Answer given by Ms Johansson on behalf of the European Commission
17.7.2020
The Commission is not aware of the use of the Clearview AI application by law enforcement authorities in the EU and whether the application is processing data of European citizens.
Any processing of personal data must be carried out in compliance with the EU data protection rules, i.e. the General Data Protection Regulation (EU) 2016/679[1] as regards the processing of personal data by companies, and Directive (EU) 2016/680 on the processing of personal data by law enforcement authorities[2], which protect fundamental rights, in particular the right to the protection of personal data. It follows from the directive that the processing of special categories of personal data, which includes biometric data processed for the purpose of uniquely identifying a natural person, is deemed lawful if both of the following conditions are met: a) it is necessary for the performance of a task carried out by a competent authority for the purposes of the directive; and b) it is authorised by Union or Member State law, which should provide for strict safeguards and precise conditions for such data processing.
Any activity of law enforcement authorities using facial recognition technologies must fulfil the above requirement.
The monitoring and enforcement of the application of the data protection legislation fall under the competence of national data protection authorities and courts who have to assess the lawfulness of such processing. As an additional safeguard, law enforcement authorities must consult the national data protection authorities prior to the deployment of a system that involves a high risk to the rights of the individuals.
The Commission announced in the White Paper on Artificial Intelligence[3] to launch a broad European debate on the use of remote biometric identification technologies, which is taking place in 2020. The outcome of such consultation will be duly taken into account in the upcoming legislative initiatives. Processing of personal data in international law enforcement cooperation must comply with the requirements of Directive (EU) 2016/680 and the specific legislation applicable to the specific form of cooperation.