Facial recognition technology (“FRT”) has attracted a fair amount of attention over the years, including in the EU (e.g., see our posts on the European Parliament vote and CNIL guidance), the UK (e.g., ICO opinion and High Court decision) and the U.S. (e.g., Washington state and NTIA guidelines). This post summarizes two recent developments in this space: (i) the UK Information Commissioner’s Office (“ICO”)’s announcement of a £7.5-million fine and enforcement notice against Clearview AI (“Clearview”), and (ii) the EDPB’s release of draft guidelines on the use of FRT in law enforcement.

I. ICO Fines Clearview AI £7.5m

In the past year, Clearview has been subject to investigations into its data processing activities by the French and Italian authorities, and a joint investigation by the ICO and the Australian Information Commissioner. All four regulators held that Clearview’s processing of biometric data scraped from over 20 billion facial images from across the internet, including from social media sites, breached data protection laws.

On 26 May 2022, the ICO released its monetary penalty notice and enforcement notice against Clearview. The ICO concluded that Clearview’s activities infringed a number of the GDPR and UK GDPR’s provisions, including:

  • Failing to process data in a way that is fair and transparent under Article 5(1)(a) GDPR. The ICO concluded that people were not made aware or would not reasonably expect their images to be scraped, added to a worldwide database, and made available to a wide range of customers for the purpose of matching images on the company’s database.
  • Failing to process data in a way that is lawful under the GDPR. The ICO ruled that Clearview’s processing did not meet any of the conditions for lawful processing set out in Article 6, nor, for biometric data, in Article 9(2) GDPR.
  • Failing to have a data retention policy and thus being unable to ensure that personal data are not retained for longer than necessary under Article 5(1)(e) GDPR. There was no indication as to when (or whether) any images are ever removed from Clearview’s database.
  • Failing to provide data subjects with the necessary information under Article 14 GDPR. According to the ICO’s investigation, the only way in which data subjects could obtain that information was by contacting Clearview and directly requesting it.
  • Impeding the exercise of data subject rights under Articles 15, 16, 17, 21 and 22 GDPR. In order to exercise these rights, data subjects needed to provide Clearview with additional personal data, by providing a photograph of themselves that can be matched against the Clearview Database.
  • Failing to conduct a Data Protection Impact Assessment (“DPIA”) under Article 35 GDPR. The ICO found that Clearview failed at any time to conduct a DPIA in respect of its processing of the personal data of UK residents.

The ICO decided to fine Clearview £7.5 million, in contrast to the £17 million fine initially suggested. The monetary penalty notice sets out the ICO’s reasoning behind the fine. As Clearview did not provide any figures for its income or turnover, the ICO was unable to calculate Clearview’s financial gain from the activities in question, which would ordinarily serve as a step in calculating the fine amount. The ICO had regard to the range of penalties available to it, and set an initial amount at just below the mid-point of this range, amounting to £7,552,800. The ICO then considered the other statutory factors, and did not consider that any of these justified either an increase or a reduction from the initial starting point. This included consideration of certain representations made by Clearview that it had acted on requests from UK data subjects to exclude their images from future searches.

Although Clearview no longer offers its services to UK organisations, due to the perceived risk of data concerning UK residents being used in the company’s offerings elsewhere, the ICO ordered Clearview to take the following steps in addition to paying the £7.5 million fine:

  • Deleting the personal data of UK residents from its systems, within six months of the expiry of the appeal period.
  • Refraining from any further processing of the personal data of data subjects resident in the UK, within three months following the date of the expiry of the appeal period.
  • Refraining from offering any service provided by way of its database to any UK customer.
  • Refraining from doing anything in the future that would fall under the above points without first drafting a DPIA, and providing this to the ICO.

The ICO imposed a similar deletion order on HMRC in 2019, in which it gave the tax authority 28 days to delete all biometric voice data for which it did not have explicit consent to process.

II. EDPB Publishes New Draft Guidelines on the Use of FRT in Law Enforcement

On 12 May 2022, the EDPB adopted draft guidelines providing guidance to law makers and law enforcement authorities (“LEAs”) on implementing and using FRT systems. The guidelines provide that FRT should only be used in compliance with the Law Enforcement Directive (“LED”) and only in a necessary and proportionate manner, as set out in the Charter of Fundamental Rights. The EDPB’s draft guidelines are currently open for public consultation until 27 June. If adopted, they will impact the requests for data, software, and other technology that the EU and LEAs can make of private companies.

