US facial recognition firm faces ?17m UK fine for ?serious breaches?

A US company that gathered photos of people from Facebook and other social media sites for use in facial recognition by its clients is facing a £17m fine after the Information Commissioner's Office (ICO) found it had committed "serious breaches" of data protection law.

Clearview AI, which describes itself as the "world's largest facial network", allows its customers to compare facial data against a database of more than 10bn images harvested from the internet.

The database is "likely to include the data of a substantial number of people from the UK and may have been gathered without people's knowledge from publicly available information online, including social media platforms", the ICO said.

Clearview's technology had been offered on a "free trial basis" to UK law enforcement agencies, the data regulator added. The company said the ICO's findings were "factually and legally incorrect", that it was considering an appeal, and that it had only provided publicly available information to law enforcement agencies.

It said Clearview had broken data protection law by failing to process the information of people in the UK in a way they were likely to expect or that was fair. The company did not have processes in place to stop the data being retained indefinitely, nor did it have a lawful reason to collect the information.

Clearview also allegedly failed to meet the higher data protection standards required for biometric data under general data protection regulations and did not inform people in the UK of what was happening to their data.

The ICO said people who asked for their data to be deleted may have been put off from going through with the request because Clearview asked for additional personal information, including photographs.