Clearview AI enforcement: governance lessons for organisations using AI

What happened

In September 2024, the Dutch Data Protection Authority announced a €30.5 million fine against Clearview AI and orders subject to further penalty for non-compliance. The regulator said Clearview had built a database containing billions of facial images and converted them into biometric codes without a lawful basis under the GDPR.

The decision is a GDPR enforcement matter, not an EU AI Act enforcement decision. That distinction is important: organisations using AI can face legal exposure under existing data protection law independently of the AI Act classification of a system.

Why it matters

AI systems are often discussed in terms of model capability, but data provenance can be the more fundamental governance question. If an organisation cannot explain where training, reference or input data came from and why it may lawfully be processed, technical sophistication does not cure the underlying problem.

Who may be affected

The lesson extends beyond facial recognition providers. AI developers, buyers and organisations integrating external datasets should understand data origin, processing roles, legal basis, transparency, retention and the rights of affected individuals before scale makes remediation difficult.

Relevant governance and regulatory issues

• Data provenance and evidence of a lawful basis for personal data processing.
• Special-category biometric data and the additional protections that apply.
• Transparency to people whose information is processed.
• Ability to support data subject rights and deletion requirements.
• Vendor or dataset due diligence before integrating external data into AI workflows.

What businesses should check

• Can the supplier explain the origin of material datasets and the contractual rights around them?
• Has privacy review been performed before personal data is used to build or enrich AI systems?
• Are biometric or other special-category data explicitly identified rather than hidden inside a generic data field?
• Can the organisation respond if a person asks how their information reached an AI system?

Practical actions

Add data provenance to AI procurement and system review. Escalate biometric and large-scale personal data uses for specialist privacy assessment. Require evidence where risk is material rather than relying only on supplier assurances.