0

TL;DR: how do we get the data this company collected on us without also giving them our government-issued IDs that they could potentially keep and tie to our "profiles"?


A week ago (January 25th), the New York Times reported that Clearview AI, a neural-network-based facial recognition software, has collected and stored over 3 billion names, photos and addresses. The company's software is marketed to law enforcement officials, but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc. Concerns are growing that the database could infringe upon personal freedoms, specifically the right to privacy when used in conjunction with state-of-the-art mathematical facial recognition algorithms recently published. I agree with those sentiments, this technology is dangerous.

Now Forbes has reported on it as well and affirmed those beliefs, highlighting the Clearview AI privacy policy's horrible stipulation for obtaining your own personal data that they have collected:

Contact information

If you would like to ask a question about our privacy policy or exercise your data privacy rights please contact us at: privacy-requests@clearview.ai. This address will connect you to our Data Protection Officer. Please submit name, a headshot and a photo of a government-issued ID to facilitate the processing of your request. Privacy requests can also be submitted via (phone or mail).

...

Requests to exercise data protection rights can be submitted here to privacy-requests@clearview.ai. (see below for further instructions)

These rights are subject to limitations that vary by jurisdiction. We will honor such requests, withdrawal or objection as required under applicable data protection rules but these rights are not absolute: they do not always apply and exemptions may be engaged. Clearview does require that persons requesting the sharing or deletion of their personal data provide us with information to verify their identity and to facilitate the processing of data requests. While most of this information is deleted after the completion of the request, Clearview is required to retain some of this information to maintain a record of data rights requests. If we do not comply with your request, we will explain why.

Updates to this Policy

Clearview AI regularly reviews our privacy policy and places any updates on this web page. This policy was last updated on January 23, 2020.

*Clearview AI privacy policy

The language of this policy, combined with the fact that it was updated while the news is breaking about growing concerns about its potential impacts on privacy makes me very concerned.

This company, not unlike others in modern history, has scraped or purchased billions of data points containing personally-identifying information (names, photos, addresses, etc.) of American (and likely many other countries') citizens. In order to know what they've collected on us, we have to give them a government-issued ID??

How can I (we) get what data this company has on us without further violating our own personal right to privacy?

Side note/bonus question: is this kind of software not a direct violation of our Fifth Amendment rights to privacy of personal information?

  • "I agree with those sentiments" Mind you law is not about sentiments. Show how exactly this technology violates your rights to privacy. What would be your damages? – Greendrake Jan 27 at 4:32
  • @Greendrake Is unapproved collection, storage and use of PII (name, address, photos, etc.) not an infringement upon our rights to privacy? Companies are required to follow certain practices with PII, this company has had no independent review by NIST or other institutions. We don't know what they're using this data for because there is no regulation. I want to know what they have on me, but in doing so I have to give them even more PII. Not only is that extremely fishy - who knows how long they keep that data or how they use it - but sharing my driver's license #/passport as well is insane. – Chris Cirefice Jan 27 at 4:43
  • "...because there is no regulation." Exactly. – BlueDogRanch Jan 27 at 4:47
2

You appear to be outraged and offended at the terribly dangerous technology in use,

but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc.

Publicly available data. You - and all of those other billion users - agreed to allow those platforms to publicly share your data with other platforms or scrapers when you opened an account.

Read the TOSs of Facebook, Twitter, etc. When users of those platforms signup, they agree to allow the platforms to share their data with other platforms. That agreement may be in small print, but it is still there, and it is legally binding. You have no legal recourse against them, except to delete your account. (And TOSs can change, without informing you; read that part, too).

Unless you can show that Clearview broke Facebook Twitter's, or those companies broke their own TOS by allowing Clearview to scrape data, there's nothing to say. Unless you can show that Clearview broke the law or a TOS, you have no legal recourse against Clearview.

If a company did break a TOS, that's more than likely civil law, not criminal.

In any event, Clearview is a different company; you have to abide by Clearview's process to ask them to remove your data. They are not bound by the TOS of another company. They are bound by law, but until the law tries to catch up with technology and privacy (i.e., GDPR), they are free to operate.

If you value your privacy, read the TOS before you sign up with any service, even a library card or driver's license in your own town.

| improve this answer | |
  • "Twitter sent a letter this week to the small start-up company, Clearview AI, demanding that it stop taking photos and any other data from the social media website “for any reason” and delete any data that it previously collected, a Twitter spokeswoman said. The cease-and-desist letter, sent on Tuesday, accused Clearview of violating Twitter’s policies." report by the New York Times. If Twitter is accusing them of violating their Privacy Policy, doesn't that extend to the platform's users? I'm not a lawyer. – Chris Cirefice Jan 27 at 4:56
  • I am also aware of the privacy policies. This is a 3rd party scraping data that breaches other company privacy policies. It is also potentially infrigning upon our rights. And to supply them with PII to know what they've scraped (against ToS of these data owners, Facebook, Twitter, etc.) seems a bit like giving them an official document to tie you to your public persona in a centralized manner. That's concerning. Surely giving them a government-issued ID is against some law. Again, IINAL. – Chris Cirefice Jan 27 at 4:58
  • The fast that Twitter send a cease-and-desist letter to Clearview is a completely different question than what you asked. That's a dispute between the two companies; personal data may or not be caught in between; it all depends on the TOS of, in this case, Twitter, and if users indemnify themselves for data scraped against Twitter's TOS. – BlueDogRanch Jan 27 at 5:01
  • Okay, so can you confirm any way to obtain my own personal information from Clearview without giving them an official government-issued ID as collateral? Or do we actually have no recourse to know what the heck is going on in these companies (ran by a very few individuals) with their mass collection and storage of our PII without our consent? – Chris Cirefice Jan 27 at 5:03
  • 1
    Me confirm a way for you to get your data? That's your problem. Find a lawyer and sue Clearview. Go all the way to SCOTUS and establish a precedent. – BlueDogRanch Jan 27 at 5:07
0

You can't

There is a practical dimension here - if you don't tell them who you are, how can they identify (and delete) PII that belongs to you? "Please delete all my data" is a request that is impossible to comply with if they don't know who "me" is.

As for identification, the right to have the data deleted (where you have such a right which is by no means universal) requires you to reasonably prove that you are you. Otherwise, you could request the deletion of my data and only I can do that.

| improve this answer | |
  • There's nothing in their privacy policy that guarantees that they won't keep your government-issued ID. So giving them even more PII to delete the PII they already have when they are clearly a sketchy company makes me concerned that they would just keep e.g. my passport photo to be used for whatever purpose, or even sold. The issue here is trust. Is my only recourse to sue them like David Carroll and come up empty-handed anyway because there are no laws/regulations governing this stuff? – Chris Cirefice Jan 29 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.