Fine in the amount of EUR 20 million applied by Italian Data Protection Authority to Clearview AI for illegal personal data processing

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 20 million applied by Italian Data Protection Authority (SA) to Clearview AI for illegal personal data processing.

The Italian SA launched an own volition proceeding following press reports on several issues in connection with facial recognition products which were offered by the Clearview AI Inc. Moreover, the Italian SA received, during 2021, four complaints and two alerts by two organizations that are active in the field of protecting privacy and the fundamental rights of individuals against Clearview.

The inquiries and assessment by the Italian SA found several infringements by Clearview AI: the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis, since the legitimate interest of the US-based company does not qualify as such; the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation; it failed to provide the information set out by Article 13-14, to provide information on an action taken on a request under Article 15 within the due timeframe, and to designate a representative in the EU.

In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on further processing of the standard and biometric data that are handled by the Company via its facial recognition system. Furthermore, ordered erasure of the data, including biometric data, processed by its facial recognition system and designation of a representative in the territory of the European Union.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.