5 ms·

> "Clearview AI does not have a place of business in the Netherlands or the EU, it does not have any customers in the Netherlands or the EU, and does not undert

by swyx 2y ago

> "Clearview AI does not have a place of business in the Netherlands or the EU, it does not have any customers in the Netherlands or the EU, and does not undertake any activities that would otherwise mean it is subject to the GDPR," he said. what limits do we place on countries randomly being able to make supranational claims like this? do you want every online business checking the passport of their customer? because sure this case is fine but its a pretty dangerous precedent to accept without limits. for all its good intentions, GDPR has also resulted in cookie banner spam on the rest of us. as with all government power - u may be fine when its used against things you dont like, but try to imagine when its used to against things you do...

hcfman 2y ago
So does that mean it’s intelligence services never get a face match done ? How would you know if they have no customers here, do you think their intelligence services would tell you ? In the past the head of Dutch intelligence lied to the government about mass surveillance. Even if it was true, guaranteed they would simple send their photos to American counterparts to run. This is just democracy theatre in reality.
mikae1 2y ago
> what limits do we place on countries randomly being able to make supranational claims like this? Randomly? EU or other nations act because their citizens have their rights violated. I assume Clearview has collected Dutch faces en masse and thereby violated laws. Obey by GDPR or don't deal with the data of EU citizens.
piva00 2y ago
> do you want every online business checking the passport of their customer? Is the business selling to a EU citizen? If so they have to deal with the rights that citizen has. If a company in some fictitious jurisdiction where fraud is not a crime defrauds an American citizen, should they not face American justice for it? It might be they don't have legal representation in the USA but that shouldn't stop an American citizen on bringing the issue to authorities to deal with. It's not random, if you make business with someone in the EU or deal with the information of someone in the EU then you need to follow EU's regulations. Can't do that? Don't deal with EU's citizens data or business, it's pretty simple. I really don't think this is a hard concept to grasp.
- brainwad 2y ago
  If you run a company in a foreign country, then the laws of that country apply of course. Why should it be different just because they have scraped internet data containing images of Euroepeans? If that's legal in the home country of the business (as it would in, say, America) then its none of the EU's business. Imagine the reverse, if China was fining European companies for not censoring CCP-offensive terms on the internet. Or America was fining them for dealing with US-blocklisted entities like Iran.
  - piva00 2y ago
    > If that's legal in the home country of the business (as it would in, say, America) then its none of the EU's business. The data pertain to EU's citizens, that is covered under the GDPR, if your business deal with private data from EU's citizens you are under the GDPR even if you don't operate in the EU (such as the case of Clearview). Of course, without an office/representation in the EU it's impossible for the EU to collect the fines and apply other punishments, still the business will be judged under the terms of the GDPR in the EU. It's the business of the EU since the data is from EU's citizens. Like I mentioned before, if a business was defrauding people (i.e.: identity theft) in the USA while operating outside of the USA, the American justice system has all the prerogative to defend its citizens rights even if it wasn't possible to stop the operation, collect fines, etc. There would be an investigation, there would be a prosecution and eventual punishment. Depending on how egregious the rights violating behaviour was it could escalate into the international sphere. It's the same case here, Clearview AI is processing private data from EU's citizens even if outside of the EU it is against EU laws. > Or America was fining them for dealing with US-blocklisted entities like Iran. The USA does punish companies outside of the USA for dealing with US-blocklisted entities, how the hell do you think sanctions work? Why do you think most of the world avoid dealing with Iran, North Korea, etc.? Clearview has been targeted before by other DPAs in the EU [0][1][2][3][4]. [0] https://www.edpb.europa.eu/news/national-news/2022/french-sa-fines-clearview-ai-eur-20-million_en https://www.edpb.europa.eu/news/national-news/2022/french-sa... [1] https://www.edpb.europa.eu/news/national-news/2022/facial-recognition-italian-sa-fines-clearview-ai-eur-20-million_en https://www.edpb.europa.eu/news/national-news/2022/facial-re... [2] https://noyb.eu/sites/default/files/2021-01/545_2020_Anh%C3%B6rung_CVAI_ENG_Redacted.PDF https://noyb.eu/sites/default/files/2021-01/545_2020_Anh%C3%... [3] https://www.imy.se/globalassets/dokument/beslut/beslut-tillsyn-polismyndigheten-cvai.pdf https://www.imy.se/globalassets/dokument/beslut/beslut-tills... [4] https://www.edpb.europa.eu/news/national-news/2023/decision-austrian-sa-against-clearview-ai-infringements-articles-5-6-9-27_en https://www.edpb.europa.eu/news/national-news/2023/decision-...

