Facial recognition: 20 million euros penalty against Clearview AI

Following a formal notice which remained unaddressed, the CNIL imposed a penalty of 20 million euros and ordered Clearview AI to stop collecting and using data on individuals in France without a legal basis and to delete the data already collected.

As of May 2020, the Commission nationale de l'informatique et des libertés, CNIL received complaints from individuals about Clearview AI's facial recognition software and opened an investigation. In May 2021, the association Privacy International also warned the CNIL about this practice.

On 26 November 2021, the Chair of the CNIL decided to give Clearview AI formal notice to cease the collection and use of data of persons on French territory in the absence of a legal basis to to facilitate the exercise of individuals' rights and to comply with their requests for erasure.  Clearview AI had two months to comply with the injunctions formulated in the formal notice and to justify them to the CNIL. However, it did not provide any response to this formal notice.

The Chair of the CNIL therefore decided to refer the matter to the restricted committee, which is in charge for issuing sanctions.

The Commission found:

  • Unlawful processing of personal data (breach of article 6 of the GDPR)
  • Individuals' rights not respected (articles 12, 15 and 17 of the GDPR)
  • Lack of cooperation with the CNIL (Article 31 of the RGPD)

On the basis of the information brought to its attention, the restricted committee decided to impose a maximum financial penalty of 20 million euros, according to article 83 of the GDPR.

Regarding the very serious risks to the fundamental rights of the data subjects resulting from the processing carried out by the company, the restricted committee decided to order Clearview AI to stop collecting and processing data of individuals residing in France without a legal basis and to delete the data of these persons that it has already collected, within a period of two months. The restricted committee added to this injunction a penalty of 100,000 euros per day of delay beyond these two months. (edpb.europa.eu/photo: freepik.com)

More information here

Comments

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Gigantic fine for unfair practices imposed on Booking.com by the Competition Authority of Hungary

Politically Exposed Persons (PEPs): What and Why?

The name Pablo Escobar may not be registered as an EU trade mark

ECHR President: Covid-19 pandemic has raised a number of important human rights issues

First judgment of the ECHR: Lawless v. Ireland

A pregnant worker must be afforded a reasonable time limit in order to be able to bring an action against her dismissal (ECJ)