In May 2022 the UK Information Commissioner’s Office fined Clearview AI £7,552,800 and issued an enforcement notice requiring the company to stop collecting and using the personal data of UK residents available publicly on the internet, and to delete what it held. Reporting describes a database built from more than 20 billion images scraped from websites and social media.
The regulator’s findings included using information in a way that was neither fair nor transparent, having no lawful basis for collection, having no process to stop data being retained indefinitely, and failing to meet the higher standard required for biometric data.
No Attacker, No Incident, Still A File
Nothing was compromised. No credential was stolen, no system was misconfigured, and the images were obtained from pages their subjects had made visible.
The corpus opened this category at 22-1020, where analytics code on a patient portal sent health information to marketing vendors exactly as installed. Clearview is the same shape scaled up: harm arising from a system working precisely as intended, by a party the affected person has no relationship with and never heard of.
A Face Is The Identifier That Cannot Be Reissued
This desk files unresettable identifiers at 26-0726 and 22-0922, and argues that identity documents are the category no remedy addresses because they describe a person rather than an account.
A facial template is the limit case. It was not issued by anyone, cannot be revoked, and is presented involuntarily every time its owner appears in a photograph someone else takes. The regulator’s finding about retention — no process to stop data being held indefinitely — is the part of the decision that survives regardless of what happened to the fine.
The Fine Did Not Hold
Clearview appealed and the penalty was overturned, on the basis that the regulator lacked jurisdiction over a foreign company providing services to foreign law enforcement agencies.
The desk records that in the file rather than as a footnote, because it changes what the file is about. We keep finding that remedies are poorly matched to harm — 25-1031, 26-0721b, the four dollars a head at 22-1020. This is a further mode: a remedy that fitted the harm and did not reach the party, because the data crossed a border the enforcement power did not.
Compiled from the ICO’s published decision and contemporaneous reporting, together with reporting of the subsequent appeal, listed below. The overturning of the penalty on appeal, on jurisdictional grounds, is as reported; this desk has not read the tribunal judgment and does not characterise its reasoning beyond that. Enforcement action by other national regulators against the same company is outside the scope of this file. No individual is named. Graded high on the decision and its reversal. Corrections: corrections@forensicpost.com.
- ICO fines facial recognition database company Clearview AI Inc more than £7.5m and orders UK data to be deletedInformation Commissioner’s Office
- Facial Recognition Firm Clearview AI Fined $9.4 Million by UK RegulatorSecurityWeek
- Clearview AI wins appeal to overturn $10 million UK privacy fineThe Record