Rightly or wrongly, people knowingly and willingly give their photos to Google, Facebook etc, but not to this bunch.

And keep on doing it until the data is removed.

The problem for Clearview is that this will probably mean re-creating their databases from scratch from the new input datasets (with removed images), which is a huge amount of processing work, assuming they iteratively add new images over time.

And yes, people giving personal images to Google/Facebook does not mean they ever consented to this use which is very different from why people upload to social media.

And also why we shouldn't upload to social media, unless we have locked things down massively, which unfortunately the social media businesses don't want to make easy.

I can see clearview trying to resist this with a "how are we supposed to know who's British?"

They'll know, they've been training the AI with our data after all

"The question of whether computers can think is like the question of whether submarines can swim." - Edsger W. Dijkstra

Yeah, I don't think that's going to fly. It's their problem. If they can't figure out how to operate their business without breaking the law, then they don't get to operate their business.

Don't need to. Just delete the data for everyone you cannot prove is some other nationality.

The same goes for Google. They do not need to know who I am to delete what they know about me. They can simply delete records for all people they cannot identify. These days, that list must consist almost exclusively of people who do not want to be tracked by Google.

"how are we supposed to know who's British?"

The images will show our famous stiff upper lips. (Admittedly used to hide our awful teeth).

Just because I make a piece of data freely available on the Internet, that does not make it public domain. It can still be legally protected in all kind of ways, even if it's not protected by technical means.

Companies that gather data from the Internet ought to be made painfully aware of this fact: you still need a license to use any data that's not yours, and if it's not clear whether there is a license to be had, that doesn't mean the piece of data is up for grabs; it means that if you grab it you're in an ambiguous situation at best, and could very well land in court.

Seems a pointless headline grabber by the ICO - I'm assuming that by design this company has no UK/EU assets or presence.

So the ICO is going to make them stop HOW exactly?

If they ever want to do business in the UK, they'll care.

In other words they can't right now legally sell to ANY business in the UK, or that has a UK subsidiary that would use their technology without automatically becoming liable to pay the fine.

...and adds data source to existing library

-> failing to have a lawful reason for collecting it

Why is it lawful for Google to collect this and Clearview not? It seems that the ICO is ignoring the elephant in the room. I have never had much time or respect for the ICO. It is a chair-polishing unit of government.

The distinction is between indexing for search, and capturing/saving process to derive a biometric class of identifier. Google can still do the latter of course, but if they do it's just not public knowledge yet.

Given Google's history I would be surprised if they weren't doing this.

Consent. If I put a photo on Google's site, I give consent under Google's terms for its use there. I do not give carte blanche to every random company to take it and use it how they see fit.

And, if Google were to sell that data, they'd still need explicit, informed consent for that particular use too.

unless, usually, you consented to allow you data to be shared "with trusted and carefully selected third parties".

Bit like signing up to virtually any UK government system ... to paraphrase "we will share you data with anyone from any security organisation, local council, pet rescue organisation, private parking mafia and anyone else who knows and will pay us for your data ..."

That would fail the informed consent test, because the list of partners is not enumerated...

This is all too true. There is always a 'need' word in their too - if it is necessary we will share your data. Need for who? Not me.

You forgot they will sell it to Palantir and its evil boss Peter Thiel.

Er hello? Google scrapes the web. That is what it does.

Consent. If I put a photo on public internet, I give consent to everybody and his cat... erm, dog, to see it and do whatever he wants with it.

If you don't like it, don't make the photo available on public internet. Use a private cloud under your control.

Rubbish. Otherwise you could create a news site by just scraping and collating other news sites, for example.

The principle that content on the web can only be consumed in accordance with the license, and not freely copied and republished is well established.

See for example [1]here .

[1] https://www.stockphotosecrets.com/questions-answers/can-i-use-photos-from-facebook.html

It's a difficult question. As a society, we don't really yet have a universally-accepted consensus on how privacy works on the Internet. And legislation usually trails societal consensus, for good reasons.

In this case, the difference is that while it's fairly obvious that nobody wants other people to be able to run face recognition on them without their consent, it's not obvious at all what exactly people want Google to index - even though a reverse GIS looks a lot like what Clearview is doing. I'm fairly sure that everyone at the ICO is well aware that this distinction is rather nebulous, but what can they do about that? Come up with arbitrary rules that would likely discontent everyone?

Until we, the everyday people of the Internet, get into some kind of agreement on exactly what's acceptable and what isn't, I wouldn't blame governments too much for failing to evict elephants from rooms.

"Why is it lawful for Google to collect this and Clearview not?"

Simple answer is that it's not lawful for Google to collect this type of data either

I agree. Yet the chair polishers don't do anything about it.

But they're doing it anyway. The law? We've heard of it and we'd gladly pay the fine. It's the cost of doing business.

I have never uploaded my image to the internet, but I have been tagged in photo's by friends and family. They are all very aware now that they were out of order for doing that. The damage was done though and cannot be undone.

It's a bit of a stretch for Clearview to consider that all of the images they gouged from the internet had an implicit agreement behind them, as many like me had no say in whether they could be uploaded. They assume too much.

And if they had approached the custodians of the original images offering money for them, I guess £7 million would be a snip. More like £7 billion for that kind of data.

-> I have never uploaded my image to the internet, but I have been tagged in photo's by friends and family.

