Clearview AI Facing £17 Million Fine From UK ICO Over Violation of Data Protection Laws

By Scott Ikeda for CPO Magazine
Friday, December 3, 2021

• 4.5k
• 50
• 53
• 50
• 28
• More
• 50
• 50

The UK’s separation from EU data protection laws is relatively new, having begun at the start of 2021. The country opted to reserve the right to fine up to 4% of a company’s annual global turnover for violations, but (as with the EU) nothing has yet to come close to that amount. Its largest fine to date came in 2020 and was issued to British Airways, a penalty of £20 million. It also fined hotel chain Marriott £18.4 million around the same time.

Ilia Kolochenko, Founder of ImmuniWeb, notes that there has been a tendency thus far for punishments to not fit the scope of the crimes: “Clearview AI has allegedly collected and processed over 10 billion individual photos without notice, let alone valid consent. The personal life and privacy of many UK and EU residents are jeopardized for commercial gain stemming from the unlawful processing of personal data. Furthermore, under GDPR, the highest penalty threshold for a data breach is 2% of infringer’s annual turnover, and 4% for violations like unlawful processing of personal data, making this specific decision of ICO incomprehensible for me. In some notorious cases, like BA, the fine was eventually reduced from hundreds of millions to a significantly smaller amount, however, for different reasons unrelated to the gravity of the violation … Different reports show that there is no consistency between GDPR fines and enforcement priorities among European DPAs, while this decision also demonstrates that even one DPA, like ICO, may have broadly varying decisions that make GDPR enforcement unpredictable. The European Data Protection Board should probably bring more clarity and uniformity to the context by issuing additional guidelines on fines.” Read Full Article