Clearview AI’s anti-crime facial recognition technology broke Canadian privacy law, probe finds

The US company’s technology allows law enforcement and commercial organisations to match photographs of unknown people against Clearview’s databank of more than 3 billion images for investigative purposes.

The Royal Canadian Mounted Police (RCMP) was a paying customer for a while and a total of 48 accounts were created for law enforcement and other organisations across the country.

The size of Clearview’s databank creates the risk of significant harm to individuals, such as misidentification and exposure to potential data breaches, the investigation found.

“It is completely unacceptable for millions of people who will never be implicated in any crime to find themselves continually in a police lineup,” said Daniel Therrien, Privacy Commissioner of Canada.

The probe, conducted by his office and counterparts in Quebec, British Columbia and Alberta provinces, found Clearview had collected highly sensitive biometric information without the knowledge or consent of individuals.

“Furthermore, Clearview collected, used and disclosed Canadians’ personal information for inappropriate purposes, which cannot be rendered appropriate via consent,” the commissioners said in a statement.

The investigation concluded the New York-headquartered company violated Canada’s federal and provincial privacy laws.

When presented with the findings, the commissioners say Clearview argued:

• Canadian privacy laws do not apply to its activities because the company does not have a “real and substantial connection” to Canada;
• Consent was not required because the information was publicly available;
• Individuals who placed or permitted their images to be placed on websites that were scraped did not have substantial privacy concerns justifying an infringement of the company’s freedom of expression;
• Given the significant potential benefit of Clearview’s services to law enforcement and national security, and the fact that significant harm is unlikely to occur to individuals, the balancing of privacy rights and Clearview’s business needs favoured the company’s entirely appropriate purposes; and
• Clearview cannot be held responsible for offering services to law enforcement or any other entity that subsequently makes an error in its assessment of the person being investigated.

The commissioners rejected those arguments. They were particularly concerned Clearview did not recognise that mass collection of biometric information from billions of people, without express consent, violated an individual’s reasonable expectation of privacy.

The company’s view its business interests outweighed privacy rights also concerned the commissioners, who noted Clearview collected the images of Canadians and actively marketed its services to law enforcement agencies in the country.

Michael McEvoy, Information and Privacy Commissioner for British Columbia, commented: “It is unacceptable and deeply troubling that a company would create a giant database of our biometric data and sell it for profit without recognising its invasive nature.”

The privacy authorities recommended Clearview stop offering its facial recognition services to Canadian clients; cease collecting images of individuals in Canada; and delete all previously collected images and biometric facial arrays of individuals in Canada.

Shortly after the investigation began, the company agreed to no longer provide services in Canada, stopped offering trial accounts to Canadian organisations, and discontinued services to its one remaining subscriber in the country, the RCMP, last July.

“However, Clearview disagreed with the findings of the investigation and did not demonstrate a willingness to follow the other recommendations,” the commissioners said.

“Should Clearview maintain its refusal, the four authorities will pursue other actions available under their respective acts to bring Clearview into compliance with Canadian laws.”

A related investigation by the Office of the Privacy Commissioner of Canada into the RCMP’s use of Clearview AI’s facial recognition technology remains ongoing.

Doug Mitchell, IMK Advocates, attorney for Clearview AI, said: ”Clearview AI’s technology is not available in Canada and it does not operate in Canada. In any event, Clearview AI only collects public information from the Internet which is explicitly permitted under the Personal Information Protection and Electronic Documents Act (PIPEDA)

“The Federal Court of Appeal has previously ruled in the privacy context that publicly available information means exactly what it says: “available or accessible by the citizenry at large”.  There is no reason to apply a different standard here.  Clearview AI is a search engine that collects public data just as much larger companies do, including Google, which is permitted to operate in Canada.”

On its website, the company says: “Clearview AI’s technology has helped law enforcement track down hundreds of at-large criminals, including paedophiles, terrorists and sex traffickers. It is also used to help exonerate the innocent and identify the victims of crimes including child sex abuse and financial fraud.”