This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Finnish National Police Board was reprimanded by the Data Protection Ombudsman for the unauthorized use of Clearview AI by the National Bureau of Investigation. During a 2020 trial, officers conducted approximately 120 searches using the facial recognition tool to identify potential victims of child sexual abuse without ensuring compliance with data protection legislation or obtaining approval from the controller. The incident highlights risks associated with the unsanctioned adoption of third-party AI tools by law enforcement agencies.
Finland's National Police Board was reprimanded for illegal processing of special categories of personal data in a facial recognition trial to identify potential victims of child sexual abuse.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The police unit tested and used the AI tool independently without the approval or oversight of the National Police Board, highlighting a failure in internal governance and regulatory compliance.
The incident involved the unlawful processing and transmission of sensitive biometric facial data to an unvetted third-party platform without the consent of the data subjects or authorization from the data controller.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy incident was caused by the human decision of NBI officers to use an unapproved third-party tool, resulting in an unintentional personal data breach while pursuing the goal of victim identification.
The unauthorized use of Clearview AI by the Finnish National Bureau of Investigation represents a minor national security concern characterized by internal governance failures and regulatory non-compliance. While the incident involved the unlawful processing of biometric data of approximately 120 individuals, it was a localized law enforcement trial with no broader threat to national sovereignty or critical infrastructure.
The report describes Clearview AI as a software tool that allows users to upload a photo of a person and receive matching public photos and links. It performs a specific, well-defined function on direct input without autonomous planning.
Risk Level 2 (High Risk). The system is a facial recognition application used in law enforcement, which is explicitly classified as high-risk under the EU AI Act due to its significant implications for fundamental rights and privacy.
The AI system was explicitly used to perform facial recognition on uploaded images to identify potential victims of child sexual abuse.
The reports provide clear, consistent, and official details from both the Finnish police and the European Data Protection Board regarding the unauthorized trial, the number of searches, and the regulatory reprimand.
None
Technology
Misleading Software Capabilities
Belief that system does not store searches, leading to false sense of security.
Unregulated Scraping Database
Clearview database relied on billions of scraped social media images.
Potential Match Inaccuracies
Facial recognition software provides probabilities, not facts, risking errors.
Data Inputs
Unsanctioned Biometric Processing
Processing of special categories of sensitive personal data without consent.
Lack of Data Retention Details
Police did not determine how long data would be stored or if shared.
Use of Real Victim Images
Real images of child exploitation victims were uploaded to a third-party app.
Human Factors
Unit Overconfidence in Tool
Staff assumed the tool was safe based on a brief presentation at Europol.
Workload Pressure
Unit sought automation to control increased child abuse screening workload.
Process and Methods
Lack of Prior Impact Assessment
No data protection impact assessment was conducted before starting the trial.
Unchecked Software Sourcing
Free trials were used without formal procurement or security vetting.
Inadequate Training on Rules
Personnel were not sufficiently familiar with data processing regulations.
Management
Lack of Internal Oversight
NBI unit made independent decision to use tool without management approval.
Failure to Monitor Staff
National Police Board failed to prevent unauthorized software trials.
Poor Internal Communication
NBI leadership was unaware of tool usage until contacted by media.
Regulatory Environment
Ambiguous Law Enforcement Rules
Unclear boundaries regarding GDPR exemptions for covert police investigations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
