NOYB files criminal complaint over Clearview AI’s GDPR violations
Clearview AI built a global database by scraping images and videos from the internet, assembling over 60 billion photos and linking faces to names, webpages and metadata. Although marketed mainly to law enforcement, the service was also used by private companies. EU data protection authorities found these practices to violate the GDPR: France, Greece, Italy and the Netherlands imposed fines totaling roughly €100 million, and the Austrian authority declared Clearview’s processing illegal and issued bans. The company did not challenge most of those decisions.
Clearview largely ignored the EU outcomes and continued operating without complying with the bans. Only in the United Kingdom did Clearview appeal an Information Commissioner’s Office decision and fine; that appeal remains pending. EU data protection authorities have limited means to enforce administrative fines and bans against a U.S. company that does not cooperate, creating a gap between rulings and practical enforcement when the controller is outside the EU.
Beyond administrative sanctions, EU law allows criminal penalties for certain GDPR breaches under national law. Austria implemented such rules in its Data Protection Act (§63), enabling criminal prosecution for serious violations. Because criminal procedures can target individuals and use cross-border tools, they present a stronger enforcement path than administrative fines alone, potentially reaching executives and enabling arrest or other measures if jurisdictional hooks exist.
The privacy NGO noyb filed a criminal complaint with Austrian prosecutors seeking criminal investigation of Clearview AI and its leadership. noyb argues that the mass collection and processing of biometric data amounted to theft of personal data affecting millions of Europeans and that criminal proceedings could hold managers personally liable, including when traveling to Europe. If prosecutors proceed, criminal sanctions could close the enforcement gap that administrative remedies have not fully addressed.