The EDPB makes several references to processing of personal data in a law enforcement context that relies on databases, similar to Clearview’s, populated by “scraping” photographs accessible online on a mass scale, including calling for a ban on LEAs’ use of such databases. The EDPB notes that when assessing whether processing relates to data which are “manifestly made public by the data subject” (a lawful ground for processing biometric data under Article 10 LED), the fact that a photograph is “manifestly made public” does not mean that the related biometric data which can be retrieved from the photograph using FRT tools has also been “manifestly made public”. For biometric data to be seen as “manifestly made public,” the data subject must have deliberately made their biometric data freely accessible and public through an open source. Further, the EDPB notes that default settings of a service (e.g., if data is made public by default on a social networking platform) should not be construed as data “manifestly made public.”

The guidelines repeat the EDPB’s prior call for a ban on the use of FRT in certain cases, specifically:

  • Remote biometric identification of individuals in publicly accessible spaces;
  • ­FRT categorizing individuals based on their biometrics into clusters according to ethnicity, gender, as well as political or sexual orientation or other grounds for discrimination;
  • ­FRT to infer emotions of a natural person; and
  • As described above, processing of personal data in a law enforcement context that relies on a database populated by the collection of personal data on a mass-scale and in an indiscriminate way.

The EU is also currently debating whether to prohibit certain forms of “real time” remote biometric identification systems in the context of its proposal for a Regulation laying down harmonized rules on artificial intelligence (the “EU AI Act”) (see our blog here for further details). The EDPB and the European Data Protection Supervisor published a Joint Opinion on the EU AI Act last year.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.
Marianna Drake

Marianna Drake is an associate in the technology regulatory group in the London office. Her practice focuses on European data protection law and new policies and legislation relating to innovative technologies such as artificial intelligence and online platforms. Her practice encompasses regulatory compliance…

Marianna Drake is an associate in the technology regulatory group in the London office. Her practice focuses on European data protection law and new policies and legislation relating to innovative technologies such as artificial intelligence and online platforms. Her practice encompasses regulatory compliance and advisory work. Marianna also advises clients on policy developments in online content and online safety.

Photo of Sam Jungyun Choi Sam Jungyun Choi

Sam Jungyun Choi is an associate in the technology regulatory group in the London office. Her practice focuses on European data protection law and new policies and legislation relating to innovative technologies such as artificial intelligence, online platforms, digital health products and autonomous…

Sam Jungyun Choi is an associate in the technology regulatory group in the London office. Her practice focuses on European data protection law and new policies and legislation relating to innovative technologies such as artificial intelligence, online platforms, digital health products and autonomous vehicles. She also advises clients on matters relating to children’s privacy and policy initiatives relating to online safety.

Sam advises leading technology, software and life sciences companies on a wide range of matters relating to data protection and cybersecurity issues. Her work in this area has involved advising global companies on compliance with European data protection legislation, such as the General Data Protection Regulation (GDPR), the UK Data Protection Act, the ePrivacy Directive, and related EU and global legislation. She also advises on a variety of policy developments in Europe, including providing strategic advice on EU and national initiatives relating to artificial intelligence, data sharing, digital health, and online platforms.

Photo of Fredericka Argent Fredericka Argent

Fredericka Argent advises emerging and leading companies on intellectual property and data protection issues, including copyright, trademarks, e-commerce and piracy.  She has experience advising companies in the technology, pharmaceutical, luxury brands and media sectors.  Her practice encompasses regulatory compliance and advisory work. She…

Fredericka Argent advises emerging and leading companies on intellectual property and data protection issues, including copyright, trademarks, e-commerce and piracy.  She has experience advising companies in the technology, pharmaceutical, luxury brands and media sectors.  Her practice encompasses regulatory compliance and advisory work. She regularly provides strategic advice to global companies on complying with data protection laws in Europe.  Ms. Argent has experience conducting IP enforcement.  She represents right owners, including in the publishing and fashion industries, and helps coordinate an in-house internet investigations team who conduct global monitoring, reporting, notice and takedown programs to combat Internet piracy.