To ask Her Majesty’s Government what assessment they have made of the decision by the Information Commissioner’s Office to fine and issue an enforcement notice against Clearview AI Inc. in respect of its use of images of United Kingdom residents collected from the internet without their knowledge or consent.
My Lords, organisations based in the UK and those based overseas which process data of UK residents for the purposes of providing services must comply with our data protection legislation. Where personal data are more sensitive in nature, such as where they relate to a person’s biometric information, stricter rules and safeguards apply. The Information Commissioner’s Office enforces legislation independently of government. In the case of Clearview AI, it decided that the data protection principles were not complied with and enforcement action was needed. Further details can be viewed on the ICO’s website.
My Lords, Clearview is a US company that is in clear breach of data protection laws, collects facial images for its database without our knowledge or consent, uses it to train its algorithms and then offers special deals to schools and the police to use the database on their live facial recognition systems. What are the Government doing to prohibit public authorities contracting with Clearview? Clearview has said it will not even pay the ICO’s rather limited fine. What will the ICO and the Government do now to ensure that it pays?
My Lords, Clearview is appealing the ICO’s finding, which it is entitled to do, but I note that the ICO is not the only regulator to have taken action against it: its French, Italian, German, Canadian and Australian counterparts have reached similar conclusions. The ICO has issued a fine and served an enforcement notice issuing orders for Clearview to delete the data. Subject to its appeal, that is what it will have to do.
My Lords, a video from the States appeared to show Nancy Pelosi drunkenly slurring her way through a speech. It later transpired that it was a deep fake in which her face and voice had been digitally altered. Hackers and activists can use this technology to discredit public figures and affect the democratic process of this country. What is the Government’s counter disinformation unit doing to combat deep fakes in this country?
The noble Viscount rightly points to an emerging area of concern. Last year, the Government published a national AI strategy and committed to a White Paper setting out our approach to regulating artificial intelligence. We will publish that White Paper later this year, setting out how we intend to address the opportunities as well as the risks that arise from AI in a proportionate and nimble way.
My Lords, the Clearview AI service was used on a free trial basis by several UK law enforcement agencies. Do the Government now accept the Ryder review’s recommendation that new statutory regulations are required to stop the police using facial recognition technology in such a cavalier fashion?
My Lords, the scale of Clearview’s ambition is global: to have 100 billion face images on its database by next year. That is 14 images for every person presently on this planet. It also gave evidence recently of what it intends to do with this. It gave the Ukrainian Ministry of Defence free access to its software. I am not sure whether the Minister knows this, but the Ministry of Digital Transformation in Ukraine has said that it is using the technology to give Russians the chance to experience the true cost of the war by searching the web for images of dead Russians and contacting their families to say, “If you want to find your loved ones’ bodies, you’re welcome to come to Ukraine”. I can imagine what our attitude would be if that was happening in reverse. Are the Government aware that this company has ambitions well beyond what is within the jurisdiction of the ICO? It can be regulated only by Governments, and our Government should be at the forefront.
I have seen the reports to which the noble Lord refers. As I said, our Information Commissioner’s Office has taken action, and so have its French, Italian, German, Canadian and Australian counterparts. I hope that that sends a clear message to companies such as Clearview that failure to comply with basic data protection principles will not be tolerated in the UK or, indeed, anywhere else. All organisations that process personal data must do so in a lawful, transparent and fair way.
The noble Lord is absolutely right. There is a comprehensive legal framework for police use of live facial recognition, which includes ensuring that it is proportionate and necessary. Generally, the police can use that technology without people’s consent only where it is strictly necessary for law enforcement purposes. The College of Policing has rightly produced national guidance on this important issue.
My Lords, I live in the borough of Tower Hamlets. The borough next to it —Newham, where I grew up—is among those with the greatest number of video cameras, surveying its citizens in all their various aspects. The Minister has just said that he is well aware of the risks and opportunities presented by new and emerging technologies. What are he and the Government doing seriously to ensure that consent, education and awareness are a central part of all the strategies and actions implemented?
CCTV can help people to feel safe on the streets and can help in the prosecution of crimes committed against people. We support the police using new technologies to keep the public safe, and we are simplifying the oversight of biometric and overt surveillance technologies such as CCTV cameras. The ICO will continue to provide independent oversight and regulation of all biometrics and surveillance camera use, including by the police.
My Lords, as is so often the case, companies such as Clearview AI operate across the world and may attract the attention of multiple regulators. Given that these bodies may exchange information, can the Minister confirm whether a firm’s bad behaviour in another jurisdiction will provide grounds for investigation by the ICO? Also, what weight, if any, does the ICO give to events elsewhere when determining sanctions such as fines?
The noble Baroness is right: global co-operation is needed on this. Our new Information Commissioner, who was previously commissioner in New Zealand, has recently been to Brussels to discuss how best the ICO can co-operate with international partners to tackle threats to privacy such as this, so he is indeed engaged globally, as noble Lords would hope.
The noble Baroness is right: there are important ethical questions which need to be fed in. The College of Policing provides guidance on the use of surveillance technology and facial recognition technology, which should take these into account. The general principles of facial recognition technology are that it should be lawful, transparent and fair to the individual.
Those public bodies are independent from the Government. They are subject to data protection law and if they break any data protection rules, they could be investigated and fined accordingly. But the ICO’s investigation, the fine and the enforcement action it has taken show that our law is robust and is being enforced by the ICO.
Are noble Lords aware of the recent statement from Big Brother Watch about Hikvision, the Chinese company that has sold many cameras to many public authorities and government departments in the UK? These cameras can speak back to the mother ship in China. Is this really a good idea?
I have seen those reports in the media. I know that your Lordships’ House takes great interest in ensuring that the companies whose hardware is purchased are those that the people of this country would want it to be purchased from.
My Lords, has the Minister seen the report into biometrics generally by Matthew Ryder QC, on behalf of the Ada Lovelace Institute? Does he agree with the overriding recommendation that we need a new framework governing the use of biometrics?