Zut alors! Raclage crapuleux! Clearview AI in 20% more trouble in France

Here’s how the French data protection regulator describes controversial facial recognition service Clearview AI, in its own words, in clear and plain English:

CLEARVIEW AI collects photographs from a wide range of websites, including social networks, and sells access to its database of images of people through a search engine in which an individual can be searched using a photograph. The company offers this service to law enforcement authorities. Facial recognition technology is used to query the search engine and find an individual based on [their] photograph.

The French regulator we are referring to here is officially known as the CNIL, short for Commission Nationale de l’Informatique et des Libertés, a phrase that needs no translation, even though English is, historically at least, a Germanic and not a Romance language.

Back in October 2022, we reported that CNIL had fined Clearview AI €20,000,000 for deploying its image scraping technology in France, arguing (convicingly, in our opinion) that constructing data templates for recognising individials amounted to collecting biomnetric data, and that biometric data of this sort is unarguably PII, or personally identifiable information:

Facial recognition technology is used to query the search engine and find a person based on their photograph. In order to do so, the company builds a “biometric template”, i.e. a digital representation of a person’s physical characteristics (the face in this case). These biometric data are particularly sensitive, especially because they are linked to our physical identity (what we are) and enable us to identify ourselves in a unique way.

The vast majority of people whose images are collected into the search engine are unaware of this feature.

No consent, no fair, concluded CNIL.

Not just collection, but concealment, too

Worse still, CNIL castigated Clearview for trying to cling onto the very data it shouldn’t have collected in the first place.

The regulator ruled that Clearview made it unacceptably difficult for French people to exercise their rights not only to request full details of PII collected about them, but also to have any or all of that data deleted if they wanted.

CNIL determined that Clearview placed artificial restrictions on letting individuals get at their own data, including: by refusing to delete data collected more than a year earlier; by allowing people to request their data only twice a year; and by “only responding to certain requests after an excessive number of requests from the same person.”

CNIL even summarised these problems in a neat, English-language infographic:

Penalties added to penalty

As well as ordering Clearview to delete all existing data on Frech residents, and to stop collecting data in future, CNIL noted back in 2022 that it had already tried to engage with the face-scraping company but had been ignored, and had therefore run out of patience:

Following a formal notice which remained unaddressed, the CNIL imposed a penalty of 20 million Euros and ordered CLEARVIEW AI to stop collecting and using data on individuals in France without a legal basis and to delete the data already collected.

Apparently, Clearview has still made no effort to comply with the French regulator’s ruling, and the regulator has yet again decided it has had enough.

Last week, CNIL invoked a “thou shalt not ignore us this time” clause in its previous settlement, allowing for fines of up to €100,000 for every day that the company refsed to comply, stating that:

CLEARVIEW AI had two months to comply with the order and justify compliance to the CNIL. However, the company did not send any proof of compliance within this time limit.

On 13 April 2023, [CNIL] considered that the company had not complied with the order and consequently imposed an overdue penalty payment of €5,200,000.

What next?

We can’t help but wonder what’s going to happen next.

If you were {Queen, King, President, Supreme Wizard, Glorious Leader, Chief Judge, Lead Arbiter, High Commissioner of Privacy}, and could fix this issue with a {wave of your wand, stroke of your pen, shake of your sceptre, Jedi mind-trick}…

…how would you resolve this stand-off?