Autoriteit Persoonsgegevens v Clearview AI (Netherlands)

EUR 30.5M

Administrative fine

AP decision, 16 May 2024

EUR 5.1M

Maximum periodic penalty payments for non-compliance

AP press release, 3 September 2024

30B+

Images in the index, as reported by the AP

AP press release

What happened?

The Autoriteit Persoonsgegevens (AP) investigated Clearview AI after complaints from Dutch residents whose faces appeared in the company's index. Clearview collects photographs from publicly accessible pages, converts each face into a face embedding and lets clients search the resulting database. The AP found that the database contained more than 30 billion images and that Dutch residents had been included without their knowledge or consent.

In its decision of 16 May 2024, published on 3 September 2024, the AP fined Clearview EUR 30.5 million and ordered it to stop the violations, with periodic penalty payments of up to EUR 5.1 million if it did not. The AP also stated that using Clearview's services is prohibited for Dutch organisations and warned that it would consider holding the company's directors personally liable if the violations continued.

1. 2021

   Complaints from Dutch residents

   Individuals ask the AP to act after finding their images in Clearview's index.

2. 2024-05-16

   Decision

   Fine of EUR 30.5 million and orders subject to penalty payments.

3. 2024-09-03

   Publication

   AP publishes the decision; Clearview has not objected within the period, so the fine stands.

What did the authority decide?

• Clearview processed biometric data within the meaning of Article 9 of the GDPR without any applicable exception.
• The company had no lawful basis under Article 6 for building the database at all.
• Clearview was not transparent: people were not told they were in the database and could not exercise their rights effectively; access requests were obstructed.
• The company's position that it is not subject to the GDPR was rejected: it processes data of people in the EU while monitoring their behaviour.

Why does it matter for face search?

It is the largest fine against a face search database in Europe and the clearest statement by an EU regulator that scraping faces from the public web to build a searchable index is unlawful under the GDPR, regardless of whether the images were public. The AP's reasoning applies the same way to consumer face search engines: the public availability of a photo does not create a lawful basis for turning the face in it into biometric data. For how engines respond, see the opt-out routes directory.

What happened next?

Because Clearview did not lodge an objection, the decision is final and the fine is enforceable in the Netherlands. The practical question is collection: Clearview has no European establishment and has said it does not consider itself subject to EU law. The AP stated it was looking at ways to ensure the company stops, including the personal liability of directors. The decision sits alongside the EUR 20 million fines in France, Italy and Greece and the UK proceedings in ICO v Clearview.