What legal recourse do we have against Clearview AI&#39;s collection of our personal data and terrifying privacy policy? TL;DR: how do we get the data this company collected on us without also giving them our government-issued IDs that they could potentially keep and tie to our &quot;profiles&quot;? A week ago (January 25th), the New York Times reported that Clearview AI, a neural-network-based facial recognition software, has collected and stored over 3 billion names, photos and addresses. The company's software is marketed to law enforcement officials, but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc. Concerns are growing that the database could infringe upon personal freedoms, specifically the right to privacy when used in conjunction with state-of-the-art mathematical facial recognition algorithms recently published. I agree with those sentiments, this technology is dangerous. Now Forbes has reported on it as well and affirmed those beliefs, highlighting the Clearview AI privacy policy's horrible stipulation for obtaining your own personal data that they have collected: Contact information If you would like to ask a question about our privacy policy or exercise your data privacy rights please contact us at: privacy-requests@clearview.ai. This address will connect you to our Data Protection Officer. Please submit name, a headshot and a photo of a government-issued ID to facilitate the processing of your request. Privacy requests can also be submitted via (phone or mail). ... Requests to exercise data protection rights can be submitted here to privacy-requests@clearview.ai. (see below for further instructions) These rights are subject to limitations that vary by jurisdiction. We will honor such requests, withdrawal or objection as required under applicable data protection rules but these rights are not absolute: they do not always apply and exemptions may be engaged. Clearview does require that persons requesting the sharing or deletion of their personal data provide us with information to verify their identity and to facilitate the processing of data requests. While most of this information is deleted after the completion of the request, Clearview is required to retain some of this information to maintain a record of data rights requests. If we do not comply with your request, we will explain why. Updates to this Policy Clearview AI regularly reviews our privacy policy and places any updates on this web page. This policy was last updated on January 23, 2020. *Clearview AI privacy policy The language of this policy, combined with the fact that it was updated while the news is breaking about growing concerns about its potential impacts on privacy makes me very concerned. This company, not unlike others in modern history, has scraped or purchased billions of data points containing personally-identifying information (names, photos, addresses, etc.) of American (and likely many other countries') citizens. In order to know what they've collected on us, we have to give them a government-issued ID?? How can I (we) get what data this company has on us without further violating our own personal right to privacy? Side note/bonus question: is this kind of software not a direct violation of our Fifth Amendment rights to privacy of personal information?
Breach of GDPR France, Italy and Greece fined Clearview AI 20 million Euros for the following breaches: Unlawful processing of personal data (breach of Article 6 of the GDPR) Individuals’ rights not respected (Articles 12, 15 and 17 of the GDPR) Lack of cooperation with the CNIL (Article 31 of the RGPD) https://techcrunch.com/2022/10/20/clearview-ai-fined-in-france/ https://techcrunch.com/2022/03/09/clearview-italy-gdpr/ https://techcrunch.com/2022/07/13/clearview-greek-ban-order/
Is it GDPR compliant that I can't access the account that I created and the personal data that I shared because "I haven't completed their internal pre-qualification process"? Article 15 defines a “Right of access to the data subject” but it's difficult to see how this could be construed as a right to log into a specific website. Common sense suggests this would be a very bad idea. If they are willing to provide the data through another means (say a report or data dump of some sort), the obligation would seem to be met. In fact, article 15(3) even states that data controllers should merely provide the information in a “commonly used electronic form” (i.e. not necessarily through access to their systems or whatever form they are using internally for the processing). Have you asked for that and would you be satisfied by that resolution? Is it GDPR compliant that their answer to my deletion request is "We will delete the data..." The text of article 17 (right to erasure) explicitly specifies that such a request must be honored without “undue delay”. Article 12, which defines some of the modalities for the rights to access, rectification or erasure by the data subject, also provides that controllers shall “provide information on action taken on a request […] without undue delay and in any event within one month of receipt of the request”. You haven't provided any time frame and I don't think there is anything wrong with acknowledging the request by promising they “will” do it but in light of article 12, it seems you would indeed be entitled to know once they have actually taken further action. However, you implied you might want to access the data first and it's not clear to me whether you explicitly invoked the GDPR in earlier communications. So I would clarify and reiterate my request (access or erasure) and ask them for explicit confirmation once it has been satisfied.
