10 ms·

France latest to slap Clearview AI with order to delete data

84 points by arkadiyt 5y ago

dmortin 5y ago
Let's say Clearview says they are deleting the data. How could France make sure the data is actually deleted? Is it possible without perusing Clearview's source code and accessing its servers?
- hlbjhblbljib 5y ago
  They'd also have to be able to identify pictures of French people. Perhaps a large US-based corporation could help them developing a tool to do it? They'd need lots of examples first.
deleted 5y ago
[deleted]
throwaway277432 5y ago
I requested my data back in March 2020 when they were on HN, never got an answer. They wanted me to upload a photo ID to verify my identity and I was stupid enough to comply. One commenter said: This is a case of 'never click "opt-out" on spam'. Clearview is not to be trusted. One should not go through their process. They are not likely to delete the data, and if they have none, they are likely to create a profile for you. I should have listened, lesson learned.
- csdvrx 5y ago
  Your comment is extremely point on, yet was dead, so I vouched for it. I think you perfectly highlight the difficulty of the current opt-out process. I do not know how it should be done without revealing more information, except maybe by using an attorney that would have the legal power to act in your name while only revealing his information, and not yours.
- hoppla 5y ago
  Also, they do not recognize Norway as part of EU and do not give Norwegians the choice to opt out. I have not checked since 2020 though.
  - deleted 5y ago
    [deleted]
  - Fnoord 5y ago
    Norway is not part of EU. Perhaps you meant something different?
    - hoppla 5y ago
      Yes of course, Norway is not a full member of the EU, but through the EØS agreement, GDPR also apply for Norway
shakna 5y ago
> Clearview AI does not have a place of business in France or the EU, it does not have any customers in France or the EU, and does not undertake any activities that would otherwise mean it is subject to the GDPR. > To be clear, Clearview AI has not violated any law nor has it interfered with the privacy of Australians. Clearview AI does not do business in Australia, does not have any Australian users. > The UK ICO Commissioner’s assertions are factually and legally incorrect. The company is considering an appeal and further action. Clearview AI provides publicly available information from the internet to law enforcement agencies. To be clear, Clearview AI does not do business in the UK, and does not have any UK customers at this time. > Clearview AI’s technology is not available in Canada and it does not operate in Canada. This time, and the last three times, Clearview have made the same legal argument. That because they have no physical basis in a country, and because their customers aren't in that country (though several times that has occurred post-breach), they cannot possibly have breached that country's laws. Despite the privacy laws of every nation being around the _citizen_, not their physical location. All four places have extraterritoriality baked into their privacy laws, and all four have trade agreements with the US in place that could mean that they could ask the US to enforce compliance and make it into a diplomatic issue. How many more times do their lawyers have to be told the same thing before they try and come up with a new argument?
- tempnow987 5y ago
  Wishing something is true doesn't make it true. How many more times do these bodies need to pass "orders" that don't result in any action before they come up with a new approach? The US does not have GDPR. Period. Flat out. Full stop. Once you understand that, things will make a lot more sense. And no, extraterritoriality means absolute zero here. That french citizen traveling in America? Heads up, US Customs does not have to respect to GDPR. Neither does the walmart he shops at. Neither does Amazon if he orders something online. Claiming they do is weird, that's not how it works. Before we are snarking about clearview having to come up with new arguments, let's evaluate how well their current arguments are working? Pretty darn well. And my guess is the US government, rather than shutting them down, will PAY them to do their stuff, ESPECIALLY on overseas nationals. This is exactly the type of big government "anti terrorism" surveillance style databases govts love.
downWidOutaFite 5y ago
Clearview AI is one of the main arguments I have used to convince many friends and family to stop posting face pictures to the web, especially of children who cannot consent. The social web is definetly a poorer experience without pictures, but this is the way our capitalist masters have decided to destroy our commons.
jackjeff 5y ago
How is France (or the EU) going to enforce their extra territorial law on a US company with no business interests in the EU? > Enforcing fines on companies without an EU base does present a regulatory challenge, however. Understatement of the year.
- tormeh 5y ago
  If the company doesn't do business in the EU (i.e. has no EU customers), there are still some things that can be done. Maybe target suppliers to Clearview? The cloud providers are obvious targets. Put out arrest orders for Clearview employees? Maybe try to have the US govt enforce it?
- xiaodai 5y ago
  GDPR
  - matt74827289 5y ago
    How does GDPR allow a foreign entity to punish or fine a company based entirely in the USA? I am genuinely curious, I have wondered this for ages. Every resource I have looked at says that as a US business I need to comply with GDPR, and that I can face fines if I don't. But I have never seen the mechanisms in which those fines can be enforced. Is the US government enforcing those fines?
    - ViViDboarder 5y ago
      If you do business in the EU, you likely have money there. Might be hard for a company that isn’t international to be fined though. However, California has privacy laws now and could fine a US company.
- hankman86 5y ago
  There are ways. How about: arrest ClearView top brass on their next visit to Europe? Remember the Huawei heir who got sent to jail on a trip to Canada. Do the ClearView head honchos really want to be confined to travelling within the US? So while it might be difficult to go after ClearView in the US, France (and the rest of the EU, the UK, Canada, Australia) would become no-go zones for ClearView staff. Not to mention that these countries could also seize assets owned by ClearView leadership, as long as these are within their jurisdiction. In an interconnected world, it is exceedingly difficult to avoid such scenario. The question is rather: would the US step up and put pressure on the French if events would unfold in this way?
kmlx 5y ago
> Clearview sought to suggest the company is not subject to the GDPR — although the regulation is extraterritorial in scope, meaning it is applicable and (at least in theory) enforceable outside the EU’s borders in instances when EU people’s data has been processed in violation of the rules. GDPR applies also outside of the EU? who exactly thought this one up? how can the EU possibly think it can enforce this and does the EU think europeans should be subject some special rules when in a foreign country?
- deleted 5y ago
  [deleted]
- donkarma 5y ago
  if you murder someone in the United States and fly back to the UK then they'll sure as hell try to extradite you
  - ahupp 5y ago
    You generally can't be extradited unless it's considered a crime in both places.
  - UncleEntity 5y ago
    Because they’d be violating US law…
  - onphonenow 5y ago
    Which is fine because under UK law murder is a crime. The US does not have GDPR. The US has no law giving weight to these data commissioner orders (which appear to target US companies)

