Answers to Parliamentary questions on the report that Dutch police have nevertheless used facial recognition software from controversial company Clearview AI

1. Are you familiar with the report ''Clearview AI Offered Free Facial Recognition Trials To Police All Around The World''?(1)

Yes.

2. Do you recall that in March 2020 you stated in answers to Parliamentary questions by Member Verhoeven that: "as far as I have been able to verify, there are no Dutch investigative services cooperating with Clearview"?(2)

Yes.

3. Do you recall the answers by the Minister of Justice and Security to Parliamentary questions by Member Buitenweg (Groenlinks) in which the Minister stated that: "I have already been informed by the police several weeks ago, when the first mention of Clearview in relation to the Dutch police was made on the Internet. They have not been centrally approached by Clearview, are not aware of any contacts with that company, and have not purchased any products."(3)

Yes.

4. How do you explain that according to new research based on internal data from Clearview AI, it appears that the National Police have used Clearview AI between 51 and 100 times?

The log files to which BuzzFeed News refers predate February 2020. This also applies to the leaked customer list that BuzzFeed News previously wrote an article about and that you asked written questions about in March 2020.(2,3)

The BuzzFeed News publication cites that the leaked Clearview data recorded searches with someone associated with the "National Police Corps" as the requester. Interrogation within the police did not reveal this. BuzzFeed News did not provide further information that would allow for highly targeted inquiries.

The BuzzFeed News article refers to a meeting at Europol in late 2019, where test accounts were made available. Upon inquiry, there was no indication that any test account was used by Dutch police employees at or as a result of this meeting.

In response to the previously submitted written questions, the Minister of Justice and Security indicated that the police have not been centrally approached by Clearview, are not aware of any contacts with that company, and have not entered into a relationship with that company to purchase products from it.3 In its response to the Volkskrant in response to this BuzzFeed News report, as well as in response to this set of Parliamentary questions, the police again emphasized that the police do not work with Clearview and do not intend to do so.

The only application used by the police in which biometric facial recognition technology is used is Catch. The police have an internal policy prohibiting the deployment of other applications of facial recognition technology in police operational processes unless there is a prior positive opinion based on a legal ethics review, at the discretion of the joint Ethics and Digitization portfolio holders. This has not yet resulted in approval of any use of biometric facial recognition technology other than Catch.

However, it cannot be ruled out that an individual police officer may have visited the Clearview website on one occasion and made some searches. This does not mean that this system was operationally deployed. Additionally, due to lack of further information from both BuzzFeed News and Clearview AI, it also cannot be ruled out that someone posed as a police employee.

5. Were you aware of the use Clearview AI within the police and government? If yes, why did you not inform the Chamber about this? If no, how is it possible that despite several requests from the Chamber to inventory the use of Clearview AI, this subsequently did not surface?

As previously indicated, the police have stated that they do not use Clearview and do not intend to do so. The information to which BuzzFeed News refers cannot be verified by me or by the police. Of course, the police are alert to signs that might indicate that this system has been used after all. The Police Data Protection Officer is also in contact with the Personal Data Authority on this matter. Neither in the financial records of the police nor in the departments involved in digital research has any indication been found that Clearview would have been used.

6. In what context was Clearview AI used by the national police? Were any financial payments made to the Clearview AI company?

The police disclosed in March 2020 and last June in response to Wob requests that there are no documents that see agreements on the use of Clearview. In answering your Chamber's questions in March 2020, I was informed by the police.(4, 5) They are not aware of any contacts with that company and did not purchase any products. The police also checked this at the time, including in their financial adminis tration.

7. How was the consideration of whether the concrete application of facial recognition and processing of biometric data was in line with human rights and the General Data Protection Regulation (AVG)? Is the use of Clearview AI at all compatible with the AVG?

In the November 20, 2019 parliamentary letter on safeguards and frameworks in the use of facial recognition technology, the Minister of Justice and Security wrote that in our democratic legal order and for the sake of our national security, the use of technologies such as biometric facial recognition technology should be subject to clear frameworks.(4) After all, the protection of privacy is a fundamental right. Infringement of that fundamental right - and capturing someone's face is just that - is only permissible if a number of legal safeguards are met.

There is a special law for the processing of personal data necessary for the exercise of police duties: the Police Data Act (Wpg). The Wpg provides the basis and further regulation for processing these data. The application of facial recognition technology for identification purposes involves the use of biometric data. Biometric data are special personal data to which stricter rules apply. The police may only process these data if this is unavoidable for the purpose of the processing and in addition to processing other police data on the person concerned. For a more detailed explanation of the legal framework, I refer you to the aforementioned parliamentary letter.

