What legal recourse do we have against Clearview AI&#39;s collection of our personal data and terrifying privacy policy?
<p><strong>TL;DR:</strong> how do we get the data this company collected on us without also giving them our government-issued IDs that they could potentially keep and tie to our &quot;profiles&quot;?</p>
<hr />
<p>A week ago (January 25th), the <a href="https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html" rel="nofollow noreferrer">New York Times reported</a> that <a href="https://clearview.ai/" rel="nofollow noreferrer">Clearview AI</a>, a neural-network-based facial recognition software, has collected and stored over 3 billion names, photos and addresses. The company's software is marketed to law enforcement officials, but the database is filled with publicly-available data scraped from sites like Facebook, Twitter, etc. Concerns are growing that the database could infringe upon personal freedoms, specifically the right to privacy when used in conjunction with state-of-the-art mathematical facial recognition algorithms recently published. I agree with those sentiments, this technology is dangerous.</p>
<p>Now <a href="https://www.forbes.com/sites/kateoflahertyuk/2020/01/26/clearview-ais-database-has-amassed-3-billion-photos-this-is-how-if-you-want-yours-deleted-you-have-to-opt-out/#2ed64f1a60aa" rel="nofollow noreferrer">Forbes has reported</a> on it as well and affirmed those beliefs, highlighting the Clearview AI privacy policy's horrible stipulation for <em>obtaining <strong>your own personal data</strong> that they have collected</em>:</p>
<blockquote>
<p><strong>Contact information</strong></p>
<p>If you would like to ask a question about our privacy policy or exercise your data privacy rights please contact us at: privacy-requests@clearview.ai. This address will connect you to our Data Protection Officer. <em><strong>Please submit name, a headshot and a photo of a government-issued ID to facilitate the processing of your request</strong></em>. Privacy requests can also be submitted via (phone or mail).</p>
<p>...</p>
<p>Requests to exercise data protection rights can be submitted here to privacy-requests@clearview.ai. (see below for further instructions)</p>
<p><strong>These rights are subject to limitations that vary by jurisdiction. We will honor such requests, withdrawal or objection as required under applicable data protection rules but these rights are not absolute: they do not always apply and exemptions may be engaged. Clearview does require that persons requesting the sharing or deletion of their personal data provide us with information to verify their identity and to facilitate the processing of data requests. While most of this information is deleted after the completion of the request, Clearview is required to retain some of this information to maintain a record of data rights requests</strong>. If we do not comply with your request, we will explain why.</p>
<p><strong>Updates to this Policy</strong></p>
<p>Clearview AI regularly reviews our privacy policy and places any updates on this web page. This policy was last updated on <strong>January 23, 2020</strong>.</p>
<p>*<a href="https://staticfiles.clearview.ai/privacy_policy.html" rel="nofollow noreferrer">Clearview AI privacy policy</a></p>
</blockquote>
<p>The language of this policy, combined with the fact that it was updated <em>while the news is breaking about growing concerns about its potential impacts on privacy</em> makes me <strong>very</strong> concerned.</p>
<p>This company, not unlike others in modern history, has scraped or purchased billions of data points containing personally-identifying information (names, photos, addresses, etc.) of American (and likely many other countries') citizens. In order to know what they've collected on us, we have to give them <strong>a government-issued ID</strong>??</p>
<p><strong>How can I (<em>we</em>) get what data this company has on us without further violating our own personal right to privacy?</strong></p>
<p><em>Side note/bonus question</em>: is this kind of software not a direct violation of our Fifth Amendment rights to privacy of personal information?</p>

<p><strong>Breach of GDPR</strong></p>
<p>France, Italy and Greece fined Clearview AI 20 million Euros for the following breaches:</p>
<ul>
<li>Unlawful processing of personal data (breach of Article 6 of the GDPR)</li>
<li>Individuals’ rights not respected (Articles 12, 15 and 17 of the GDPR)</li>
<li>Lack of cooperation with the CNIL (Article 31 of the RGPD)</li>
</ul>
<p><a href="https://techcrunch.com/2022/10/20/clearview-ai-fined-in-france/" rel="nofollow noreferrer">https://techcrunch.com/2022/10/20/clearview-ai-fined-in-france/</a>
<a href="https://techcrunch.com/2022/03/09/clearview-italy-gdpr/" rel="nofollow noreferrer">https://techcrunch.com/2022/03/09/clearview-italy-gdpr/</a>
<a href="https://techcrunch.com/2022/07/13/clearview-greek-ban-order/" rel="nofollow noreferrer">https://techcrunch.com/2022/07/13/clearview-greek-ban-order/</a></p>

<p>You appear to be outraged and offended at the <em>terribly dangerous technology</em> in use,</p>

<blockquote>
  <p>but the database is filled with publicly-available data scraped from
  sites like Facebook, Twitter, etc.</p>
</blockquote>

<p>Publicly available data. You - and all of those other billion users - agreed to allow those platforms to publicly share your data with other platforms or scrapers when you opened an account.</p>

<p>Read the TOSs of Facebook, Twitter, etc. When users of those platforms signup, they agree to allow the platforms to share their data with other platforms. That agreement may be in small print, but it is still there, and it is legally binding. You have no legal recourse against them, except to delete your account. (And TOSs can change, without informing you; read that part, too).</p>

<p>Unless you can show that Clearview broke Facebook Twitter's, or those companies broke their own TOS by allowing Clearview to scrape data, there's nothing to say. Unless you can show that Clearview broke the law or a TOS, you have no legal recourse against Clearview. </p>

<p>If a company did break a TOS, that's more than likely civil law, not criminal.</p>

<p>In any event, Clearview is a different company; you have to abide by Clearview's process to ask them to remove your data. They are not bound by the TOS of another company. They are bound by law, but until the law tries to catch up with technology and privacy (i.e., GDPR), they are free to operate.</p>

<p>If you value your privacy, read the TOS before you sign up with any service, even a library card or driver's license in your own town.</p>

<h2>You can't</h2>

<p>There is a practical dimension here - if you don't tell them who you are, how can they identify (and delete) PII that belongs to you? "Please delete all my data" is a request that is impossible to comply with if they don't know who "me" is.</p>

<p>As for identification, the right to have the data deleted (where you have such a right which is by no means universal) requires you to reasonably prove that you are you. Otherwise, you could request the deletion of my data and only I can do that.</p>

privacy human-rights fifth-amendment security data