4 ms·

Criminal complaint against facial recognition company Clearview AI

165 points by latexr 1y ago

reify 1y ago
Been going on since 2021. The UK has fined them has fined Clearview AI £7,552,800 in 2022 but they have not paid. EU data protection authorities did not come up with a way to enforce its fines and bans against the US company, allowing Clearview AI to effectively dodge the law. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/ https://ico.org.uk/about-the-ico/media-centre/news-and-blogs... A shit company
- deaux 1y ago
  > EU data protection authorities did not come up with a way to enforce its fines and bans against the US company, allowing Clearview AI to effectively dodge the law. This is laughable. You make it illegal for any EU company to do business with them, you imprison leadership as they arrive on EU soil, there's a hundred things you can do. Companies like these that simply ignore the law and seriously damage society need to be treated just like international drug trafficking rings. Never heard a "well they keep ignoring our fines and bans, oh my what do we do" when talking about those.
  - gampleman 1y ago
    > imprison leadership as they arrive on EU soil I think that's the step that's being taken (or attempted at least) here.
  - cynicalsecurity 1y ago
    > you imprison leadership as they arrive on EU soil It's in the article, Austria might issue a criminal warrant for the company executives.
    - deaux 1y ago
      The other measure is more important IMO. I doubt that zero EU companies, including EU subsidiaries of US companies, do business with these companies.
  - wongarsu 1y ago
    I would assume their leadership simply never enter EU soil. Just like the CIA agents Italy has arrest warrants out for kidnapping Abu Omar, or how Kim Dotcom lived quite happily for a time by not going to the US or any country that would extradite him. It's pretty difficult to prosecute people on foreign soil without the kind of international cooperation that exists for prosecuting drug traffickers
    - deaux 1y ago
      I did mention another measure. Does not a single EU company work with Clearview? Even EU subsidiaries of US companies? I doubt it.
  - leobg 1y ago
    This is government. If you exceed the speed limit on the autobahn, you’ll be fined immediately. But if you run a multi million Euro fraud, you will get away with it for DECADES. Why? Because they’ve got no systems in place for that. And to do something out of the ordinary that is hard would require someone with an incentive to do it. That does not fit the profile of your typical government employee. They don’t get paid for taking on difficult cases. They get paid for closing files, or, ideally, finding reasons for not even opening them in the first place. Laws are like locks. The honest people pay attention to them. The criminals don’t. They look at the enforcement (or lack thereof).
- anonym29 1y ago
  I'm no fan of surveillance technology in general, nor of Clearview specifically, but no American corporation is legally obligated to obey British law. To suggest that Clearview is "dodging" the (British) law falsely implies that Clearview has any legal duty to obey (British) law in the first place. Sure, if they don't want to follow British law, Britain has the right to reject Clearview from British markets, but that's about it. The British government does not have jurisdiction over American companies or American citizens outside of Britain's borders, in spite of what British Parliament seems to believe.
  - ForHackernews 1y ago
    If they do business in the EU they are obligated to follow EU laws, and if they have committed crimes they should be subject to arrest and extradition. I know you're making a point about Ofcom censorship, and I agree, but we cannot set the precedent that "if you commit your crimes using a company in Delaware, they're not illegal." If you program your AI-drone to murder your enemies, that's fine as long as the control server is offshore?
    - anonym29 1y ago
      Should European citizens be subject to the laws of Russia, China, Iran, North Korea, and pals? Either laws in other countries matter in yours (regardless of how different they are from your own) or they don't. Picking and choosing which country's laws you do or don't want to consider yourself bound to on moral grounds is not fundamentally very different from picking which of your own country's laws you do or don't want to consider yourself bound to on moral grounds.
      - bbg2401 1y ago
        An entity must follow the law of each jurisdiction it conducts business. This is not a novel concept. If an entity wishes to process data of citizens of a particular country, then they must follow the laws and regulations of said country, in those instances.
- udev4096 1y ago
  UK fining them is hilarious. UK is a joke in terms of upholding any form of privacy for it's citizens
  - JohnFen 1y ago
    Maybe so, but it's so much better than the US at this that it's not even funny.
pogue 1y ago
I wish the US took data protections like this as seriously as the EU. Our data is just passed around like a gangbang on a daily basis and the US is just like ¯\_(ツ)_/¯
- udev4096 1y ago
  EU is the same. Maybe slightly better but with the amount of data breaches increasing exponentially, I don't think any amount of "regulations" is going to stop data leaks. The worst thing is, companies are facing lesser and lesser consequences. Look at the recent discord breach, nothing happened after millions of IDs were exposed. They are just blaming it on customer support, who are blaming it back on discord. The only thing we can do is promote E2EE and homophoric encryption
  - pogue 1y ago
    If you're in the EU, you should pressure your legislators to do something about it. As I understand it, there are laws against these data breaches for companies doing business in the EU, correct? If that is the case & the law(s) aren't being properly followed/enforced then you must speak up about it. Contact your representatives and let them know. I understand it's easy to be complacent and be apathetic that nothing is being done, but that's how it goes in a representative democracy. At the end of the day, all we have is our voice.
  - c-linkage 1y ago
    I've often said security doesn't matter anymore. There are no consequences for a security breach. With companies claiming "hey, we followed best practices!" and transferring liability to third parties like Crowdstrike I'm not even sure how one could even prosecute (in the US).
    - fooqux 1y ago
      What would you want instead? If a company truly followed best practices and was as secure as was reasonably expected, then was it their fault a zero-day was exploited? And if not what consequence should there be for the actions of a bad actor?

