The controversial facial recognition company Clearview AI has been hit with its largest fine to date under Europe's General Data Protection Regulation (GDPR). The Dutch Data Protection Authority (DPA) has imposed a €35 million ($38.7 million) penalty on the American firm for illegally storing and using biometric data of Dutch citizens without their consent.
Clearview AI, known for its massive database of facial images scraped from social media platforms, has been under scrutiny from privacy regulators worldwide. The company claims to have amassed over 50 billion images, which it sells to law enforcement and intelligence agencies for investigative purposes.
The Dutch DPA's decision includes:
- A €30.5 million fine for creating an illegal database of biometric data
- An additional €5 million penalty for non-compliance and continued violations
Aleid Wolfsen, chairman of the Dutch DPA, described Clearview's technology as highly intrusive, stating, If there is a photo of you on the Internet – and doesn't that apply to all of us? – then you can end up in the database of Clearview AI and be tracked.
The regulator is exploring ways to ensure Clearview ceases its violations, including the possibility of holding company directors personally liable if they knowingly failed to stop GDPR breaches.
This isn't Clearview's first encounter with European privacy laws. The company has previously faced similar fines and data deletion orders in the UK, France, and Italy. It has also been penalized in Australia and Canada.
Clearview AI maintains that it is not subject to the GDPR, as it does not have a place of business or customers in the EU. Jack Mulcaire, Clearview's chief legal officer, called the Dutch DPA's decision unlawful, devoid of due process and is unenforceable.
As privacy concerns continue to mount, it remains to be seen how Clearview AI will navigate the increasing regulatory pressure and whether this latest fine will impact its operations or business model.