This point you are raising here is crucial, and it doesn't even occur to many people. Your name and your photo is now in Clearview's database (and other databases which you are unaware of). The surveillance state is built on this. Just because it is a private company that has this data, do not think that the state does not have access to it. At the drop of a hat if the state comes round to Clearview and says 'can you match this photo?', Clearview is not going to say 'we do not do that sort of thing'. They are now party to the surveillance state.

Yup.

I had a FaceMelta account with a pseudonym. A friend published a picture of me and tagged it with both my real name, and my pseudonym, enabling both to be linked. Assuming Clearview stole that, it could now find me in random images that just happen to contain me. I have no idea if those images exist, so cannot have given consent.

It's an interesting legal challenge. I remember years ago, a German fellow was at a motor race with a lady that was not his wife. His wife saw the image, wasn't impressed, and filed for divorce. The man sued the broadcaster, and won for infringing his privacy. From memory, case relied on what's a reasonable expectation of privacy at a public, or semi-public event.

But this is a good step by the ICO. Now it just has to repeat the process against every data slurper and aggregator that thinks privacy is less important than profit. Personally I think there's a couple of quick fixes. Data controllers are legally responsible for data accuracy, so should automatically send their records to data subjects to check. Obviously this would cost them, and reveal the amount of data held. All executives at the slurpers should also be required to maintain public profiles detailing every class of data held and processed. If they think it's ok to spy on our browsing habits, they should have no problem with publishing their own.

Yep, it's much like Whatsapp taking my number from other people's Contacts with their permission but not mine.

Exactly.

"I have never uploaded my image to the internet, but I have been tagged in photo's by friends and family. They are all very aware now that they were out of order for doing that. The damage was done though and cannot be undone."

That was your 1st mistake. What you should of done was get a total random picture of a person (preferable deceased) then upload it to as many sites as possible attached to your name. You could even ask your nearest and dearest to add some photoshopped images of them with your avatar.

It may not be possible to beat the man, but you can at least confuse the hell out of hime

No problem.

Let's gets a group follow them taking photos 24/7 when in public, and post saying where they were, who they were with, what they ate, what time they went to the toilet etc.

No problem with that, it's public after all.

That sounds like a clear case of harassment.

Photographing people in public without their permission is allowed in the UK and the US. Following them around continually photographing them is materially a different thing.

There is, I believe a caveat to that which is whether you are using the picture for profit or not. If yes, then you should have the permission of the people in the picture, whether or not you are standing on public ground when you take the image.

I don't understand the thumb downs but it's a free world I guess...

"DO I NEED PERMISSION TO TAKE PICTURES FOR COMMERCIAL PURPOSES?

In order to sell your photos to a media library or to use your photos to promote or sell products or services, you will often be required to obtain a signed model release form from any identifiable person featuring in the image. Although it is not illegal in the UK to take an identifiable photo of a person in a public place, media libraries and agencies often require you to have had permission to take the photos regardless."

https://www.pauldavidsmith.co.uk/photographers-rights/

No, you don't. Otherwise there would be no pictures of celebs doing things they don't want pictured in the newspapers.

Picture of a footballer coming out of a restaurant with his mistress, sorry no permission. Picture of him beating up some bloke on the street because he looked at him funny, sorry no permission. ETC.

Yes you do. Journalism has an exemption to GDPR

https://bookdown.org/fede_caruso/bookdown/the-journalistic-exemption-in-the-gdpr.html

That sounds like a clear case of harassment.

Why would they feel harassed? I think we should crowd fund some private investigators to do this, and publish the results in near-realtime. Sure, it might be considered stalking, but it's not really any different to what these scumbags do. If they're concerned about their privacy being violated, stop violating ours.

What are the odds that they won't pay the fine or do anything to rectify this since they're headquartered in NY?

Has anyone read the judgment? Are they being asked to delete the photos/images or are they also being ordered to delete the derived hashes etc that could still be used to later identify people in new photos?

Just because I make a piece of data freely available on the Internet, that does not make it public domain. It can still be legally protected in all kind of ways, even if it's not protected by technical means.

Companies that gather data from the Internet ought to be made painfully aware of this fact: you still need a license to use any data that's not yours, and if it's not clear whether there is a license to be had, that doesn't mean the piece of data is up for grabs; it means that if you grab it you're in an ambiguous situation at best, and could very well land in court.

The article says one of the reasons for the fine is "failing to have a lawful reason for collecting it". ICO's own article actually says "failing to have a lawful reason for collecting people’s information".

It is not 100% clear whether this is a reference to: (a) failing to have any valid/defined legitimate purpose(s) (GDPR Article 5(b)), or (b) failing to have any valid defined lawful bases/conditions (GDPR Articles 6(1) and 9(2)).

I assume the ICO is referring to GDPR Article 5(b) "legitimate purpose(s)".

You'd expect the ICO to use the correct legal terminology in their press release so as to be clear as to which of these they were referring to. Then again it is the ICO...

It should be $7.5B. Then they might stop scraping images of all and sundry without a thought to the damage they are doing.

suck on this--> [see icon]

"Clearview AI is not subject to the ICO's jurisdiction, and Clearview AI does no business in the UK at this time."

"My company and I have acted in the best interests of the UK and their people by assisting law enforcement in solving heinous crimes against children, seniors, and other victims of unscrupulous acts."

Those two statements contradict each other