Clearview AI – €20,000,000 Fine (Italy, 2022)

Clearview A.I. Inc. (Clearview) is a company conducting facial recognition on public web sources and is the data controller. Four data subjects had sought information from Clearview under Article 15 GDPR. Clearview replied to three of them and provided “special reports” containing the results obtained through the Clearview software. In 2021, these data subjects complained to the Italian DPA (Garante per la protezione dei dati personali) regarding the processing of their personal data by Clearview, without their consent. In addition, two "organisations committed to defending the privacy and fundamental rights of individuals" submitted information about precedents in Germany and Sweden, and their reports on activities of Clearview to the DPA. Based on the press reports on the activities of Clearview and the complaints submitted to it, the DPA opened an investigation. Before the DPA, Clearview submitted as follows: The GDPR was not applicable and the DPA lacked jurisdiction as Clearview was not offering its services in Italy and had utilized technical measures to block Italian IP addresses from accessing services of Clearview. Clearview was not carrying out any monitoring activity as per Article 3(2)(b) GDPR, and its search results were akin to Google Search. Clearview did not have a list of Italian customers, and its privacy policy did not refer to GDPR. Clearview did not have a representative in the Union as mandated by Article 27 GDPR. Accordingly, the activities of Clearview were not covered by the GDPR. Since 2019, law enforcement agencies in the United States (US) were using Clearview, “especially in the context of child pornography investigations”. This generated international interest and several European government agencies signed up for a test account for a short time. In March 2020, following complaints by regulators in European Union (EU), these test accounts, which were very few, were closed. Clearview does not have any customers in the EU, and it ensure