Clearview AI has been fined EUR 30.5 million (approximately USD 33.7 million) by the Dutch Data Protection Authority (DPA) for multiple violations of the General Data Protection Regulation (GDPR). 

The penalty is the largest GDPR fine imposed on the company to date and stems from its creation of an extensive facial recognition database, which is said to include over 30 billion images scraped from the internet without user consent.

Initiated in March 2023 following complaints from individuals, the DPA's investigation revealed that Clearview AI failed to comply with data access requests and did not have a legal basis for processing the biometric data of Dutch citizens. 

The authority highlighted that collecting and using biometric data, like facial images, is generally prohibited under GDPR unless specific exceptions apply, which Clearview could not demonstrate.

In addition to the fine, the DPA warned that Clearview could face an additional penalty of up to EUR 5.1 million for ongoing non-compliance. The DPA emphasised that using Clearview's services is illegal for organisations within the Netherlands and that any entities that do so may also incur significant fines.

Clearview AI has stated that it does not operate within the EU and therefore claims it is not subject to GDPR; however, the DPA asserts that GDPR applies to any processing of personal data of EU residents, regardless of where the company is based. 

The DPA's chairman reiterated the invasive nature of facial recognition technology and the importance of protecting individuals' privacy rights.