CNIL v Clearview AI (France)

EUR 20M

Fine, 17 October 2022

CNIL decision SAN-2022-019

EUR 5.2M

Overdue penalty, 10 May 2023

CNIL press release

2 months

Deadline given to delete French residents' data

CNIL decision

What happened?

The CNIL received complaints in 2020 from individuals who had found their photographs in Clearview's index and from the organisation Privacy International. Its investigation found that Clearview collected photographs from websites and social networks without a lawful basis, and that it did not respond adequately to access and erasure requests. On 26 November 2021 the CNIL's president issued a formal notice ordering Clearview to stop collecting and using French residents' data and to delete what it held, within two months.

Clearview did not respond. On 17 October 2022 the CNIL's restricted committee fined the company EUR 20 million, the maximum available under Article 83 of the GDPR for a company of its turnover, and ordered deletion within two months, with a penalty of EUR 100,000 for each day of delay. On 10 May 2023 the CNIL liquidated that penalty at EUR 5.2 million after Clearview provided no proof of compliance.

1. 2020-05

   Complaints

   Individuals and Privacy International complain to the CNIL.

2. 2021-11-26

   Formal notice

   Clearview ordered to stop collecting and to delete French data.

3. 2022-10-17

   Fine

   EUR 20 million fine and deletion order with daily penalty.

4. 2023-05-10

   Overdue penalty

   EUR 5.2 million liquidated for non-compliance.

What did the CNIL decide?

• Unlawful processing: no legitimate interest could justify building a face index from photographs of people who never expected their faces to be used that way (Article 6).
• Rights obstructed: Clearview limited access requests, demanded excessive justification and did not respond within the time limits (Articles 12, 15 and 17).
• Non-cooperation: the company did not respond to the formal notice, an aggravating factor in the fine (Article 31).

Why does it matter for face search?

The CNIL's decision is the first in the EU to put a number on scraping faces from public pages: EUR 20 million, the statutory maximum for the company's size, followed by daily penalties. It also set a procedural pattern that the Italian, Greek and Dutch authorities followed. For consumer engines the relevant finding is on legitimate interest: a person posting a photo does not reasonably expect it to feed a searchable face index.

What happened next?

Clearview has not paid or complied, and the CNIL has no establishment in France to enforce against. The gap between decision and enforcement is the same in every European Clearview case and is one reason the European Data Protection Board's members have discussed coordinated action against web-scraping face indexes, and why advocacy groups such as noyb have pursued regulators for inaction in the PimEyes matter (see Belgian DPA and PimEyes).