The Netherlands’ privacy watchdog today fined Clearview AI Inc. €30.5 million, or about $33.7 million, over its controversial facial recognition database.

The penalty is the latest in a series issued to the company by data protection regulators. Moreover, Clearview AI’s business practices were the focus of multiple lawsuits in the U.S. over the past few years. 

Clearview AI operates a database that contains more than 30 billion photos of people’s faces. Those images are collected from sources such as social media without the affected individuals’ knowledge or permission. The company uses the data to power a facial recognition service that it sells to law enforcement agencies, other government organizations and those organizations’ contractors.

The Dutch Data Protection Authority, or DPA, began investigating Clearview AI last year. It opened the probe following complaints from three individuals who had unsuccessfully asked the company for information on what data it collected about them. The DPA’s investigation concluded that Clearview AI’s business practices run afoul of the European Union’s GDPR data privacy law in two ways.

First, the regulator concluded that the company should not have created its facial recognition database. “This especially applies” to certain features in the database that Clearview AI uses to link together photos associated with the same person, the DPA stated. 

Second, the regulator found that the company fails to meet certain transparency requirements set forth in the GDPR. In particular, Clearview AI doesn’t inform people when their photos are incorporated into its database. The company likewise fails to fulfill requests from individuals to disclose what data it collects about them.

The DPA plans to fine Clearview AI another €5.1 million, or $5.6 million, if it continues to run afoul of GDPR privacy requirements. The regulator also warned that Dutch organizations can expect “hefty fines” if they purchase access to the company’s service.

The company was previously fined by privacy regulators in three other EU member states as well as the U.K. The DPA detailed today that those penalties, which totaled more than $50 million, did not appear to prompt a change in Clearview AI’s business practices. To try to remedy the situation, the regulator will investigate “if the directors of the company can be held personally responsible for the violations.”

Clearview AI’s facial recognition database has also come under scrutiny in the U.S. Two years ago, the company ended an Illinois lawsuit over its data collection practices by agreeing to make its service unavailable to most U.S. businesses. Clearview AI was also banned from selling its service in Illinois for five years.

More recently, the company settled a separate federal lawsuit over its facial recognition service this past June. At the time, it was estimated that the deal could cost Clearview AI more than $50 million.

Image: Unsplash