Matthias Marx discovered that his Images were being stolen by Clearview AI without his permission.
Matthias Marx claims that his face was stolen. The German activist has a pale, wide face and messy blond hair. So far, three companies have mapped and monetized these features without his permission. His face, like that of billions of others, has been turned into a search term without his permission.
Marx learned about Clearview AI in 2020, a company that claims to have scraped billions of photos from the internet to create a massive database of faces. Clearview clients, which include law enforcement agencies, can use the company’s facial recognition technology to find other online photos with the same face by uploading a single photo. Marx emailed Clearview to inquire whether the company had any photos of his face database. He received a response with two screenshots attached a month later. The photos were around a decade old, but both showed Marx, looking youthful in a blue T-shirt, competing in a Google engineering competition.
Marx was aware of the existence of the photographs. But, unlike Clearview, he had no idea a photographer was selling them without his permission on the stock photo website Alamy. Marx considers Clearview’s revelation to be a wake-up call. “I’m not in control of what people do with my data anymore,” he says. Clearview was violating Europe’s privacy law, the GDPR, in his opinion, by using his face, or biometric data, without his knowledge or permission. As a result, he filed a complaint with his local privacy regulator in Hamburg in February 2020. That was the first complaint filed against Clearview in Europe, but it’s unclear whether the case has been resolved. The case has been closed, according to a spokesperson for the regulator, but Marx claims he has not been notified of the outcome.
Millions of people’s faces are appearing in search engines run by companies like Clearview across Europe. The region may have the world’s strictest privacy laws, but European regulators, including those in Hamburg, are having difficulty enforcing them. Since Marx filed his complaint, other individuals and privacy groups from across Europe have followed suit. Clearview was fined 20 million euros ($19 million) by the French data protection authority in October, making it the third EU regulator to do so. Nonetheless, Clearview has not removed EU faces from its platform, and similar fines imposed by Italian and Greek regulators remain unpaid. However, as European regulators grapple with how to make the company heed their warnings, the problem is escalating. Clearview is no longer the only company that makes money off of people’s faces.
Marx, like other privacy activists, believes it is technically impossible for Clearview to permanently delete a face. He believes that Clearview’s technology, which constantly crawls the internet for faces, will simply find and catalog him again. Clearview did not respond to a request for comment on whether it can permanently delete individuals from its database. However, privacy advocates argue that the distinction between searching by name and searching by face is critical.
Frustration is growing in Europe over the fact that face search engines can continue to operate in defiance of regulators’ orders to stop processing EU faces. Ton-That contends that Clearview is exempt from the GDPR because it has no clients or offices in the EU, which regulators dispute. “It’s very difficult to enforce a European regulatory decision on a US company if the company is unwilling to cooperate,” says Audibert, who wants EU regulators to be more aggressive in their enforcement. “This is a test case to see what kind of restrictive power the GDPR has,” she says, adding that she does not expect new sweeping EU tech rules to have an impact on the dispute.
