A US-based company has been ordered to delete all the personal data they have collected from UK citizens. Clearview AI were also ordered to pay a fine of £7.5 million for harvesting photos and images from social media sites without permission.
The ruling by the Information Commissioner’s Office (ICO), the UK’s data protection regulator is the fourth such judgement against Clearview AI. The UK joins France, Italy and Australia in fining the company, after deciding their image collection practices violate local data protection laws.
What is the problem?
Clearview AI offers facial recognition technology for use by businesses and law enforcement agencies across the world. The concern is that these systems use a database of images that have been collected from Facebook, Instagram and other social media websites without the owner’s knowledge or permission.
The collection process, known as ‘scraping’, is highly controversial. All of the images are publicly accessible and viewable – however, businesses are not legally allowed to collect and use those pictures without first obtaining permission from the owner.
What were the images used for?
Clearview AI provides their customers with artificial intelligence-powered image matching technology. Using Clearview AI’s database of 20 billion photographs, customers can compare images they have collected, such as CCTV footage, to identify specific people.
The system is reportedly very effective – previous customers from the UK include the Metropolitan Police, the Ministry of Defence and the National Crime Agency. Less clear is which private firms have been using the data.
In the US, Clearview has already agreed that they will restrict sales of their service so it is only available to federal agencies and police departments. However, the service is still available for general sale to almost any business elsewhere in the world – so the collected images can still be used without permission.
What happens next?
The ICO has given Clearview 28 days to appeal the ruling. They then have six months to delete all data belonging to UK residents.
It remains unclear how the ICO intends to enforce their judgement however. Clearview AI – and their technology – is based in the US, outside the jurisdiction of the courts. There are also questions as to how Clearview can distinguish between data belonging to UK residents and those of other individuals.
Clearview have been clear in their response – they have confirmed their business operates outside UK jurisdiction and that they no longer do business with British companies. As such, they have declined to comply with the ICO ruling and will continue to sell access to UK citizens’ data elsewhere in the world.
Clearly there is no simple answer to this situation at the moment. Until a global agreement on personal data protection can be organized, companies like Clearview AI will be able to use (and potentially misuse) personal images for profit.
Panda Security specializes in the development of endpoint security products and is part of the WatchGuard portfolio of IT security solutions. Initially focused on the development of antivirus software, the company has since expanded its line of business to advanced cyber-security services with technology for preventing cyber-crime.
Panda Free Antivitus
FREE TECHNICAL SUPPORT