The use of Clearview is not compatible with legal provisions and violates our fundamental rights. The collection and processing of personal data for the purpose of criminal justice must be for a concrete purpose, must be based on the law, and must comply with the principles of proportionality and subsidiarity. And this must be subject to supervision. Now that a basis for acquiring images or biometric characteristics using Clearview is not considered present, a question of the compatibility of processing such data with the rules applicable to it need not and cannot be answered in detail.

8. Have matches made through Clearview AI been used in criminal cases? If so, what impact does this have on the legality of these cases?

No.

9. Can you answer again which further public organizations have used the controversial facial recognition software? What financial arrangements have been made with Clearview AI?

I am not aware of any use of Clearview by Dutch public organizations, or any financial arrangements with Clearview.

10. What steps will you take to ensure that Clearview AI and similar companies cannot simply be used in the future?

On December 20, 2019, the Minister of the Interior and Kingdom Relations and the Minister for Legal Protection presented the study "Supervision of the use of algorithms by the government" to your House of Representatives.(5.) Based on an analysis of laws and regulations, the researchers found no legal gap in the supervisory tasks. I therefore see no reason to take additional steps.

11. Are you aware of the report "The Rise and Rise of Biometric Mass Surveillance in the EU," by the organization European Digital Rights (EDRi), which examines the use of biometric surveillance in three member states, including the Netherlands?(6) What is your reaction to this report?

Yes, I have taken note of this report. I regard the report as an overview report. The information presented and the points of criticism have been previously published in Dutch newspapers, on news websites and in publications. Several members of your Chamber have already asked questions about it. I have already addressed the criticisms described in the answers to those questions. I see no reason to add to them.

12. Do you share the report's conclusion that the collection of biometric data is rapidly increasing and that this is often not in compliance with the AVG, because in most cases there is no substantial public interest to justify biometric surveillance, nor is citizens asked for consent?

This conclusion is too generalized. With the rapid development of technology, data collection is indeed increasing dramatically. To prevent unrestrained and undirected data collection, the AVG has a number of safeguards. One of these is the principle of purpose limitation. The general rule is that personal data may only be processed if it is compatible with the purpose for which the data was collected. Conversely, this also means that data may not be collected without a (legally permitted) purpose. Whether data collection is compatible with the AVG depends on the concrete circumstances. It can therefore vary from one situation to another. Biometric surveillance, in the sense of real-time facial recognition, is currently not done in the Netherlands.

13. What will you do to stop the unlawful collection of biometric data?

In the November 20, 2019 parliamentary letter, the Minister of Justice and Security made it clear that the processing of biometric data can only be done if there is a legal basis for doing so, and if a legal and ethical review has been carried out beforehand.(7) From the Dutch government, therefore, there is no support for using applications such as Clearview that are judged to be unlawful.

For data subjects who believe that biometric data are nevertheless being collected on an unlawful basis, within the Netherlands, the route to the Personal Data Authority is open. The Personal Data Authority supervises compliance with the legal rules for the protection of personal data. In case of violations, it can impose fines.

In my response to earlier questions about Clearview2 I indicated that Clearview operates primarily in the United States. It is primarily up to the authorities in that country to determine whether the law has been violated. Meanwhile, we see that American politics at the Senate level is paying attention to this. If someone suspects that his or her photograph is being used by Clearview and wants to oppose it, they will have to turn to that company or the relevant regulator in the United States.

14. Can you answer each question separately?

Yes.

Footnotes

(1) Buzzfeed News, August 25, 2021 (https://www.buzzfeednews.com/article/ryanmac/clearview-ai-international-search-table)
(2) Appendix Acts 2, session year 2019-2020, no. 2004
(3) Appendix Acts 2, session year 2019-2020, no. 2669
(4) Parliamentary Papers II, session year 2019-2020, 32761 and 30821, no. 152
(5) Parliamentary Papers II, 2019/20, 26643, no. 657.
(6) https://edri.org/our-work/new-edri-report-reveals-depths-of-biometric-mass-surveillancein-germany-the-netherlands-andpoland/#:~:text=The%20EDRi%20network's%20new%20independent,the%20European%2 0Union%20(EU)
(7) 7 Parliamentary Papers II, session year 2019-2020, 32761 and 30821, no. 152.