Privacy Notes – Clearview AI Application (14-2-2020)

Welcome to another edition of Privacy Notes. In the last edition, we discussed the “Right to Request for your Personal Data” also known as Data Subject Access Request. You can read it here

This week, we will be discussing the Clearview AI Application and the Nigeria Data Protection Regulation.

The Clearview AI Application

The Clearview AI Application is an application software developed by the American Company, Clearview AI which was founded by Hoan Ton-That and Richard Schwartz. The application software is used for facial recognition and matches faces of individuals to their database which contains more than 3 (three) billion images of individuals obtained from the internet – including social media applications as well as other platforms. The company argues that the images uploaded in its database is already publicly available and as such does not violate the privacy rights of any individual.

According to the company, the software application is mostly used by law enforcement agencies such as the NYPD (New York Police Department) in detecting and tracking suspects as well as solving criminal cases such as child abuse. In the case of the child abuse cases, the application was used to track minors who had been abused and had also been displayed in exploitative videos and photos. These victims were tracked down and were invited as witnesses in the prosecution of a multiple sexual offender.

The application stores pictures known as probe images overtime resulting in its large database of images. Privacy advocates have, in the course of the application’s publicity, indicated their concerns over the security and regulation of the application’s database. The application, as argued by the Company, uses public images to function and does not actually survey or take new pictures of any individual. It scrapes images from social media platforms and uploads these on its database. Social media companies such as Facebook, LinkedIn, Twitter have issued cease and desist letters to the company noting that it should desist from obtaining images from their platforms.

There have been arguments for the use of the application, with members of law enforcement supporting the use of the application while noting that the application was efficient, effective and essential in solving cases, stating that while there was an understanding of the public’s concern for the protection of their privacy, there was also a need to protect the society from criminal offenders especially in cases of child abuse.

The Clearview Application and the Nigeria Data Protection Regulation

The Nigeria Data Protection Regulation was enacted by NITDA to, among other things, safeguard the rights of natural persons to the privacy of their personal data. Personal Data as defined by the Regulation includes but is not limited to their name, address, photo, posts on social media etc. The Regulation also provides safeguards to curb the violation of privacy by Data Controllers in the processing of personal data. Processing as defined by the Regulation includes activities on personal data such as – collection, organization, storage, use, disclosure by transmission, dissemination etc.

Furthermore, the Regulation has established certain principles such as specificity, legitimacy, lawfulness and consent. Further principles as stated by the Regulation include adequacy, accuracy, non-prejudice to dignity, security, care and reasonable retention. For the purposes of this article, we will be focusing on consent, lawfulness and reasonable retention in relation to the Clearview AI Application.

The Clearview Application and potential breach of the NDPR

The NDPR places a lot of importance on obtaining the consent of data subjects before and during the processing of their personal data. It provides specifically that no data shall be obtained except the specific purpose of collection is made known to the Data Subject. Such consent is to be obtained without fraud, coercion or undue influence. The Clearview application allegedly processes publicly available data. However, publicly available data is still personal data as defined by the NDPR as it can be used to identify a Data Subject. The software application in the course of its activity does not obtain consent from the data subjects whose images it collects and stores on its database. In this aspect, the application would be in breach of the NDPR.

Secondly, NDPR states that where personal data is stored by a Data Controller, it should communicate to the Data Subject how long such information will be retained and where it cannot determine the retention period, the criteria used to determine such period should be communicated to the Data Subject. In this regard, the application and the company would be in breach of the NDPR as there is no such communication made to Data Subjects.

However, the principle of lawfulness as provided by the NDPR seems to absolve the company of the above breaches. The NDPR provides that processing of information shall be lawful among other things if “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official public mandate vested in the controller”. As previously mentioned, the use of the application by law enforcement would put the company under this category. As such, it wouldn’t be in breach of the NDPR if its processing activities are done in the interest of the public.

In conclusion, the potential for violation of the NDPR by the Clearview AI application is dependent on the use of the application. Where the application is used to process data necessary for public interest, such as use by law enforcement in solving crimes, the company would not be in breach of the NDPR. However, where the company uses its facial recognition software for any other use such as for marketing purposes, it would have to conform to the provisions of the NDPR such as provisions for consent, communication to/with the Data Subject in respect of their rights among other things. Where it does not conform, it would be in breach of the provisions of NDPR.

Thank you for reading to this point.

Till next week,

Uwemedimo Atakpo Jnr.