We cannot dispense personalized legal advice: that is what your attorney is for. However, I agree with your analysis that this is most likely covered by fair use, and indeed it is not obvious that you have taken anything that is protected. There is no creativity behind a number such as entries in the &quot;I did N pushups&quot; column. The arrangement of data into a web page passes the smidgen of creativity test, but &quot;210&quot; is not a creative number. The terms of service of a website cannot negate your right to use the website however you want in a non-infringing way. If your use is &quot;fair use&quot;, then they can't tell you that you can't use it. In case it turns out that &quot;fair use&quot; fails, the matter would hinge on what exactly the TOS says. They may have granted you permission to make use of their &quot;information&quot;. So there are three positive avenues for you to consider: not protected, fair use, and permitted. A practical difficulty is that a university lawyer is only interested in the interests of the university, and they are as likely to say &quot;don't do that&quot; or &quot;get permission&quot; as they are to say &quot;that is fair use&quot;. You can hire a lawyer who is paid to care about your interest, though there is never a guarantee that the lawyer's advice is correct. I think it is likely that the lawyer will tell you to not say anything until legally forced to, given the apparent rebuff of your request for special permission.
Federal and state laws do protect a variety of different types of personal information in particular contexts, but there isn't really any information that is necessarily personal and protected from disclosure in all contexts. For instance, the Health Insurance Portability and Accountability Act generally protects a person's health records from unnecessary disclosure, and the Federal Education Rights and Privacy Act generally protects a student's educational records from unneccessary disclosure. But that doesn't mean that all of an American's health information is protected, or that all of the information that a hospital holds about an American is protected. The hospital can typically disclose the fact that it is treating a specific person, and if that person provides his health records to a government employer, that employer may be required to produce them in response to a request under the Ohio Public Records Act. But Facebook isn't a health-care provider, so it isn't required to protect medical records, and it isn't a school, so it isn't required to protect educational records. At the federal level, I don't know of any privacy laws that require it to maintain the privacy of its users' information, though it may be required to do so under state laws, or as a contractual matter because of its privacy policy. But that doesn't mean it has nothing to worry about. Like any business in the United States, it is prohibited from engaging in deceptive trade practices, so it can't make broad promises to protect users' privacy when it has no intention of honoring them. That's why it ended up paying $5 billion for privacy violations in the past and remains under court orders requiring it to better protect users' data. Further, Facebook has users all over the world, so it is required to comply with the international privacy regulations like GDPR that can be far more stringent.
If the lawyer has legitimate concerns, his first port of call would be the ICO https://ico.org.uk/. Before the ICO will take his complaint further he'll have had write to you expressing his concerns and received a written response that presumably he is unhappy with, and wants to take the issue further. Most companies have a data compliance team who will have policies and procedures to log breaches like this and decide what course of action to take in response. Not every breach needs to be brought to the attention of the ICO, and they have a handy self assessment tool to see if you should report the breach. https://ico.org.uk/for-organisations/report-a-breach/ In your situation, I don't think this constitutes a serious breach which will require investigating. It's simply an admin error. If it is unlikely to pose a risk to any of the individuals they will say something like: You should keep an internal record of the breach as detailed in Article 33 (5) of the GDPR, including what happened, the effects of the breach and remedial actions taken. The definition of risk according to the ICO is: "This risk exists when the breach may lead to physical, material or non-material damage for the individuals whose data have been breached". So in this case I'd assume a simple apology (Bcc'd :) ) and a record of what happened, how it happened, and the action taken to prevent it happening again should suffice.
gdpr The obligation to provide a privacy policy stems from GDPR Articles 13 and 14. When the information has to be provided depends on when personal data is obtained. Information under Art 13 (data obtained directly from the data subject) must be provided at the time when the personal data is being obtained. Since most websites will obtain personal data pretty much continuously, they will likely have to keep this information available continuously as well. Information under Art 14 (data obtained from other sources) must be provided within a reasonable time after obtaining the information, but at the latest when the data subject is contacted. So this depends very much on when data is obtained, and whether personal data is obtained directly from the data subject. E.g. a website generally obtains some personal data directly from the data subject every time a user visits the page, thus it will likely have to keep a minimal privacy policy available all the time, for all visitors (whether registered or not). In contrast, for individual instances of personal data processing, it may be sufficient to provide the information only once. For example, if we ask a user to enter information to enter a raffle, the privacy policy regarding the raffle might only have to be shown in context of the form where the user can enter data. However, all such approaches stink. Doing the bare minimum that's explicitly required is an easy way to run afoul of more foundational GDPR principles, e.g. the Art 5(1)(a) requirement that all data processing must be transparent (compare also Art 12(1)), and the Art 5(2) accountability principle: the data controller must be able to demonstrate how what they're doing is compliant. The Art 13 and 14 time frames are the latest point in time at which this information has to be actively provided to the user (compare also the guidelines on transparency WP260). But it would be entirely possible for a court to argue that the transparency principle implies that all such information must be available to the user for the duration of all related processing activities, possibly both before and after the data subject was explicitly informed. The WP260 document also emphasizes that the data controller must take the reasonable expectations of the users into account, and most users expect a “privacy policy” link in the footer of every page. As a more general point, the GDPR never requires that data subjects agree to a privacy policy. A privacy policy is largely unidirectional information, not a contract. Under some circumstances, the data controller may rely on consent as a legal bases for processing, and will then have to obtain consent from the data subject. In the course of this, it is necessary to provide information about the specific processing activities for which consent is being asked. Usually, this is done by a short summary with key information, and a link to the privacy policy for the full details (a layered privacy notice, compare the WP260 document and the EDBP guidelines on consent 05/2020). But valid consent can only be obtained for specific processing activities, not for a bundle of processing activities or a privacy policy in its entirety.
