The Swedish Authority for Privacy Protection ('IMY') issued, on 11 February 2021, a decision fining the Swedish Police Authority ('the Police') SEK 2,500,000 (approx. €250,000) for processing personal data in breach of the Criminal Data Act ('the Act'), when using Clearview AI to identify individuals. In particular, the decision notes that the IMY had initiated the investigation, following news in the media of the Swedish Police Authority using the application Clearview AI for facial recognition. In addition, the decision notes that Clearview AI had been used by the Police on a number of occasions and that according to the Police, a few employees have used the application without prior authorisation.

Furthermore, the decision notes that the Police has not fulfilled its obligations as a data controller on a number of accounts with regards to the use of Clearview AI, such as:

• failing to implement sufficient organisational measures to ensure and demonstrate that the processing of personal data has been carried out in compliance with the Act;
• unlawfully processing biometric data; and
• failing to conduct a data protection impact assessment which the processing of biometric data would require.

Lastly, the decision notes that the Police has been ordered to inform the affected data subjects and to erase any personal data transferred to Clearview AI.

You can read the press release here and the decision here, both only available in Swedish.