Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Austria: DSB orders Clearview AI to delete data and designate EU representative

None of your business ('NOYB') announced, on 10 May 2023, that the Austrian data protection authority ('DSB') issued a decision, in which it found Clearview AI Inc. in violation of Articles 5(1)(a), 5(1)(b), 5(1)(c), 6(1), 9(1), and 27 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and ordered the same to delete the complainant's personal data and to designate a representative within the EU, following a complaint submitted by an individual.

Background to the decision

In particular, the DSB noted that the complaint related to a photo of the complainant contained within the respondents' database. More specifically, the DSB explained that the complaint examined whether Clearview AI processed the complainant's personal information in violation of Article 5(1) of the GDPR and without a legal basis in accordance with Articles 6(1) or 9(1) of the GDPR.

Findings of the DSB

Following its investigation, the DSB determined that Clearview AI violated Article 5(1) of the GDPR. On this, the DSB explained that as there was no lawful basis for processing, the processing could not be lawful, and was unfair, as the complainant could not expect their photographs to be added to a database by the respondent and made available to a variety of clients (including law enforcement agencies).

With regard to legal bases, the DSB detailed that there were no lawful bases for the processing undertaken by Clearview AI, highlighting that legitimate interest was not available as the right of the data subject outweighed the interest of the company, owing to the serious interference with the data subjects' privacy. On special categories of personal information, the DSB noted that the processing fell within the scope of 'biometric data' and thus within 'special categories of personal information'. To this end, the DSB also found Clearview AI to have violated Article 9 of the GDPR.

Furthermore, the DSB determined that Clearview AI falls within the scope of the GDPR, as it monitors the behaviour of EU residents in line with Article 3(2)(b) of the GDPR, and therefore should have a representative in the EU, according to Article 27 of the GDPR.

Outcomes

In light of the above, the DSB concluded that the processing of the complainant's personal data was unlawful and ordered Clearview AI to delete said data in accordance with Article 17(1)(d) of the GDPR. In addition, the DSB ordered Clearview AI to designate a representative within the EU.

You can read the press release here, the European Data Protection Board summary here, and the decision, only available in German, here.

Feedback