Facts
Clearview AI, a US company, built a facial recognition tool on a database of more than three billion images taken from social media platforms and other publicly available websites. A user uploads a photo of a face, and the tool finds other images of that person collected from the internet, with links to where they appeared. Between October 2019 and March 2020 Clearview let some Australian police forces trial the tool, and they searched using images of people in Australia. The OAIC investigated jointly with the UK Information Commissioner's Office (ICO). Australian Information Commissioner Angelene Falk made her determination on 14 October 2021, and it was announced on 3 November 2021.
What was the legal question in Commissioner initiated investigation into Clearview AI, Inc. (Privacy)?
Clearview argued that the information it handled was not personal information and that, as a US-based company, it was outside the jurisdiction of the Privacy Act 1988. It also said it had stopped offering its services to Australian law enforcement shortly after the investigation began. The Commissioner had to decide whether the Act reached a foreign company with no Australian office that gathered images from the internet, whether facial images and the biometric templates made from them were personal and sensitive information, and whether collecting them without consent or notice was consistent with the Australian Privacy Principles (APPs).
What did the Office of the Australian Information Commissioner (OAIC) decide?
The Commissioner found that Clearview had breached the Privacy Act by collecting sensitive information without consent (APP 3.3), collecting personal information by unfair means, failing to take reasonable steps to notify individuals of the collection, failing to take reasonable steps to ensure that the information it disclosed was accurate, and failing to implement practices, procedures and systems to ensure compliance with the APPs (APP 1.2). She described the covert collection as 'unreasonably intrusive and unfair', noting that biometric identity information 'cannot be reissued or cancelled'. Clearview was ordered to stop collecting facial images and biometric templates from individuals in Australia and to destroy those it had already collected.
Why does Commissioner initiated investigation into Clearview AI, Inc. (Privacy) matter?
The determination's real test was the Australian link. In May 2023 the Administrative Appeals Tribunal (AAT) held that Clearview carried on business in Australia because its web crawlers requested images from servers located in Australia, while collecting images of Australians from servers abroad did not count towards that link. That test can bring within the Act foreign AI developers that harvest Australian-hosted content without having an office or revenue in Australia. At the time the Commissioner could not impose fines herself, and she did not apply to a court for a penalty in this case.
Related stages
Clearview applied to the AAT on 3 November 2021. In Clearview AI Inc and Australian Information Commissioner [2023] AATA 1069 (8 May 2023) the AAT confirmed breaches of APP 1.2 and APP 3.3, found no breach of the other principles before it (APP 3.5 and 5.1) and left remedies for a separate hearing. Clearview withdrew in August 2023 before any remedial orders were made. On 21 August 2024 Privacy Commissioner Carly Kind decided to take no further action and stated that the 2021 determination still stands. The parallel UK case is covered in a separate entry.