Privacy against publication of criminal convictions has been considered in the High Court in NT1 &amp; NT2 v Google LLC [2018] EWHC 799 (QB), if I may run the risk of posting a legal citation myself. But note that the claimaints there are anonymized, as often happens in criminal trials as well. In some cases, the court may give an injunction against disclosing names or details, and can hand down both a public and a private judgement, with the latter being a restricted document that does have the identifying details. So this question could only apply to mentions of criminal process where the accused is actually identified. (And I think just saying &quot;R v Smith&quot; is not enough - the posted or linked text would have to give some identifying detail about which Smith it is, the nature of the crime, etc.) I have no qualms at all about talking about NT1 and NT2. The claimants brought a case against Google for making available information about their long-spent convictions, including on GDPR grounds although it took place just before the implementation of GDPR in UK law. Dealing with that argument under the prior legislation, the judge found that of the various exemptions claimed by Google, the condition The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject. (found in the Data Protection Act 1998, Schedule 3, paragraph 5, implementing the Data Protection Directive that preceded GDPR) applied, because of a longstanding principle for criminal conduct. The idea is that (paragraph 111): A person who deliberately conducts himself in a criminal fashion runs the risk of apprehension, prosecution, trial, conviction, and sentence. Publicity for what happens at a trial is the ordinary consequence of the open justice principle [...] The same must be true of the details of the offending, and other information disclosed in open court, including information about himself which a criminal reveals at a trial or in the course of an application. The core principles are the same as the carve-out from defamation law for the fair and accurate reporting of criminal proceedings (paras 44-49). That &quot;made public&quot; condition can now be found in a slightly different context in the Data Protection Act 2018, Schedule 1, Part 3, paragraph 32, which mirrors Article 9(2)(e) of the GDPR for the purpose of Article 10: This condition is met if the processing relates to personal data which is manifestly made public by the data subject. Since this is virtually the same condition of European provenance, in the same context of surrounding rules, I think the precedent is a good guide. For courts themselves, law reports, and journalism or scholarship, there are other specific grounds to rely on. Individual Stack Exchange posters are surely covered under the general exemption for posting on social media in a private capacity, GDPR 2(2)(c) as interpreted through its Recital 18. For the site itself, as in the case of NT1 and NT2, there could well be a legal claim made about the inclusion of criminal conviction information in a posted answer. (In general, such a post, being free text, could contain all sorts of defamatory statements or other objectionable content.) The court would have to look at the competing interests and the level of harm. NT1 was not successful but NT2 was. The example scenario, where we are talking about a very brief mention of a criminal case, cited because it illustrates a legal point rather than because there's anything relevant about the person mentioned, is quite far from the grounds complained of by NT2. For NT2, there was a newspaper article in which he was &quot;quite inappropriately, portrayed as one of a rogues' gallery of serious criminals&quot; (para 188), eight years after the end of his sentence, and it was this that he wanted removed from search results. In particular, the academic exemption (para 13) seems strong, in the same way that it would be for a publisher of legal academic content. The test of &quot;substantial public interest&quot; does not apply, because this exemption comes through paragraph 36 in the case of criminal convictions; it's enough to show a reasonable belief that publication would be in the public interest. Google was not able to rely on the &quot;journalism&quot; version of this exemption (again, under the prior law) because they are a totally generic search engine for all kinds of data and purposes (para 100 of the 2018 judgement). The public interest test, and the accompanying &quot;legitimate interest&quot; for the data controller, do not seem too difficult in this example.
You have an agreement with the store that allows you to use scan and go technology. Part of that agreement a bit that says we may ask you to help us confirm that the service is working effectively by allowing us to check your goods against the scanner or to re-scan your shopping They also say that they are entitled to withdraw your right to use the Scan and Go service at any time if you do not comply with these Terms and Conditions. If we do that, the legal agreement created between ASDA and you under these Terms and Conditions will come to an end immediately, although any relevant statutory rights that you may have will not be affected. More generally, ASDA reserves the right to withdraw the Scan and Go Service at any time, at its sole discretion You have implicitly consented to a brief stop for a rescan. I don't see any implication that they assert a right to search your person. You can refuse a re-scan and they can process you like an ordinary customer. As for shoplifting, as this article summarizes, security can make a citizen's arrest if they suspect that you have committed a crime (theft). They have to have reasonable grounds for thinking that an arrest is necessary to prevent the loss. Hence they can detain you until the constable arrives.