Clearview AI – €20,000,000 Fine (France, 2022)

The controller operates a facial recognition tool (the tool) to identify data subjects using pictures and video's posted online (online content). The controller is established in the United States and has no establishment in the European Union (EU), but processes personal data of EU data subjects. Specifically, it collects online content in which faces appear, including faces of minors. The tool indexes freely accessible web pages and social media platforms. After the indexing, the tool extracts all images with faces of data subjects. Based on these images, the tool calculates a mathematical hash for each data subject, which is in turn based on a unique biometric template of the face in the picture. The mathematical hash is used to make data subjects searchable in the database. The controller sells access to its database to third parties. These third parties can upload a picture of a face to start a search in order to identify data subject, after which the tool creates a mathematical hash for this uploaded picture. This new hash is compared with existing hashes in the database. When the hashes are similar, the tool collects all the images with the same hash, including a reference to the original source of each picture. This process makes it possible to identify data subjects. In its privacy policy, the controller stated that data subjects could only exercise their right of access twice a year. The controller did not mention a retention period for the personal data. The DPA received several complaints from data subjects regarding the rights of access (Article 15 GDPR) and erasure (Article 17 GDPR) between May and December 2020. One data subject requested a third party to make an access request on her behalf. The controller acknowledged that it had received this request and invited the data subject to use an online platform to exercise her right of access, but failed to answer follow up requests on multiple occasions. When answering to the last request, the contr