1

TL;DR: how do we get the data this company collected on us without also giving them our government-issued IDs that they could potentially keep and tie to our "profiles"?

A week ago (January 25th), the New York Times reported that Clearview AI, a neural-network-based facial recognition software, has collected and stored over 3 billion names, photos and addresses. The company's software is marketed to law enforcement officials, but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc. Concerns are growing that the database could infringe upon personal freedoms, specifically the right to privacy when used in conjunction with state-of-the-art mathematical facial recognition algorithms recently published. I agree with those sentiments, this technology is dangerous.

Now Forbes has reported on it as well and affirmed those beliefs, highlighting the Clearview AI privacy policy's horrible stipulation for obtaining your own personal data that they have collected:

Contact information

If you would like to ask a question about our privacy policy or exercise your data privacy rights please contact us at: [email protected]. This address will connect you to our Data Protection Officer. Please submit name, a headshot and a photo of a government-issued ID to facilitate the processing of your request. Privacy requests can also be submitted via (phone or mail).

...

Requests to exercise data protection rights can be submitted here to [email protected]. (see below for further instructions)

These rights are subject to limitations that vary by jurisdiction. We will honor such requests, withdrawal or objection as required under applicable data protection rules but these rights are not absolute: they do not always apply and exemptions may be engaged. Clearview does require that persons requesting the sharing or deletion of their personal data provide us with information to verify their identity and to facilitate the processing of data requests. While most of this information is deleted after the completion of the request, Clearview is required to retain some of this information to maintain a record of data rights requests. If we do not comply with your request, we will explain why.

Updates to this Policy

Clearview AI regularly reviews our privacy policy and places any updates on this web page. This policy was last updated on January 23, 2020.

*Clearview AI privacy policy

The language of this policy, combined with the fact that it was updated while the news is breaking about growing concerns about its potential impacts on privacy makes me very concerned.

This company, not unlike others in modern history, has scraped or purchased billions of data points containing personally-identifying information (names, photos, addresses, etc.) of American (and likely many other countries') citizens. In order to know what they've collected on us, we have to give them a government-issued ID??

How can I (we) get what data this company has on us without further violating our own personal right to privacy?

Side note/bonus question: is this kind of software not a direct violation of our Fifth Amendment rights to privacy of personal information?

Improve this question
4
  • 1
    "I agree with those sentiments" Mind you law is not about sentiments. Show how exactly this technology violates your rights to privacy. What would be your damages?
    – Greendrake
    Commented Jan 27, 2020 at 4:32
  • @Greendrake Is unapproved collection, storage and use of PII (name, address, photos, etc.) not an infringement upon our rights to privacy? Companies are required to follow certain practices with PII, this company has had no independent review by NIST or other institutions. We don't know what they're using this data for because there is no regulation. I want to know what they have on me, but in doing so I have to give them even more PII. Not only is that extremely fishy - who knows how long they keep that data or how they use it - but sharing my driver's license #/passport as well is insane.
    – Chris Cirefice
    Commented Jan 27, 2020 at 4:43
  • "...because there is no regulation." Exactly.
    – BlueDogRanch
    Commented Jan 27, 2020 at 4:47
  • While you may have no right to privacy, you do have the right to register your photos you took of yourself under copyright. Violation of copyright includes statutory damages. Such a registration costs 65$ and requires you to upload your photo to the government. But you have to register your photo within 3 months of first publication.
    – Yakk
    Commented Sep 28, 2021 at 21:39

3 Answers 3

Reset to default
3

Breach of GDPR

France, Italy and Greece fined Clearview AI 20 million Euros for the following breaches:

  • Unlawful processing of personal data (breach of Article 6 of the GDPR)
  • Individuals’ rights not respected (Articles 12, 15 and 17 of the GDPR)
  • Lack of cooperation with the CNIL (Article 31 of the RGPD)

https://techcrunch.com/2022/10/20/clearview-ai-fined-in-france/ https://techcrunch.com/2022/03/09/clearview-italy-gdpr/ https://techcrunch.com/2022/07/13/clearview-greek-ban-order/

Improve this answer
1
  • Also in 2021, the Swedish police were fined €250000 for the usage of the Clearview-AI-Software by Swedens data protection autority IMY.
    – Mark Johnson
    Commented Apr 11, 2023 at 9:13
2

You appear to be outraged and offended at the terribly dangerous technology in use,

but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc.

