# Clearview AI - Facial Recognition and Privacy
USA/Europe, 2020-2022 | Severity: N3

## What Happened
The facial recognition company Clearview AI built a massive biometric database containing over 3 billion images harvested (scraped) from public social media platforms and websites without user consent. The company sold access to this database to law enforcement agencies and private organizations, allowing them to upload any photo of a person to instantly identify them, find their social media profiles, and track their online identity. Data protection authorities in several European nations (such as France's CNIL and Italy's GPDP) fined Clearview AI millions of euros and ordered the deletion of their citizens' biometric data, ruling that the mass scraping and biometric profiling violated the GDPR, the right to privacy, and the principle of informational self-determination.

## How MEG 1 acted
Clearview AI's mass biometric harvesting and profiling represents a severe "cognitive extraction" attack. Collecting and processing citizens' biometric data without explicit consent violates the core principles of informational dignity and public safety.

## MEG 2 Analysis - Legal Framework
* **Agent level:** N3 (individualized/advanced) - mass biometric profiling and real-time identification database operating globally; high individuation and tracking capacity of specific citizens.
* **Cause (6.1):**
  * **(a) system defect** - design of a business and technical model that relies on unauthorized, systemic extraction of private personal data (data privacy defect).
  * **(b) autonomous decision error** - the system's decision to generate biometric templates and match identities without authorization or verification.
* **Attachment of liability:** Clearview AI as the manufacturer/operator is fully liable for the systemic privacy violations and the unauthorized processing of biometric data; the purchasing organizations share liability if they used the unvalidated system.

## Procedural Mechanism
* **6.2 (architectural human confirmation):** Biometric identification and search actions must require strict, independent judicial confirmation. The system must be architecturally blocked from executing identity matches for law enforcement without a validated judicial warrant.
* **7.1 (independent forensics):** All access logs to the biometric search database must be recorded in an unalterable, independent ledger to prevent insider abuse and unauthorized searches.
* **9.4 (least privilege):** The scraping and processing of billions of public images without explicit, proportional limits violates the principle of least necessary access.