Clearview AI’s biometric photo database deemed illegal in the EU, but only partial deletion ordered

“Right to your face”. A Hamburg resident and member of the <a style="cursor: pointer; box-sizing: border-box; color: rgb(0, 0, 0); letter-spacing: 0.05rem; text-decoration: none; background-image: linear-gradient(rgb(156, 10, 125) 0px, rgb(156, 10, 125) 100%); background-size: 100% 0.1rem; animation: link-loading 0.8s; transition: 0.8s cubic-bezier(0.2, 0, 0.05, 1); overflow-wrap: break-word; background-position: 0px 100%; background-repeat: no-repeat no-repeat;" href="https://www.ccc.de/en/">Chaos Computer Club , Matthias Marx, discovered that Clearview AI, a face-tracking company based in the US, had added his biometric profile to their searchable database without his knowledge. The Clearview AI system can be used track and find persons in CCTV footage, pictures and alike - leading to an Orwellian surveillance system. Database access was sold to private companies and is now sold to U.S. law enforcement.The database is claimed to have over 3 billion images, partly gathered from sources like websites and social media and generally without the affected people knowing.

Mr. Marx submitted a complaint to the Hamburg Data Protection Authority (DPA) asking for the deletion of his pictures and the mathematical hash values representing the biometric profile. Following an investigation that lasted over 11 months with submissions by noyb , the Hamburg DPA today affirmed the right of every EU resident to not end up in Clearview AI’s database. The DPA however only ordered Clearview AI to delete the mathematical hash values representing the biometric profile and to confirm the deletion. There was no order made in relation to the captured pictures of Mr Marx. Clearview AI is being given the opportunity to comment on the order, which must be implemented by February 12, 2021.

“ Imagine a world where every time you are caught on video camera, systems don’t just have your picture, but can directly identify you. That’s horrifying. ” - Alan Dahi, privacy lawyer at noyb.eu

Clearview AI has to comply with the GDPR. The GDPR applies to anyone that processes personal data on the European market. Even though Clearview AI is based solely in the US, the GDPR applies to their activities affecting European residents - for example when collecting pictures of Europeans. While Clearview AI denied that EU law applies to it, the Hamburg DPA claifies that is has jurisdiction and issued a decision.

“ If a US company’s actions affect Europeans, the company needs to play by European rules. It’s like an American tourist driving on the German Autobahn - they need to follow local rules." - Alan Dahi, privacy lawyer at noyb.eu

Hamburg DPA did not issue pan-European order. Unfortunately, the Hamburg DPA issued a narrow order protecting only the individual complainant instead of an order banning the collection of any European resident’s photos, as noyb had argued for. Any European DPA has the right to issue general orders that go beyond the individual complaint. Lacking such a general order, every European would have to submit their own complaint against Clearview AI in order to not be included in the search results of their biometric database. Not only is this inefficient, it is also an unnecessary burden for Europeans who must actively take steps to have their profile removed from Clearview AI’s biometric database, even though the collection of such data is already illegal from the get go. Moreover, the Hamburg DPA failed to order the deletion of Mr. Marx’s photos and limited the decision to the mathematical hash values representing the biometric profile of Mr Marx.

“This surveillance machine is terrifying. Almost one year after my initial complaint, Clearview AI doesn't even have to delete the pictures that show me. And even worse, every individual must submit their own complaint. This shows that our data is not yet sufficiently protected and that there is a need for action against biometric surveillance.” - Matthias Marx, complainant

What you can do? We encourage everyone to ask Clearview AI for a copy of their data, to delete any data Clearview AI has on them, and to object to being included in Clearview AI’s database. <a style="cursor: pointer; box-sizing: border-box; color: rgb(0, 0, 0); letter-spacing: 0.05rem; text-decoration: none; background-image: linear-gradient(rgb(156, 10, 125) 0px, rgb(156, 10, 125) 100%); background-size: 100% 0.1rem; animation: link-loading 0.8s; transition: 0.8s cubic-bezier(0.2, 0, 0.05, 1); overflow-wrap: break-word; background-position: 0px 100%; background-repeat: no-repeat no-repeat;" href="https://clearview.ai/privacy/requests">The forms to do so are available on Clearview AI’s website . You should also submit a complaint against Clearview AI with your local data protection authority if you are in Clearview AI’s database.

Next Steps. Clearview AI will have until February 12 until the order is effective. Clearview AI and the complainant has the right to an appeal. noyb is reviewing such an option, to ensure that all the rights of the data subject are upheld and his pictures are equally deleted, not just the mathematical hash values.

<a style="cursor: pointer; box-sizing: border-box; display: block; height: 25px; color: rgb(255, 255, 255); background-size: auto 50%; text-decoration: none; min-width: 25px; background-image: url("https://noyb.eu/themes/ao_canvas/images/icons/services/icon-twitter.svg"); background-color: rgb(38, 196, 241); background-position: left 10px center; background-repeat: no-repeat no-repeat;" aria-label="Share on Twitter" role="button">tweet <a style="cursor: pointer; box-sizing: border-box; display: block; height: 25px; color: rgb(255, 255, 255); background-size: auto 50%; text-decoration: none; min-width: 25px; background-image: url("https://noyb.eu/themes/ao_canvas/images/icons/services/icon-facebook.svg"); background-color: rgb(48, 97, 153); background-position: left 10px center; background-repeat: no-repeat no-repeat;" aria-label="Share on Facebook" role="button">share <a style="cursor: pointer; box-sizing: border-box; display: block; height: 25px; color: rgb(255, 255, 255); background-size: auto 50%; text-decoration: none; min-width: 25px; background-image: url("https://noyb.eu/themes/ao_canvas/images/icons/services/icon-whatsapp.svg"); background-color: rgb(67, 216, 84); background-position: left 10px center; background-repeat: no-repeat no-repeat;" aria-label="Share on Whatsapp" role="button">share <a style="cursor: pointer; box-sizing: border-box; display: block; height: 25px; color: rgb(255, 255, 255); background-size: auto 50%; text-decoration: none; min-width: 25px; background-image: url("https://noyb.eu/themes/ao_canvas/images/icons/services/icon-diaspora.svg"); background-color: rgb(187, 187, 187); background-position: left 10px center; background-repeat: no-repeat no-repeat;" aria-label="Share on diaspora*" role="button">share <a style="cursor: pointer; box-sizing: border-box; display: block; height: 25px; color: rgb(255, 255, 255); background-size: auto 50%; text-decoration: none; min-width: 25px; background-image: url("https://noyb.eu/themes/ao_canvas/images/icons/services/icon-mail.svg"); background-color: rgb(156, 10, 125); background-position: left 10px center; background-repeat: no-repeat no-repeat;" aria-label="Send by email" role="button">mail