The privacy agency also ordered the facial recognition company to delete all data on Italians

Italy’s data privacy watchdog said it will fine the controversial facial recognition firm Clearview AI for breaching EU law. An investigation by Garante, Italy’s data protection authority, found that the company’s database of 10 billion images of faces includes those of Italians and residents in Italy. The agency has fined the New York City-based firm €20 million. The company will also have to delete any facial biometrics it holds of Italian nationals.

Clearview AI says it has built up a database of more than 10 billion facial images. The company has taken these from public websites, social media and news sites. It then sells this information as a tool for law enforcement.

Italy’s privacy watchdog said that, despite Clearview’s assertions to the contrary, the firm had allowed the tracking of citizens and people in Italy.

“The personal data held by the company, including biometric and geolocation data, are processed unlawfully,” the watchdog said.

The company had also violated several principles of GDPR, Garante said. This is a European Union privacy regulation introduced in 2018 to control who can access personal data.

Garante’s findings showed that the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis.

Additionally, the company infringed several fundamental principles of the GDPR, Garante asserted/ These includectransparency, as it failed to adequately inform users. It also failed in purpose limitation, since it processed users’ data for purposes other than those for which they had been made available online. Clearview also violated rules on storage limitation, they said. This was because Clearview failed to set out any data storage period.

“Thus, Clearview AI is violating data subjects’ freedoms including the protection of privacy and non-discrimination,” Garante said in a press release.

Clearview has been growing in the U.S., but its efforts to scale up internationally have been stymied. The company has also been banned in Sweden, France and Australia.