Controversial facial recognition company Clearview AI, which is reportedly used by thousands of government and law enforcement agencies around the world, has been fined more than $9.4 million by the U.K.’s privacy watchdog on Monday for illegally creating a database filled with billions of images taken from social media and the internet.
The Information Commissioner’s Office (ICO) said Clearview illegally harvested more than 20 billion images from the internet and social media to create its global facial recognition database.
The trove of pictures power an app that lets Clearview’s customers—which include police and law enforcement agencies—match an uploaded photo against the images in the database, the ICO said.
While Clearview no longer offers its services to U.K. organizations, the ICO said its database was likely to include a “substantial amount of data from U.K. residents” gathered without their knowledge owing to the high number of people using social media and the internet in the country.
Clearview broke multiple U.K. data protection laws, the ICO said, including not having a lawful reason for collecting personal information, not having mechanisms in place to stop data being held indefinitely, failing to inform people their data was being used in this way and making it harder for members of the public to object to their data being collected and used.
In addition to the fine of more than $9.4 million (£7.5 million), the ICO also ordered Clearview to delete data of U.K. residents from its system and to stop collecting and using the personal data of U.K. residents available online.
John Edwards, the U.K.’s Information Commissioner said Clearview AI’s practices are “unacceptable,” not only identifying people but effectively monitoring their behavior and offering it as a commercial service.
Clearview AI went from a little known startup to one of the most visible examples of digital surveillance in 2020 when the New York Times exposed the company’s massive trove of data quietly harvested online and its client roster filled with law enforcement agencies and police. Since then, the company has been accused of violating numerous privacy laws around the world, including in Europe and the U.S., and has faced scrutiny from legislators and privacy advocates. In early May, the company settled a nearly two-year-old lawsuit with activist groups in Illinois for allegedly violating the state’s privacy law. Globally, regulators are broadly seeking to rein in the use of artificial intelligence and mass surveillance online, which by nature occurs across borders. European politicians have floated a possible ban on the technology entirely, though there may be exceptions for police.
$21.4 million. That’s how much the ICO said it was provisionally planning to fine Clearview in November. It did not say why its final penalty was less than half this amount.