The French data protection authority (CNIL) has issued a decision on Clearview AI, Inc. a company offering biometric identification services, to stop collecting and using the data. The CNIL also obliged it to comply with the demands of individuals who have filed complaints against the company.
Clearview AI collects images from a number of websites, including social media, and then offers access to its image database in the form of a search engine where people can be searched for using photographs. The company makes its database available not only to individuals, but also to law enforcement agencies, universities, government agencies and businesses.
The CNIL said that Clearview AI acquires data without a proper legal basis. Moreover, their collection is indiscriminate and may significantly affect the rights and freedoms of individuals whose images are obtained by the company. Individuals whose images were included in the Clearview AI database have had difficulty exercising their rights in relation to the processing of their personal data. The company, without any justification and without legal basis, limited the possibility of exercising the right of access to the data to 2 times in 12 months. Applicants received answers to their questions or concerns only after submitting several or even several requests on the same issue – individual requests for access to data often went unanswered.
Consequently, the CNIL ordered the controller to allow data subjects to exercise their rights and to comply with requests for erasure.