DPA case 3394/171/21 – Violation Found (Finland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish Central Criminal Police was found to have tested a facial recognition software called Clearview AI without proper oversight. They initially denied using the software but later admitted to testing it during a free trial. This case raises questions about how law enforcement uses technology and the need for transparency.
What happened
The Finnish police tested Clearview AI facial recognition software during a free trial without proper authorization.
Who was affected
Members of the Finnish Central Criminal Police who used the facial recognition software.
What the authority found
The Finnish DPA found that the police had processed personal data without proper oversight during the trial period.
Why this matters
This case highlights the need for law enforcement agencies to be transparent about their use of technology. Companies providing such software should ensure that their clients comply with data protection laws.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On March 31, 2021, the Finish Central Criminal Police (CCP) received an inquiry from the US online publication Buzzfeed News as to whether the Finnish police had used an application called Clearview AI (a facial recognition software). The CCP first answered in the negative, following which Buzzfeed News revealed that they were aware of about 120 searches made by the CPP in 2020 using Clearview AI. Buzzfeed News also specified that many authorities around the world had unofficially conducted searches via Clearview AI during the free trial period, and that those searches may thus not have come to the attention of the CPP. On April 7, 2021, the Police Board and the CPP began to investigate the matter. Following this investigation, it was found that some members of the CPP had indeed tested Clearview AI during the free trial period, together with the National Center for Missing and Exploited Children (NCMEC). In particular, the purpose was to test the suitability of the software for protecting children against the dissemination of pedopornographic material. During that testing phase, those members of the CPP screened the internet for pedoporographoc content matching the profile picture of potential Finnish victims. The profile pictures of potential victims had primarily been collected from social media by the NCMEC. During the experiment, one match between some pedopornographic material and the profile picture of a Finish minor was found. The matter was referred to the social authorities. Consequently, personal data have been processed for criminal law purposes during that period by relying on Clearview AI. The trial period was discontinued in early 2020. On 9 April 2021, the National Police Board filed an data breach notification, which was completed upon request from the Finish DPA. In the course of these clarifications, it was further revealed by the CPP that, during a meeting hosted by Europol in 2019, the latter had presented and recommended Clearview AI for the
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 3394/171/21 in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 3394/171/21 - Finland (2021). Retrieved from cookiefines.eu
Last updated: