What happened
It was reported that Clearview AI, an American facial recognition company, collected more than three billion photographs from social media and public websites to build a searchable database of people’s faces.
The technology allowed users, including law enforcement agencies, to upload a photograph and search for matching faces across the internet. The people whose images had been collected were generally unaware they were in the database and had never agreed to their photographs being used this way.
In October 2021, Australia’s Privacy Commissioner found that Clearview had breached Australian privacy law by collecting sensitive biometric information without consent. The company was ordered to stop collecting images of Australians and destroy the information it already held.
Clearview challenged the decision, arguing that Australian privacy law did not apply to its operations in the United States, but withdrew its review proceedings in August 2023, leaving the determination standing.
In August 2024, the regulator announced it would not pursue further action at that time, despite maintaining its concerns about the company’s conduct. The Australian Federal Police had also been investigated over its use of Clearview’s technology and was directed to improve its privacy practices.
What an auditable version would have shown
The difficulty for regulators was establishing exactly what Clearview had collected, whose information was stored and whether the company had complied with the order to destroy Australian biometric data.
An auditable system would have recorded where each photograph came from, when it was collected and what legal justification existed for turning it into biometric information.
A ConductRecord could preserve that history, including any subsequent deletion, while allowing independent checks of whether records had been removed as required.
Such records would make compliance easier to demonstrate, although they would not make unlawful collection acceptable.
Where the gap was
Clearview’s business relied on collecting enormous quantities of photographs that people had made available online, without first obtaining their permission to use those images for facial recognition.
Headlights identifies a rules-behaviour gap, where the system’s method of collecting information conflicted with the privacy obligations governing that information.
There is a broader human assumption behind this case: that information available to the public is somehow available for any purpose.
People might share photographs online so friends can see them, but that does not mean they expect a company to turn those images into a permanent tool for identifying and tracking them.
The distinction matters because a photograph can be removed from a website, while biometric information derived from someone’s face raises more difficult questions about privacy and control.
What governance should have looked like
Before collecting photographs for facial recognition, Clearview needed to establish whether it had a lawful basis to collect and process the biometric information of the people involved.
A ConstraintGate could prevent collection where the required legal conditions had not been satisfied, while a ConductRecord could document the source of each image, the justification for collecting it and any subsequent deletion.
Independent verification would also be important, particularly when a regulator orders a company to destroy information that cannot easily be inspected from outside its systems.
The central lesson is that finding someone’s photograph online does not automatically give a company the right to turn their face into a searchable identity record.
Failure Pattern: Clearview AI collected billions of online photographs to build a facial recognition database without obtaining consent from the people involved. Australia’s Privacy Commissioner found the practice breached privacy law and ordered the company to stop collecting Australian biometric information and destroy existing records.
Governance Principle: Publicly accessible information is not automatically available for unrestricted biometric use. Organisations must establish a lawful basis for collection and maintain evidence that privacy obligations, including deletion requirements, have been met.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Clearview AI breached Australians’ privacy (OAIC)
- Statement on Clearview AI (OAIC)
- AFP ordered to strengthen privacy governance (OAIC)
- Government drops further action against Clearview AI (Information Age, ACS)