In a statement released on Wednesday, Falk, who is also the country's privacy commissioner, said this conclusion had been reached following a joint investigation between the Office of the Australian Information Commissioner and the UK Information Commissioner’s Office.
Falk said Clearview has breached the Australian Privacy Act 1988 by:
- collecting Australians’ sensitive information without consent;
- collecting personal information by unfair means;
- not taking reasonable steps to notify individuals of the collection of personal information;
- not taking reasonable steps to ensure that personal information it disclosed was accurate, having regard to the purpose of disclosure; and
- not taking reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles.
The company was ordered to stop collecting data from Australians and to destroy any existing images and templates it had already collected.
| |
Said Falk: "The covert collection of this kind of sensitive information is unreasonably intrusive and unfair.
“It carries significant risk of harm to individuals, including vulnerable groups such as children and victims of crime, whose images can be searched on Clearview AI’s database.
“By its nature, this biometric identity information cannot be reissued or cancelled and may also be replicated and used for identity theft. Individuals featured in the database may also be at risk of mis-identification.
“These practices fall well short of Australians’ expectations for the protection of their personal information.”
The OAIC said Clearview had provided use of its technology to some police forces in Australia in 2019 and 2020 and it was checking to see whether the use of the technology had met requirements under the Australian Government Agencies Privacy Code to assess and mitigate privacy risks.
Clearview AI had argued that it had not been given personal information and as it was based in the US it did not have to conform to the Privacy Act. It also claimed that use of its technology had stopped before the OAIC investigation began.
But Falk batted away these arguments, saying she was satisfied the company had to comply with Australian privacy law and that the information it handled was personal information covered by the Privacy Act.
“Clearview AI’s activities in Australia involve the automated and repetitious collection of sensitive biometric information from Australians on a large scale, for profit. These transactions are fundamental to their commercial enterprise,” she said.
“The company’s patent application also demonstrates the capability of the technology to be used for other purposes such as dating, retail, dispensing social benefits, and granting or denying access to a facility, venue or device.
“This case reinforces the need to strengthen protections through the current review of the Privacy Act, including restricting or prohibiting practices such as data scraping personal information from online platforms.
“It also raises questions about whether online platforms are doing enough to prevent and detect scraping of personal information.”
