What is Clearview AI's business?
Clearview AI is a US-based company which provides facial recognition technology, primarily to law enforcement and government agencies, and is known to have developed a database of more than 20 billion images of faces, collected from the internet without consent. It then allows its clients to upload photos of people and search the database for a match. Clearview had initially accepted commercial clients but, following a settlement with US civil liberties campaigners in 2020, it now only offers its services to law enforcement or national security agencies in the US, Brazil, Mexico, Panama, etc...
ICO grounds for the 2022 fine
The ICO's monetary penalty notice and enforcement notice against Clearview released on 23 May 2022 hinged on Clearview's alleged breach of a number of provisions of the UK GDPR including failing to:
- process data in a fair and transparent way;
- meet the requirements for processing biometric data;
- maintain and implement an appropriate retention policy;
- allow data subjects to effectively exercise their rights; and
- conduct a Data Protection Impact Assessment (DPIA) in respect of its processing of the personal data of UK residents.
The decision is complex and sheds new light on the interpretation of the material and territorial scope of the UK GDPR when applied to data processing related to monitoring the behaviour of UK data subjects.
The UK GDPR governs the processing of personal data of data subjects in the UK by a controller or processor not established in the UK where the processing activities are related to monitoring the behaviour of UK data subjects. On that basis, the ICO successfully argued that because Clearview enables its clients to monitor the behaviour of data subjects, Clearview and its clients were joint controllers, and the data processing related to the monitoring of UK data subjects' behaviour.
However, Clearview's strong arguments centred around being a foreign company based in the US and providing services to foreign clients purely for the public interest activities of foreign governments and government agencies, in particular in relation to "their national security and criminal law enforcement functions”.
The UK GDPR states that the processing of personal data by competent authorities for national security and law enforcement purposes is outside its scope — and is instead subject to rules in Part 3 of the Data Protection Act 2018 (which post Brexit incorporates the EU Law Enforcement Directive EU2016/680 into UK. law). However, a conflict arose between the material scope of the UK GDPR - as there is no doubt that Clearview's monitoring activities (or rather those of its clients) are in breach, and the territorial scope of the UK GDPR – as Clearview's clients are based outside the UK/EU. This is where the FTT Decision clarified the limitation of the UK GDPR's scope and the exemption applicable to the processing by enforcement agencies based outside the UK/EU for law enforcement purposes. As a result, the ICO was found to have no jurisdiction, because the UK GDPR does not apply to the processing of personal data by authorities outside the UK for national security/law enforcement purposes. The FTT accepted Clearview's argument that its clients were foreign national security and law enforcement bodies, and accordingly outside the scope of the UK GDPR.
Other regulators in Canada, Australia, and South Africa, but also in the European Union including in France, Italy and Greece, have taken enforcement measures against Clearview. France's CNIL issued a €20 million fine in October 2022. The FTT Decision does not attempt to align with those of the CNIL and the other EU regulators who have issued fines, even though the ICO supplied the FTT with copies of those decisions. To date, Clearview has not paid the fines it has been issued, nor is it thought that it has complied with the orders to delete personal data. It is clear that regulators in the EU are struggling to enforce GDPR's extraterritorial rules against organisations operating from outside the EU. In the UK, the FTT Decision has further jeopardised any present and future oversight of Clearview's monitoring of UK data subjects unless the ICO decides to appeal.
