Clearview AI Broke Australian Privacy Law - Data Deletion Ordered

Clearview AI Found to Violate Australian Privacy Laws

Following a similar finding in Canada, Australia has determined that Clearview AI, a facial recognition company, infringed upon national privacy regulations. This occurred through the surreptitious gathering of Australian citizens’ facial biometric data, which was then integrated into its AI-driven identity matching service.

Breaches of the Privacy Act 1988

Australia’s information and privacy commissioner, Angelene Falk, released a statement detailing how Clearview AI’s facial recognition technology violated the country’s Privacy Act 1988. The breaches included:

• Collecting sensitive information from Australians without their explicit consent.
• Employing unfair methods to obtain personal information.
• Failing to adequately inform individuals about the collection of their personal data.
• Not ensuring the accuracy of disclosed personal information, considering its intended use.
• Lacking sufficient practices and systems to comply with the Australian Privacy Principles.

This outcome represents a significant victory for privacy advocates in Australia. The regulator has mandated that Clearview cease collecting facial biometrics and biometric templates from Australian citizens, and furthermore, to destroy all currently held images and templates.

Joint Investigation with the UK

The Office of the Australian Information Commissioner (OAIC) conducted a collaborative investigation with the U.K.’s data protection agency, the Information Commissioner’s Office (ICO).

However, the ICO has not yet publicly announced its conclusions regarding the matter.

ICO’s Deliberations

In a statement, the ICO indicated it is “considering its next steps and any formal regulatory action” appropriate under U.K. data protection laws.

A spokesperson for the ICO declined to provide further details regarding the timeline for a decision.

Concerns have been raised that the U.K. regulator may take an extended period to reach a conclusion, mirroring past delays in addressing issues related to adtech lawfulness.

OAIC’s Swift Action

In contrast, the OAIC is proceeding promptly with enforcement against Clearview, demonstrating a firm stance.

Falk emphasized the intrusive and unfair nature of the covert collection of sensitive biometric information, highlighting the potential for harm, particularly to vulnerable groups like children and crime victims.

She also noted the irreversible nature of biometric data and the risk of misidentification and identity theft. Falk stated that these practices do not align with the expectations of Australians regarding the protection of their personal information.

Disproportionate Impact

The OAIC determined that the privacy impacts of Clearview AI’s system were not justified by any public interest benefits.

Falk explained that individuals using social media or professional networking sites do not anticipate their facial images being collected without consent for unrelated identification purposes.

The indiscriminate collection of facial images, even from individuals not connected to law enforcement investigations, could negatively impact the personal freedoms of all Australians who may feel under surveillance.

Trials with Australian Police

Between October 2019 and March 2020, Clearview AI provided trial access to its tool to several Australian police forces, who subsequently used it to search for individuals located within Australia.

The OAIC is currently finalizing an investigation into the Australian Federal Police’s trial use of the technology to assess compliance with privacy risk mitigation requirements.

International Scrutiny

Sweden’s data protection authority previously issued a €250,000 fine to its police force for unlawful use of Clearview’s tool.

Clearview’s Defense Rejected

Clearview argued that the information it processed was not personal data and that, as a U.S.-based company, it was not subject to Australian jurisdiction. The company also claimed to have ceased offering services to Australian law enforcement following the start of the OAIC’s investigation.

However, Falk rejected these arguments, affirming Clearview’s obligation to comply with Australian law and confirming that the information handled constituted personal data under the Privacy Act.

Call for Stronger Privacy Protections

The case underscores the need for Australia to strengthen its privacy protections, including restricting or prohibiting data scraping from online platforms. Falk also raised concerns about the responsibility of online platforms to prevent and detect the scraping of personal data.

Falk stated that Clearview AI’s activities involve the large-scale, automated collection of sensitive biometric information for profit. She also pointed to the company’s patent application, which demonstrates the technology’s potential for uses beyond law enforcement, such as dating, retail, and access control.

Clearview AI has been contacted for a response to the OAIC’s decision and has confirmed its intention to appeal.

Further Legal Challenges and Meta’s Response

Clearview AI has faced legal challenges in the U.S., particularly under Illinois’ Biometric Information Privacy Act. Minneapolis recently banned the use of facial recognition software by its police department, effectively prohibiting the use of tools like Clearview.

The controversy surrounding Clearview AI’s data collection practices may have influenced Meta’s recent announcement to delete its own facial biometric data, citing “growing concerns about the use of the technology as a whole”.

Update: Clearview’s founder, Hoan Ton-That, has issued a personal response to the OAIC’s decision, expressing disappointment and arguing that the privacy commissioner’s decision misinterprets the value of his “crime fighting” technology to society.