Skip to content
Submit incident
AII-1002-43991
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Dutch DPA Fines Clearview AI €30.5 Million for Illegal Biometric Data Collection

The Dutch Data Protection Authority fined Clearview AI €30.5 million for building an illegal facial recognition database by scraping billions of photos from the internet without user consent and converting them to biometric codes. The watchdog also imposed an additional compliance order and stated the practice violates GDPR and Dutch data protection regulations.

3 September 2024 · Clearview AI · Privacy and surveillance
3 September 2024
AII-1002-439912 sources ↓
Quick facts
Category
Privacy and surveillance
Country
Netherlands
Source
forbes.com
Date
3 September 2024
Drafted by
Raidu Incident Detection

What happened

The Dutch Data Protection Authority (DPA) fined Clearview AI €30.5 million ($33.7 million) on September 3, 2024, for building an illegal database of billions of faces scraped from social media and the internet.

The watchdog found that Clearview automatically harvested photos without the knowledge or consent of the individuals pictured, then converted them into unique biometric codes per face for use in its facial recognition service sold to law enforcement and intelligence agencies.

Reported impact

According to the DPA, the database affects everyone with a photo on the internet, as they can be tracked and identified without their knowledge or consent through Clearview's services.

Index analysis

The DPA determined that Clearview scraped the data 'without these people knowing…and without them having given consent' for their photo or biometric data to be used, and found the company 'insufficiently transparent.'

The watchdog stated that Clearview 'should never have built the database' and imposed an additional non-compliance order of up to €5 million for failure to stop the practice.

Governance controls

The DPA stated that facial recognition is a highly intrusive technology that should be reserved for 'competent authorities in highly exceptional cases' under strict regulatory guidance, and should not become standard practice.

Clearview cannot appeal the fine as it did not object to the DPA's decision. The company's chief legal officer argued the decision was 'unlawful' and claimed Clearview has no business presence, customers, or activities subject to GDPR in the Netherlands or EU.

Classification

Category
Privacy and surveillance
Country
Netherlands
Harm status
Potential harm
Intent
Intentional
Timing
Post-deployment
Harm types
Human or fundamental rights
Harmed
General public
Failure modes
Training data misuse, Unauthorised scraping
Consequences
Fine or settlement
AI systems
Clearview Facial Recognition Database
Regulations
GDPR (enforcement)

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

forbes.com
Dutch DPA Fines Clearview AI €30.5 Million for Illegal Biometric Data Collection
reuters.com
Dutch DPA Fines Clearview AI €30.5 Million for Illegal Biometric Data Collection