On February 10, 2021, the Swedish Data Protection Authority (DPA) fined the police authorities for their use of facial recognition.
The Swedish DPA began its investigation in early 2020 and found that the application was used by police employees between autumn 2019 and March 2020. However, Clearview’s system was used by the police authority without prior authorisation, which led the DPA to conduct further investigations. It was subsequently confirmed that the app was used under operational conditions (i.e., to identify individuals) by employees of two police authorities.
Following investigation, the Swedish Data Protection Authority published its decision.
First of all, the DPA established that the Swedish police was responsible for the data processing carried out by its employees as the application was used in the line of duty.
Secondly, it confirmed that the police authority had an obligation to put in place technical and organisational measures to ensure the legal conformity of data processing. It therefore stated that illegal use of the Clearview AI application by two separate police authorities shows that internal procedures were not sufficiently robust, and that in particular there was a lack of education around this issue, and internal strategy.
More specifically, with regard to how the application was used, the DPA confirmed that the police did convert photographs into biometric data as a result of conducting the data processing. Moreover, the police were found responsible for transferring these data to the application without first checking the conditions that the application requires for the processing of data (in terms of storage, transfer, biometric matching and disclosure). According to the Swedish DPA, the guidelines provided by Clearview did not indicate that using the application under these conditions complied with the requirement that it be absolutely necessary and strictly proportional. Finally, the DPA concluded by decrying that where data processing by Clearview AI was concerned, no control was exercised nor other bodies consulted, even though an impact assessment would ordinarily absolutely be required.
This decision marks the first time that police forces have been challenged for using Clearview’s App in Europe, whilst revelations about its use around the world has led to major protests. On the other hand, this is not the first time that the American Startup has been the subject of an claim since, following an individual complaint, another decision regarding the deletion of data stored by Clearview AI was also issued by the Hamburg DPA (Germany) in January 2021.
The Swedish police were fined 2,500,000 Swedish kronor (approximately 250,000 euros) for using the Clearview AI application. This fine is accompanied by an obligation that the police take measures to ensure that data processing complies with the constitution. The police must also provide information before September 15, 2021 about the data that was transmitted to Clearview AI and take measures to ensure that these data have been deleted from the application.
MB
