Frustrated by an apparent lack of cooperation from Clearview, Wolfsen said that the regulator is prepared to pursue legal actions against members of the company’s board of directors.

“Clearview is an American company without an establishment in Europe. Other data protection authorities have already fined Clearview at various earlier occasions, but the company does not seem to adapt its conduct. That is why the Dutch DPA is looking for ways to make sure that Clearview stops the violations. Among other things, by investigating if the directors of the company can be held personally responsible for the violations,” Wolfsen said. “Such (a) company cannot continue to violate the rights of Europeans and get away with it. Certainly not in this serious manner and on this massive scale. We are now going to investigate if we can hold the management of the company personally liable and fine them for directing those violations. That liability already exists if directors know that the GDPR is being violated, have the authority to stop that, but omit to do so, and in this way consciously accept those violations.”

The regulator added that Clearview responded in a letter but did not explicitly dispute the findings. “Clearview has not objected to this decision and is therefore unable to appeal against the fine,” he said.