Hellenic DPA v Clearview AI (Greece)

EUR 20M

Fine, 13 July 2022

HDPA decision 35/2022

3rd

EU authority to fine Clearview, after Italy and before France

Decision dates

1

Complainant: a Greek resident represented by Homo Digitalis

HDPA decision

What happened?

In May 2021 the Athens-based digital rights organisation Homo Digitalis filed a complaint with the Hellenic DPA on behalf of a Greek resident, as part of a coordinated set of complaints by Privacy International, noyb, Hermes Center and Homo Digitalis in five countries. The complainant had made an access request to Clearview and received a response confirming the company held his images. The authority investigated and, in decision 35/2022 of 13 July 2022, found Clearview in breach of the GDPR.

1. 2021-05-27

   Coordinated complaints

   Civil-society groups file complaints in Austria, France, Greece, Italy and the UK.

2. 2022-07-13

   Decision 35/2022

   Fine of EUR 20 million, ban and deletion order.

3. 2022-07-20

   Publication

   Homo Digitalis and the EDPB publish the outcome.

What did the authority decide?

• Clearview processes biometric data of people in Greece without any Article 9 exception and without a lawful basis under Article 6.
• It breached the principles of lawfulness, fairness and transparency and did not provide the information Articles 12 to 14 require.
• The GDPR applies because the company monitors the behaviour of people in the EU, so the absence of Greek customers is irrelevant.
• Orders: stop the processing, delete the data, appoint a representative in the EU under Article 27.

Why does it matter for face search?

The Greek decision shows the role of coordinated complaints in enforcement against face indexes: one access request and one complaint produced a maximum fine. The reasoning matches Garante v Clearview and was followed by CNIL v Clearview three months later. For people checking whether their face is in an index, the case is also a reminder that an access request is a right under the GDPR, whatever the engine's terms say; see opt-out.

What happened next?

Clearview did not appeal in Greece and has not reported compliance or payment. The authority, like its peers, has no means of recovering the fine from a company without EU assets. The decision is cited in later European proceedings and in the discussions of the European Data Protection Board on cross-border enforcement against companies established outside the EU.