France Fines Clearview AI Maximum Possible For GDPR Breaches And a New ECOVIS Monthly GDPR Fines Review Initiative

France’s CNIL became the fourth data protection authority (DPA) this year to fine U.S.-based Clearview AI over its controversial facial image aggregation practices. French DPA issued a EUR 20,000,000 fine to the controversial American facial recognition firm.

The fine was also issued by the Italian DPA in February, Greek DPA in July and a fine was issued by the UK’s Information Commissioners Office in May of 2022.

Insights into Clearview Al Inc.

Clearview AI Inc. is a facial recognition platform holding a database of more than 20 billion facial images from around the world. Data collected from publicly accessible platforms such as social media networks is then used for identification purposes. Additionally, the data from may also be enriched with other associated information such as image tags and geolocation.

What were the violations?

The findings made by the French DPA are similar to those established by other DPA’s, mainly that the company:

• lacked a legal basis for processing the data;
• restricted data subjects’ rights and, often, failed to exercise them properly;
• lacked cooperation during the investigation.

What can we learn from this?

There are several things to be taken into account when reviewing this fine, most notably:

• the obligation to have a legal basis foreseen in Art. 6 of GDPR must be available for all processing activities;
• data controllers and processors must recognise what data subjects’ rights and requests are and act on them accordingly.

You can learn more about Clearview AI Inc. fine and other relevant fines issued in the month of October by joining the new initiative introduced by the Data Protection experts of ECOVIS ProventusLaw. The monthly and free review of the most relevant GDPR fines aims to introduce and analyse real-life examples of GDPR violations and provide advice on how to avoid making similar mistakes. You can begin listening to the free course here.

The content of this article is intended to provide a general guide to the subject matter. If you need assistance regarding the specific situation related with GDPR compliance, or any other question related to personal data protection, please consult the experts of ECOVIS ProventusLaw.

This review was prepared by internationally certified ECOVIS ProventusLaw data protection expert Milda Šlekytė and junior associate Julija Ginotytė