SecurityBrief Australia - Technology news for CISOs & cybersecurity decision-makers
Story image
Australia's OAIC orders Clearview AI to delete all images of Australians in landmark privacy win
Mon, 8th Nov 2021
FYI, this story is more than a year old

The Office of the Australian Information Commissioner (OAIC) and the United Kingdom Information Commissioner's Office (ICO) have completed their joint investigation into the use of facial recognition software Clearview AI.

Clearview AI is facial recognition software designed for law enforcement agencies. Agencies can upload photos of faces and compare them with a database of more than 10 billion facial images sourced from platforms including public-facing social media, news media, mugshot websites, and other publicly-open sources. Such data collection or ‘scraping' has been questioned by privacy advocates.

Clearview AI was used in trials by the Australian Federal Police and various branches of the UK Police last year, raised serious concerns about how data was handled.

The OAIC recently released findings of its report, which state that Clearview AI does not comply with the Privacy Act 1988 and ‘interfered with the privacy of Australian invidividuals'.

Australian Information Commissioner and Privacy Commissioner Angelene Falk says the investigation has been ‘highly valuable'.

“The issues raised by Clearview AI's business practices presented novel concerns in a number of jurisdictions. By partnering together, the OAIC and ICO have been able to contribute to an international position, and shape our global regulatory environment.

Clearview AI must now destroy all images it has collected from people in Australia, and it must also stop collecting images of people in Australia. The company has 90 days to comply and it must provide written confirmation.

According to the ICO, it is considering next steps to consider if any formal action will be taken under the UK's data protection laws.

UK Information Commissioner Elizabeth Denham says, “Our digital world is international and so our regulatory work must be international too, particularly where we are looking to anticipate, interpret and influence developments in tech for the global good.

“That doesn't mean sharing the same laws or approaches, but on finding ways for our different approaches to work side by side and to co-ordinate and share the regulatory challenge where technologies impact our citizens across international borders. The result is an investigation that will protect consumers in both the UK and Australia.

The New Zealand Police also trialled the software in 2020 without briefing the Police Commissioner or consulting the Office of the Privacy Commissioner. The trial was used on 150 searches of police volunteers and 30 searches of persons of interest. There was one successful match of a person.  New Zealand's Office of the Privacy Commissioner released a statement about Clearview AI, but this has not been escalated to a legal enquiry.