The UK’s data protection watchdog has fined controversial facial recognition company Clearview AI £7.5m, for multiple data privacy law breaches.

The Information Commissioner’s Office (ICO) has also ordered Clearview AI to stop obtaining and using the personal data of UK residents and to delete any existing UK data from its growing database.

Clearview AI, which describes itself as “the world’s largest facial network”, has built a database that – according to the ICO – currently holds more than 20bn images of people’s faces. The US-based company collects these images from publicly available sites on the internet such as social media platforms.

The company works with customers such as law enforcement agencies to compare facial data against its database.

In February this year, Clearview AI said its database had 10bn “publicly available facial images” taken from the web. By that point, the company said its database was the “largest known of its kind in its industry”.

One of the main issues the ICO has with Clearview AI’s practices is that the information of UK residents was collected without their consent or knowledge.

“The company not only enables identification of those people, but effectively monitors their behaviour and offers it as a commercial service,” UK information commissioner John Edwards said in a statement yesterday (23 May). “That is unacceptable.

“People expect that their personal information will be respected, regardless of where in the world their data is being used. That is why global companies need international enforcement,” Edwards said.

The ICO said Clearview AI breached UK data laws by failing to have a lawful reason for collecting the data, not having a process to stop the data being retained indefinitely and not meeting GDPR standards. The watchdog said Clearview AI also asked for additional personal information, including photos, when asked by members of the public if they are on the company’s database.

“This may have acted as a disincentive to individuals who wish to object to their data being collected and used,” the ICO said.

The fine is considerably lower than the £17m fine the company was facing, when the ICO announced its provisional intent to impose a fine on Clearview AI last November.

Regulatory pressure

In February, Clearview AI reportedly told investors it is on track to have 100bn facial photos in its database within a year. This would be enough to identify “almost everyone in the world”, according to company documents obtained by The Washington Post.

While Clearview AI has ambitious goals for expanding its services, it has been facing stiff criticism and pressure from watchdogs around the world.

In 2020, the American Civil Liberties Union (ACLU) of Illnois filed a lawsuit against the company, alleging it violated the privacy rights of citizens. The ACLU said the case was filed after a New York Times investigation revealed details of the company’s tracking and surveillance tools.

That lawsuit reached a settlement on 9 May this year, when Clearview AI agreed to a new set of restrictions. According to the ACLU, this includes a permanent ban in the US from making its faceprint database available to most businesses and other private entities.

Last November, Australia’s top information authority ordered Clearview AI to stop collecting facial images and biometric templates of Australian citizens, and to delete what data it already has.

In February 2021, Canada’s federal privacy commissioner deemed the company’s practices illegal, saying it collected facial images of Canadians without their consent.

Dr Kris Shrishak of the Irish Council for Civil Liberties recently told SiliconRepublic.com that it is difficult for regulators to enforce rulings against Clearview AI as it is headquartered in the US and does not appear to have offices in other countries. He said it would be easier to have “enforcement teeth” if a US authority introduced laws cracking down on the technology.

In recent years, concerns have been raised about facial recognition technology in terms of surveillance, privacy, consent, accuracy and bias.

Last year, EU proposals for regulating AI were met with criticism by EU watchdogs for not going far enough when it comes to live facial recognition in public places. The European Parliament then called for a ban on biometric mass surveillance technologies, such as facial recognition tools, citing the threat these technologies can present to human rights.

Facebook parent company Meta announced last November that it will delete face recognition data from more than 1bn users collected over a decade, and those who opted in for the face recognition feature will no longer be automatically recognised in photos and videos on the platform.

In July 2020, IBM said it would scrap its facial recognition and analysis software, saying it opposed the use of technology for mass surveillance or racial profiling.

10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.

The post UK fines Clearview AI £7.5m for breaching facial recognition data laws appeared first on Silicon Republic.