Face recognition: Hamburg data protectionists want to force Clearview to delete data

Face recognition software at the police station

Photo: Gillian Flaccus / AP

If the Hamburg data protection officer Johannes Caspar has his way, the New York company Clearview AI is permanently violating European law.

Clearview has tapped openly accessible photos of people on social networks and on many websites and created a collection of biometric data that it claims to contain three billion images, which the facial recognition software used by police authorities can search.

Those affected, including EU citizens, were never asked or even informed.

Caspar has now initiated administrative proceedings against Clearview.

This was triggered by Matthias Marx from Hamburg.

Almost exactly a year ago, right after the New York Times dragged the secretive company into the spotlight, he emailed Clearview AI.

He wanted to know which images and data the controversial face recognition start-up had saved of him and to whom it had been made available.

It took him a month to get the answer he wanted, at least partially.

In a PDF file from Clearview, in addition to the image he had sent in for comparison, he found two other photos on which he can be seen, as well as the links under which they could be found on the Internet.

Marx immediately submitted a complaint to Caspar's authority.

Initially, it did not consider itself responsible because Clearview "does not have a branch in Europe" and does not target European customers.

But Marx persisted and contradicted it, and the authorities turned.

After months of back and forth, during which Clearview took the view not to fall under the scope of the EU General Data Protection Regulation (GDPR), Caspar has now made a decision.

His agency told SPIEGEL that it had opened administrative proceedings to order Clearview to delete Marx's biometric data.

The company has until February 12th.

Authority criticizes massive, indiscriminate data processing

Critically important is Caspar's conclusion that the GDPR is applicable even though Clearview does not have a European office.

Because the GDPR also has to guarantee the protection of EU citizens "against data processing by a person responsible exclusively in a third country".

"This protection is necessary in view of the massive, indiscriminate data processing by Clearview and the factual impossibility of asserting the rights of data subjects in the USA against app users."

Clearview does offer a form on its website which EU citizens can use to request to be delisted from the Clearview search.

However, the company does not promise to delete the biometric data.

In addition, Caspar complains that there is no sufficient legal basis for the data processing: »The consent of the person concerned is required for the biometric data used here.

Such is not the case.

The data must therefore be deleted. "

Marx himself and the civil rights organization Noyb ("none of your business"), which represents him, are nevertheless dissatisfied.

In her opinion, Caspar does not go far enough.

It is "correct and important" that he "has confirmed the applicability of the GDPR and the illegality of the processing," said Alan Dahi from Noyb to SPIEGEL.

But Caspar's order shows that Clearview only has to delete the hash value generated from Marx's photos, but not the photos themselves. The hash value is a mathematical model that is calculated from the face on a photo.

If a Clearview user, e.g. a police investigator, uploads a photo himself, its hash value is compared with that in Clearview's database.

If there is a sufficient similarity, the investigator can see the other photos together with the associated web links, which can facilitate identification of the person depicted.

Caspar should also have ordered the deletion of the photos, says Dahi, because Marx is entitled to this.

"Finally, a Europe-wide ban on Clearview AI would be desirable," he adds.

Now every citizen »has to lodge a complaint himself.

That is also an unnecessarily large amount of work for the respective supervisory authorities. "

Marx himself says: "This shows that our data is not yet adequately protected and that there is a need for action against biometric monitoring."

Icon: The mirror