Background information
- Date of final decision: 19 October 2022
- Cross-border case or national case: National case
- Controller: Clearview AI
- Legal Reference: Lawfulness of processing of personal data (article 6 of the GDPR), Rights of individuals (articles 12, 15 and 17 of the GDPR), Cooperation with supervisory authority (article 31 of the GDPR)
- Decision: Infringement of the GDPR, Administrative fine, Order to comply with periodic penalty payments
- Key words: Facial recognition
Summary of the Decision
Origin of the case
As of May 2020, the Commission nationale de l'informatique et des libertés, CNIL received complaints from individuals about Clearview AI's facial recognition software and opened an investigation. In May 2021, the association Privacy International also warned the CNIL about this practice.
On 26 November 2021, the Chair of the CNIL decided to give Clearview AI formal notice to cease the collection and use of data of persons on French territory in the absence of a legal basis to to facilitate the exercise of individuals' rights and to comply with their requests for erasure. Clearview AI had two months to comply with the injunctions formulated in the formal notice and to justify them to the CNIL. However, it did not provide any response to this formal notice.
The Chair of the CNIL therefore decided to refer the matter to the restricted committee, which is in charge for issuing sanctions.
Key Findings
- Unlawful processing of personal data (breach of article 6 of the GDPR)
- Individuals' rights not respected (articles 12, 15 and 17 of the GDPR)
- Lack of cooperation with the CNIL (Article 31 of the RGPD)
Decision
On the basis of the information brought to its attention, the restricted committee decided to impose a maximum financial penalty of 20 million euros, according to article 83 of the GDPR.
Regarding the very serious risks to the fundamental rights of the data subjects resulting from the processing carried out by the company, the restricted committee decided to order Clearview AI to stop collecting and processing data of individuals residing in France without a legal basis and to delete the data of these persons that it has already collected, within a period of two months. The restricted committee added to this injunction a penalty of 100,000 euros per day of delay beyond these two months.
For further information: national news Reconnaissance faciale : sanction de 20 millions d’euros à l’encontre de CLEARVIEW AI (FR), Facial recognition: 20 million euros penalty against CLEARVIEW AI (EN).
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.