84 points by arkadiyt 5y ago

Let's say Clearview says they are deleting the data. How could France make sure the data is actually deleted? Is it possible without perusing Clearview's source code and accessing its servers?

hlbjhblbljib 5y ago
They'd also have to be able to identify pictures of French people. Perhaps a large US-based corporation could help them developing a tool to do it? They'd need lots of examples first.

deleted 5y ago

[deleted]

throwaway277432 5y ago

I requested my data back in March 2020 when they were on HN, never got an answer. They wanted me to upload a photo ID to verify my identity and I was stupid enough to comply. One commenter said: This is a case of 'never click "opt-out" on spam'. Clearview is not to be trusted. One should not go through their process. They are not likely to delete the data, and if they have none, they are likely to create a profile for you. I should have listened, lesson learned.

csdvrx 5y ago
Your comment is extremely point on, yet was dead, so I vouched for it. I think you perfectly highlight the difficulty of the current opt-out process. I do not know how it should be done without revealing more information, except maybe by using an attorney that would have the legal power to act in your name while only revealing his information, and not yours.
hoppla 5y ago
Also, they do not recognize Norway as part of EU and do not give Norwegians the choice to opt out. I have not checked since 2020 though.
- deleted 5y ago
  [deleted]
- Fnoord 5y ago
  Norway is not part of EU. Perhaps you meant something different?
  - hoppla 5y ago
    Yes of course, Norway is not a full member of the EU, but through the EØS agreement, GDPR also apply for Norway

shakna 5y ago

> Clearview AI does not have a place of business in France or the EU, it does not have any customers in France or the EU, and does not undertake any activities that would otherwise mean it is subject to the GDPR. > To be clear, Clearview AI has not violated any law nor has it interfered with the privacy of Australians. Clearview AI does not do business in Australia, does not have any Australian users. > The UK ICO Commissioner’s assertions are factually and legally incorrect. The company is considering an appeal and further action. Clearview AI provides publicly available information from the internet to law enforcement agencies. To be clear, Clearview AI does not do business in the UK, and does not have any UK customers at this time. > Clearview AI’s technology is not available in Canada and it does not operate in Canada. This time, and the last three times, Clearview have made the same legal argument. That because they have no physical basis in a country, and because their customers aren't in that country (though several times that has occurred post-breach), they cannot possibly have breached that country's laws. Despite the privacy laws of every nation being around the _citizen_, not their physical location. All four places have extraterritoriality baked into their privacy laws, and all four have trade agreements with the US in place that could mean that they could ask the US to enforce compliance and make it into a diplomatic issue. How many more times do their lawyers have to be told the same thing before they try and come up with a new argument?

