI had two months to comply with the injunctions formulated in the formal notice and to justify them to the CNIL. However, it did not provide any response to this formal notice.

The Chair of the CNIL therefore decided to refer the matter to the restricted committee, which is in charge for issuing sanctions.

The Commission found:

  • Unlawful processing of personal data (breach of article 6 of the GDPR)
  • Individuals' rights not respected (articles 12, 15 and 17 of the GDPR)
  • Lack of cooperation with the CNIL (Article 31 of the RGPD)

On the basis of the information brought to its attention, the restricted committee decided to impose a maximum financial penalty of 20 million euros, according to article 83 of the GDPR.

Regarding the very serious risks to the fundamental rights of the data subjects resulting from the processing carried out by the company, the restricted committee decided to order Clearview AI to stop collecting and processing data of individuals residing in France without a legal basis and to delete the data of these persons that it has already collected, within a period of two months. The restricted committee added to this injunction a penalty of 100,000 euros per day of delay beyond these two months. (edpb.europa.eu/photo: freepik.com)

More information here



George Kazoleas, Lawyer

Top Stories

Obligation of a creditor to check a consumer’s creditworthiness - Credit agreement void and creditor’s entitlement to payment of the agreed interest forfeited

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Graduate Programme 2024 for EU Nationals in European Central Bank

The rules of UEFA on ‘homegrown players’ could be contrary to EU law (ECJ)

ECtHR Judgement against Greece: Disclosure of the identities and medical data of prostitutes diagnosed with HIV was a breach of their right to private life

Cybercrime: the fear of a possible misuse of personal data is capable, in itself, of constituting non-material damage (ECJ)

Woman forced to travel abroad to have an abortion following legislative amendments in Poland breached the ECHR (ECtHR)