Publicly available data. You - and all of those other billion users - agreed to allow those platforms to publicly share your data with other platforms or scrapers when you opened an account.

Read the TOSs of Facebook, Twitter, etc. When users of those platforms signup, they agree to allow the platforms to share their data with other platforms. That agreement may be in small print, but it is still there, and it is legally binding. You have no legal recourse against them, except to delete your account. (And TOSs can change, without informing you; read that part, too).

Unless you can show that Clearview broke Facebook Twitter's, or those companies broke their own TOS by allowing Clearview to scrape data, there's nothing to say. Unless you can show that Clearview broke the law or a TOS, you have no legal recourse against Clearview.

If a company did break a TOS, that's more than likely civil law, not criminal.

In any event, Clearview is a different company; you have to abide by Clearview's process to ask them to remove your data. They are not bound by the TOS of another company. They are bound by law, but until the law tries to catch up with technology and privacy (i.e., GDPR), they are free to operate.

If you value your privacy, read the TOS before you sign up with any service, even a library card or driver's license in your own town.

Improve this answer
6
  • "Twitter sent a letter this week to the small start-up company, Clearview AI, demanding that it stop taking photos and any other data from the social media website “for any reason” and delete any data that it previously collected, a Twitter spokeswoman said. The cease-and-desist letter, sent on Tuesday, accused Clearview of violating Twitter’s policies." report by the New York Times. If Twitter is accusing them of violating their Privacy Policy, doesn't that extend to the platform's users? I'm not a lawyer.
    – Chris Cirefice
    Commented Jan 27, 2020 at 4:56
  • 1
    I am also aware of the privacy policies. This is a 3rd party scraping data that breaches other company privacy policies. It is also potentially infrigning upon our rights. And to supply them with PII to know what they've scraped (against ToS of these data owners, Facebook, Twitter, etc.) seems a bit like giving them an official document to tie you to your public persona in a centralized manner. That's concerning. Surely giving them a government-issued ID is against some law. Again, IINAL.
    – Chris Cirefice
    Commented Jan 27, 2020 at 4:58
  • The fast that Twitter send a cease-and-desist letter to Clearview is a completely different question than what you asked. That's a dispute between the two companies; personal data may or not be caught in between; it all depends on the TOS of, in this case, Twitter, and if users indemnify themselves for data scraped against Twitter's TOS.
    – BlueDogRanch
    Commented Jan 27, 2020 at 5:01
  • 1
    Me confirm a way for you to get your data? That's your problem. Find a lawyer and sue Clearview. Go all the way to SCOTUS and establish a precedent.
    – BlueDogRanch
    Commented Jan 27, 2020 at 5:07
  • 1
    Many people who's photos are on twitter / facebook have never signed up to the terms of service of those companies.
    – Dave
    Commented Jan 29, 2020 at 10:29
1

You can't

There is a practical dimension here - if you don't tell them who you are, how can they identify (and delete) PII that belongs to you? "Please delete all my data" is a request that is impossible to comply with if they don't know who "me" is.

As for identification, the right to have the data deleted (where you have such a right which is by no means universal) requires you to reasonably prove that you are you. Otherwise, you could request the deletion of my data and only I can do that.

Improve this answer
1
  • There's nothing in their privacy policy that guarantees that they won't keep your government-issued ID. So giving them even more PII to delete the PII they already have when they are clearly a sketchy company makes me concerned that they would just keep e.g. my passport photo to be used for whatever purpose, or even sold. The issue here is trust. Is my only recourse to sue them like David Carroll and come up empty-handed anyway because there are no laws/regulations governing this stuff?
    – Chris Cirefice
    Commented Jan 29, 2020 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .