The Australian Information Commissioner found that Clearview AI violated Australia’s privacy laws in many ways. In previous bilateral investigations, it was found that the company’s facial recognition tool collected sensitive information from Australians in an unfair manner without consent.A survey conducted by the Office of the Australian Information Commissioner (OAIC) and the Office of the British Information Commissioner (ICO) found that Clearview AI’s facial recognition tool indiscriminately grabbed biometric information from the Internet and collected data on at least 3 billion people.
OAIC also found that some Australian police agency users searched and identified their own images in the Clearview AI database, and found many images of unknown Australians.
Taking these factors into consideration, the Australian Information Commissioner Angelene Falk concluded that Clearview AI’s collection of sensitive information from Australians without consent and unfair means violated Australia’s privacy laws. In her ruling [PDF], Falk explained that although the facial images of the affected Australians are already available online, no consent was provided because Clearview AI’s intention to collect such biometric data is vague.
The Information Commissioner wrote: “I believe that uploading an image to a social media site does not express consent to the collection of the image by an unknown third party for commercial purposes. If the individual is not fully informed of the impact of providing or refusing consent, it cannot Implied consent. This includes ensuring that individuals are properly and clearly informed of how their personal information will be handled so that they can decide whether to give consent.”
Other violations of Australian privacy laws discovered by Falk are that Clearview AI failed to take reasonable steps to notify individuals to collect personal information or to ensure that the personal information disclosed is accurate. She also criticized the company for not taking reasonable steps to implement practices, procedures and systems to ensure compliance with Australian privacy principles.