“People who are in the database also have the right to access their data,” the Dutch DPA said. “This means that Clearview has to show people which data the company has about them, if they ask for this. But Clearview does not cooperate in requests for access.”
Dutch DPA vows to investigate Clearview AI execs
In the press release, Wolfsen said that the Dutch DPA has “to draw a very clear line” underscoring the “incorrect use of this sort of technology” after Clearview AI refused to change its data collection practices following fines in other parts of the European Union, including Italy and Greece.
While Wolfsen acknowledged that Clearview AI could be used to enhance police investigations, he said that the technology would be more appropriate if it was being managed by law enforcement “in highly exceptional cases only” and not indiscriminately by a private company.
“The company should never have built the database and is insufficiently transparent,” the Dutch DPA said.
Although Clearview AI appears ready to defend against the fine, the Dutch DPA said that the company failed to object to the decision within the provided six-week timeframe and therefore cannot appeal the decision.
Further, the Dutch DPA confirmed that authorities are “looking for ways to make sure that Clearview stops the violations” beyond the fines, including by “investigating if the directors of the company can be held personally responsible for the violations.”
Wolfsen claimed that such “liability already exists if directors know that the GDPR is being violated, have the authority to stop that, but omit to do so, and in this way consciously accept those violations.”
Clearview AI ended “voluntary” GDPR compliance
Clearview AI allows some Internet users to opt out of its face image search engine, including facilitating deletion requests for people shielded by data privacy laws in California, Virginia, and Illinois. And this used to be true for EU users, too. In the Dutch DPA’s decision, Clearview AI is quoted saying that the company previously “voluntarily” processed data requests from people in the EU but “terminated that practice.”
