Administrative fine of €30.5 million imposed by Dutch Supervisory Authority on Clearview following unlawful collection of personal data for facial recognition

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 30.5 million euro imposed by the Dutch Supervisory Authority (SA) on Clearview for violation of Article 6 Lawfulness of processing, Article 9 Processing of special categories of personal data, Article 12 Transparent  information, communication and modalities for the exercise of the rights of the data subject, Article 14 Information to be provided where personal data have not been obtained from the data subject, Article 15 Right to access by the data subject, Article 27 Representatives of controllers not established in the Union and Article 84 Penalties.

Clearview is an American company that offers facial recognition services. Customers of Clearview can provide camera images to find out the identity of people shown in the images. For this purpose, Clearview has a database of more than 30 billion photos of people. The company automatically collects these photos from the internet and then converts them into a unique biometric code for each face without the person’s knowledge or consent.

As a result of its investigations, the Dutch SA finds that for the purpose of their ‘Clearview for law-enforcement and public defenders’ service, Clearview processes, without a legal basis to do so, personal data of data subjects who are within the territory of the Netherlands. In doing so, Clearview violates Article 5(1), opening words and subsection (a) of the GDPR, read in conjunction with Article 6(1) GDPR. Clearview also infringes Article 9(1) of the GDPR by processing a special category of personal data (biometric data) of data subjects located in the Netherlands. 

The Dutch SA has determined that Clearview does not adequately inform data subjects, acting in this case contrary to Article 12(1) in conjunction with Article 14(1) and (2) and contrary to Article 5(1)(a) of the GDPR. 

Last but not least, violated Article 12(3) GDPR, read in conjunction with Article 15 GDPR by not responding to two access requests by data subjects. And fifth of all, since Clearview does not facilitate data subjects within the territory of the Netherlands in exercising their right of access, they violate Article 12(2) GDPR, read in conjunction with Article 15 GDPR. The fact that Clearview has not designated a representative in the European Union within the meaning of Article 4, paragraph 17 GDPR, although they are obliged to do so pursuant to Article 27(1) GDPR, also constitutes a violation of the GDPR.

In this context, the Dutch SA has imposed on Clearview an administrative fine of €30.5 million and four measures subject to a penalty for non-compliance, which relate to the cessation of the infringements still in progress. If Clearview fails to do so, the company will have to pay non-compliance penalties totaling up to a maximum of €5.1 million in addition to the fine.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.