by swyx 2y ago

hcfman 2y ago

So does that mean it’s intelligence services never get a face match done ? How would you know if they have no customers here, do you think their intelligence services would tell you ? In the past the head of Dutch intelligence lied to the government about mass surveillance. Even if it was true, guaranteed they would simple send their photos to American counterparts to run. This is just democracy theatre in reality.

mikae1 2y ago

> what limits do we place on countries randomly being able to make supranational claims like this? Randomly? EU or other nations act because their citizens have their rights violated. I assume Clearview has collected Dutch faces en masse and thereby violated laws. Obey by GDPR or don't deal with the data of EU citizens.

piva00 2y ago

> do you want every online business checking the passport of their customer? Is the business selling to a EU citizen? If so they have to deal with the rights that citizen has. If a company in some fictitious jurisdiction where fraud is not a crime defrauds an American citizen, should they not face American justice for it? It might be they don't have legal representation in the USA but that shouldn't stop an American citizen on bringing the issue to authorities to deal with. It's not random, if you make business with someone in the EU or deal with the information of someone in the EU then you need to follow EU's regulations. Can't do that? Don't deal with EU's citizens data or business, it's pretty simple. I really don't think this is a hard concept to grasp.

brainwad 2y ago
If you run a company in a foreign country, then the laws of that country apply of course. Why should it be different just because they have scraped internet data containing images of Euroepeans? If that's legal in the home country of the business (as it would in, say, America) then its none of the EU's business. Imagine the reverse, if China was fining European companies for not censoring CCP-offensive terms on the internet. Or America was fining them for dealing with US-blocklisted entities like Iran.
- piva00 2y ago
  > If that's legal in the home country of the business (as it would in, say, America) then its none of the EU's business. The data pertain to EU's citizens, that is covered under the GDPR, if your business deal with private data from EU's citizens you are under the GDPR even if you don't operate in the EU (such as the case of Clearview). Of course, without an office/representation in the EU it's impossible for the EU to collect the fines and apply other punishments, still the business will be judged under the terms of the GDPR in the EU. It's the business of the EU since the data is from EU's citizens. Like I mentioned before, if a business was defrauding people (i.e.: identity theft) in the USA while operating outside of the USA, the American justice system has all the prerogative to defend its citizens rights even if it wasn't possible to stop the operation, collect fines, etc. There would be an investigation, there would be a prosecution and eventual punishment. Depending on how egregious the rights violating behaviour was it could escalate into the international sphere. It's the same case here, Clearview AI is processing private data from EU's citizens even if outside of the EU it is against EU laws. > Or America was fining them for dealing with US-blocklisted entities like Iran. The USA does punish companies outside of the USA for dealing with US-blocklisted entities, how the hell do you think sanctions work? Why do you think most of the world avoid dealing with Iran, North Korea, etc.? Clearview has been targeted before by other DPAs in the EU [0][1][2][3][4]. [0] https://www.edpb.europa.eu/news/national-news/2022/french-sa-fines-clearview-ai-eur-20-million_en https://www.edpb.europa.eu/news/national-news/2022/french-sa... [1] https://www.edpb.europa.eu/news/national-news/2022/facial-recognition-italian-sa-fines-clearview-ai-eur-20-million_en https://www.edpb.europa.eu/news/national-news/2022/facial-re... [2] https://noyb.eu/sites/default/files/2021-01/545_2020_Anh%C3%B6rung_CVAI_ENG_Redacted.PDF https://noyb.eu/sites/default/files/2021-01/545_2020_Anh%C3%... [3] https://www.imy.se/globalassets/dokument/beslut/beslut-tillsyn-polismyndigheten-cvai.pdf https://www.imy.se/globalassets/dokument/beslut/beslut-tills... [4] https://www.edpb.europa.eu/news/national-news/2023/decision-austrian-sa-against-clearview-ai-infringements-articles-5-6-9-27_en https://www.edpb.europa.eu/news/national-news/2023/decision-...