tempnow987 5y ago
Wishing something is true doesn't make it true. How many more times do these bodies need to pass "orders" that don't result in any action before they come up with a new approach? The US does not have GDPR. Period. Flat out. Full stop. Once you understand that, things will make a lot more sense. And no, extraterritoriality means absolute zero here. That french citizen traveling in America? Heads up, US Customs does not have to respect to GDPR. Neither does the walmart he shops at. Neither does Amazon if he orders something online. Claiming they do is weird, that's not how it works. Before we are snarking about clearview having to come up with new arguments, let's evaluate how well their current arguments are working? Pretty darn well. And my guess is the US government, rather than shutting them down, will PAY them to do their stuff, ESPECIALLY on overseas nationals. This is exactly the type of big government "anti terrorism" surveillance style databases govts love.

downWidOutaFite 5y ago

Clearview AI is one of the main arguments I have used to convince many friends and family to stop posting face pictures to the web, especially of children who cannot consent. The social web is definetly a poorer experience without pictures, but this is the way our capitalist masters have decided to destroy our commons.

jackjeff 5y ago

How is France (or the EU) going to enforce their extra territorial law on a US company with no business interests in the EU? > Enforcing fines on companies without an EU base does present a regulatory challenge, however. Understatement of the year.

tormeh 5y ago
If the company doesn't do business in the EU (i.e. has no EU customers), there are still some things that can be done. Maybe target suppliers to Clearview? The cloud providers are obvious targets. Put out arrest orders for Clearview employees? Maybe try to have the US govt enforce it?
xiaodai 5y ago
GDPR
- matt74827289 5y ago
  How does GDPR allow a foreign entity to punish or fine a company based entirely in the USA? I am genuinely curious, I have wondered this for ages. Every resource I have looked at says that as a US business I need to comply with GDPR, and that I can face fines if I don't. But I have never seen the mechanisms in which those fines can be enforced. Is the US government enforcing those fines?
  - ViViDboarder 5y ago
    If you do business in the EU, you likely have money there. Might be hard for a company that isn’t international to be fined though. However, California has privacy laws now and could fine a US company.
hankman86 5y ago
There are ways. How about: arrest ClearView top brass on their next visit to Europe? Remember the Huawei heir who got sent to jail on a trip to Canada. Do the ClearView head honchos really want to be confined to travelling within the US? So while it might be difficult to go after ClearView in the US, France (and the rest of the EU, the UK, Canada, Australia) would become no-go zones for ClearView staff. Not to mention that these countries could also seize assets owned by ClearView leadership, as long as these are within their jurisdiction. In an interconnected world, it is exceedingly difficult to avoid such scenario. The question is rather: would the US step up and put pressure on the French if events would unfold in this way?

kmlx 5y ago

> Clearview sought to suggest the company is not subject to the GDPR — although the regulation is extraterritorial in scope, meaning it is applicable and (at least in theory) enforceable outside the EU’s borders in instances when EU people’s data has been processed in violation of the rules. GDPR applies also outside of the EU? who exactly thought this one up? how can the EU possibly think it can enforce this and does the EU think europeans should be subject some special rules when in a foreign country?

deleted 5y ago
[deleted]
donkarma 5y ago
if you murder someone in the United States and fly back to the UK then they'll sure as hell try to extradite you
- ahupp 5y ago
  You generally can't be extradited unless it's considered a crime in both places.
- UncleEntity 5y ago
  Because they’d be violating US law…
- onphonenow 5y ago
  Which is fine because under UK law murder is a crime. The US does not have GDPR. The US has no law giving weight to these data commissioner orders (which appear to target US companies)