OAIC v Clearview AI (Australia)

0

Penalty imposed (the Act then allowed none for a determination)

OAIC determination

90 days

Deadline to destroy Australians' images and vectors

OAIC determination, 14 October 2021

2024-08-21

OAIC decision not to take further action

OAIC statement

What happened?

The Office of the Australian Information Commissioner opened a joint investigation with the UK ICO in July 2020 after reports that Australian police had trialled Clearview's service. On 14 October 2021 the Commissioner determined that Clearview had collected Australians' sensitive information without consent, by unfair means, without taking reasonable steps to notify them, and without ensuring accuracy, breaching Australian Privacy Principles 1, 3, 5 and 10. She ordered the company to stop collecting images from people in Australia and to destroy the images and face embeddings it held within 90 days.

1. 2020-07-09

   Joint investigation

   OAIC and ICO open an inquiry into Clearview's practices.

2. 2021-10-14

   Determination

   Breaches of the Privacy Act found; cease and destroy orders.

3. 2021-11

   Appeal

   Clearview applies to the Administrative Appeals Tribunal for review.

4. 2023-05-08

   AAT decision

   Tribunal affirms the determination and the orders.

5. 2024-08-21

   No further action

   OAIC announces it will not pursue further proceedings.

What did the Commissioner and the tribunal decide?

The determination found that a face embedding is biometric information and therefore sensitive information under the Privacy Act 1988, that scraping it from public websites is collection by unfair means, and that the public availability of a photo does not amount to consent. The Administrative Appeals Tribunal affirmed those conclusions on 8 May 2023, rejecting Clearview's arguments that it had no Australian activities and that the Act did not reach it.

Why does it matter for face search?

• It is the leading Australian authority that face vectors are sensitive information and that public photos do not supply consent.
• The 2024 decision not to pursue further action shows the limit of enforcement against a company that has left the market and holds no local assets.
• The Privacy Act amendments passed in December 2024 and the statutory tort for serious invasions of privacy that commenced in June 2025 change the tools available for the next case; see the law entry.

What happened next?

On 21 August 2024 the Commissioner announced that, having considered Clearview's statements that it had ceased offering services in Australia and the resources required to pursue further compliance, no further action would be taken, while noting that the determination stands. The decision drew criticism from privacy advocates. Clearview's parallel cases in the UK and Canada continued.