165 points by latexr 1y ago

Been going on since 2021. The UK has fined them has fined Clearview AI £7,552,800 in 2022 but they have not paid. EU data protection authorities did not come up with a way to enforce its fines and bans against the US company, allowing Clearview AI to effectively dodge the law. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/ https://ico.org.uk/about-the-ico/media-centre/news-and-blogs... A shit company

deaux 1y ago
> EU data protection authorities did not come up with a way to enforce its fines and bans against the US company, allowing Clearview AI to effectively dodge the law. This is laughable. You make it illegal for any EU company to do business with them, you imprison leadership as they arrive on EU soil, there's a hundred things you can do. Companies like these that simply ignore the law and seriously damage society need to be treated just like international drug trafficking rings. Never heard a "well they keep ignoring our fines and bans, oh my what do we do" when talking about those.
- gampleman 1y ago
  > imprison leadership as they arrive on EU soil I think that's the step that's being taken (or attempted at least) here.
- cynicalsecurity 1y ago
  > you imprison leadership as they arrive on EU soil It's in the article, Austria might issue a criminal warrant for the company executives.
  - deaux 1y ago
    The other measure is more important IMO. I doubt that zero EU companies, including EU subsidiaries of US companies, do business with these companies.
- wongarsu 1y ago
  I would assume their leadership simply never enter EU soil. Just like the CIA agents Italy has arrest warrants out for kidnapping Abu Omar, or how Kim Dotcom lived quite happily for a time by not going to the US or any country that would extradite him. It's pretty difficult to prosecute people on foreign soil without the kind of international cooperation that exists for prosecuting drug traffickers
  - deaux 1y ago
    I did mention another measure. Does not a single EU company work with Clearview? Even EU subsidiaries of US companies? I doubt it.
- leobg 1y ago
  This is government. If you exceed the speed limit on the autobahn, you’ll be fined immediately. But if you run a multi million Euro fraud, you will get away with it for DECADES. Why? Because they’ve got no systems in place for that. And to do something out of the ordinary that is hard would require someone with an incentive to do it. That does not fit the profile of your typical government employee. They don’t get paid for taking on difficult cases. They get paid for closing files, or, ideally, finding reasons for not even opening them in the first place. Laws are like locks. The honest people pay attention to them. The criminals don’t. They look at the enforcement (or lack thereof).
anonym29 1y ago
I'm no fan of surveillance technology in general, nor of Clearview specifically, but no American corporation is legally obligated to obey British law. To suggest that Clearview is "dodging" the (British) law falsely implies that Clearview has any legal duty to obey (British) law in the first place. Sure, if they don't want to follow British law, Britain has the right to reject Clearview from British markets, but that's about it. The British government does not have jurisdiction over American companies or American citizens outside of Britain's borders, in spite of what British Parliament seems to believe.
- ForHackernews 1y ago
  If they do business in the EU they are obligated to follow EU laws, and if they have committed crimes they should be subject to arrest and extradition. I know you're making a point about Ofcom censorship, and I agree, but we cannot set the precedent that "if you commit your crimes using a company in Delaware, they're not illegal." If you program your AI-drone to murder your enemies, that's fine as long as the control server is offshore?
  - anonym29 1y ago
    Should European citizens be subject to the laws of Russia, China, Iran, North Korea, and pals? Either laws in other countries matter in yours (regardless of how different they are from your own) or they don't. Picking and choosing which country's laws you do or don't want to consider yourself bound to on moral grounds is not fundamentally very different from picking which of your own country's laws you do or don't want to consider yourself bound to on moral grounds.
    - bbg2401 1y ago
      An entity must follow the law of each jurisdiction it conducts business. This is not a novel concept. If an entity wishes to process data of citizens of a particular country, then they must follow the laws and regulations of said country, in those instances.
udev4096 1y ago
UK fining them is hilarious. UK is a joke in terms of upholding any form of privacy for it's citizens
- JohnFen 1y ago
  Maybe so, but it's so much better than the US at this that it's not even funny.

pogue 1y ago

I wish the US took data protections like this as seriously as the EU. Our data is just passed around like a gangbang on a daily basis and the US is just like ¯\_(ツ)_/¯

udev4096 1y ago
EU is the same. Maybe slightly better but with the amount of data breaches increasing exponentially, I don't think any amount of "regulations" is going to stop data leaks. The worst thing is, companies are facing lesser and lesser consequences. Look at the recent discord breach, nothing happened after millions of IDs were exposed. They are just blaming it on customer support, who are blaming it back on discord. The only thing we can do is promote E2EE and homophoric encryption
- pogue 1y ago
  If you're in the EU, you should pressure your legislators to do something about it. As I understand it, there are laws against these data breaches for companies doing business in the EU, correct? If that is the case & the law(s) aren't being properly followed/enforced then you must speak up about it. Contact your representatives and let them know. I understand it's easy to be complacent and be apathetic that nothing is being done, but that's how it goes in a representative democracy. At the end of the day, all we have is our voice.
- c-linkage 1y ago
  I've often said security doesn't matter anymore. There are no consequences for a security breach. With companies claiming "hey, we followed best practices!" and transferring liability to third parties like Crowdstrike I'm not even sure how one could even prosecute (in the US).
  - fooqux 1y ago
    What would you want instead? If a company truly followed best practices and was as secure as was reasonably expected, then was it their fault a zero-day was exploited? And if not what consequence should there be for the actions of a bad actor?