To ask Her Majesty’s Government what assessment they have made of the decision by the Information Commissioner’s Office to fine and issue an enforcement notice against Clearview AI Inc. in respect of its use of images of United Kingdom residents collected from the internet without their knowledge or consent.
My Lords, organisations based in the UK and those based overseas which process data of UK residents for the purposes of providing services must comply with our data protection legislation. Where personal data are more sensitive in nature, such as where they relate to a person’s biometric information, stricter rules and safeguards apply. The Information Commissioner’s Office enforces legislation independently of government. In the case of Clearview AI, it decided that the data protection principles were not complied with and enforcement action was needed. Further details can be viewed on the ICO’s website.
My Lords, Clearview is a US company that is in clear breach of data protection laws, collects facial images for its database without our knowledge or consent, uses it to train its algorithms and then offers special deals to schools and the police to use the database on their live facial recognition systems. What are the Government doing to prohibit public authorities contracting with Clearview? Clearview has said it will not even pay the ICO’s rather limited fine. What will the ICO and the Government do now to ensure that it pays?
My Lords, Clearview is appealing the ICO’s finding, which it is entitled to do, but I note that the ICO is not the only regulator to have taken action against it: its French, Italian, German, Canadian and Australian counterparts have reached similar conclusions. The ICO has issued a fine and served an enforcement notice issuing orders for Clearview to delete the data. Subject to its appeal, that is what it will have to do.
My Lords, a video from the States appeared to show Nancy Pelosi drunkenly slurring her way through a speech. It later transpired that it was a deep fake in which her face and voice had been digitally altered. Hackers and activists can use this technology to discredit public figures and affect the democratic process of this country. What is the Government’s counter disinformation unit doing to combat deep fakes in this country?
The noble Viscount rightly points to an emerging area of concern. Last year, the Government published a national AI strategy and committed to a White Paper setting out our approach to regulating artificial intelligence. We will publish that White Paper later this year, setting out how we intend to address the opportunities as well as the risks that arise from AI in a proportionate and nimble way.
My Lords, the Clearview AI service was used on a free trial basis by several UK law enforcement agencies. Do the Government now accept the Ryder review’s recommendation that new statutory regulations are required to stop the police using facial recognition technology in such a cavalier fashion?
We are looking at Mr Ryder’s report and recommendations. We have yet to assess them as they came out only recently but we think that the current framework offers strong protections.
My Lords, the scale of Clearview’s ambition is global: to have 100 billion face images on its database by next year. That is 14 images for every person presently on this planet. It also gave evidence recently of what it intends to do with this. It gave the Ukrainian Ministry of Defence free access to its software. I am not sure whether the Minister knows this, but the Ministry of Digital Transformation in Ukraine has said that it is using the technology to give Russians the chance to experience the true cost of the war by searching the web for images of dead Russians and contacting their families to say, “If you want to find your loved ones’ bodies, you’re welcome to come to Ukraine”. I can imagine what our attitude would be if that was happening in reverse. Are the Government aware that this company has ambitions well beyond what is within the jurisdiction of the ICO? It can be regulated only by Governments, and our Government should be at the forefront.
I have seen the reports to which the noble Lord refers. As I said, our Information Commissioner’s Office has taken action, and so have its French, Italian, German, Canadian and Australian counterparts. I hope that that sends a clear message to companies such as Clearview that failure to comply with basic data protection principles will not be tolerated in the UK or, indeed, anywhere else. All organisations that process personal data must do so in a lawful, transparent and fair way.
If it loses its appeal, the £7.5-million fine it has been issued with will stand and the enforcement notice to delete the data that has been taken unlawfully, in the ICO’s view, will have to be complied with.
My Lords, does the Minister agree that facial recognition is an important tool for the police in the detection of crime, and we should not throw the baby out with the bath-water.
The noble Lord is absolutely right. There is a comprehensive legal framework for police use of live facial recognition, which includes ensuring that it is proportionate and necessary. Generally, the police can use that technology without people’s consent only where it is strictly necessary for law enforcement purposes. The College of Policing has rightly produced national guidance on this important issue.
My Lords, I live in the borough of Tower Hamlets. The borough next to it —Newham, where I grew up—is among those with the greatest number of video cameras, surveying its citizens in all their various aspects. The Minister has just said that he is well aware of the risks and opportunities presented by new and emerging technologies. What are he and the Government doing seriously to ensure that consent, education and awareness are a central part of all the strategies and actions implemented?
CCTV can help people to feel safe on the streets and can help in the prosecution of crimes committed against people. We support the police using new technologies to keep the public safe, and we are simplifying the oversight of biometric and overt surveillance technologies such as CCTV cameras. The ICO will continue to provide independent oversight and regulation of all biometrics and surveillance camera use, including by the police.
My Lords, as is so often the case, companies such as Clearview AI operate across the world and may attract the attention of multiple regulators. Given that these bodies may exchange information, can the Minister confirm whether a firm’s bad behaviour in another jurisdiction will provide grounds for investigation by the ICO? Also, what weight, if any, does the ICO give to events elsewhere when determining sanctions such as fines?