Wiki · Enforcement timeline
Catalog dashboard
Enforcement timeline
Chronologically-ordered enforcement actions linked to the instruments and topics tracked in the Policy Window catalog. Closed cases sort by their resolution year; ongoing cases sort by initiation. Each entry links to the catalog topics + the catalog instruments the case touches, and (where possible) to the best-available primary source for the action.
13 catalogued cases total · 2 match the current filter (year = 2023; topic = Biometric Identification) clear all.
Filters
Cases (2)
- Settlement with remedy
- Fine imposed
- Open arrow = ongoing (no resolution year yet)
- Fine imposed
2020 → 2023 · EU
France CNIL — Clearview AI
Enforcer: Commission nationale de l'informatique et des libertés (CNIL)
Target: Clearview AI Inc.
Violation alleged: Mass scraping of facial images of French residents + biometric processing without lawful basis. CNIL imposed €20M fine + 5x €100k/day penalty for non-compliance with deletion order.
Lesson: Parallel to Italian Garante action; both fined identical €20M amount within 6 months. CNIL added 5x €100k/day non-compliance penalty when Clearview refused deletion — escalation pattern that EU AIA Art. 99 (penalties up to 7% global turnover) extends. Multi-DPA replication confirms GDPR is enforceable against US-based AI providers serving EU residents.
Source: https://www.cnil.fr/en/facial-recognition-cnil-fines-clearview-ai-eur20-million
- Settlement with remedy
2022 → 2023 · UK
UK ICO live-facial-recognition post-mortem
Enforcer: Information Commissioner's Office (ICO)
Target: South Wales Police + Metropolitan Police (cross-force assessment)
Violation alleged: Live facial recognition deployments in public spaces without adequate proportionality assessment, transparency, or appeal mechanisms. Disparate accuracy across demographic groups.
Lesson: Mandatory pre-deployment data-protection-impact-assessment + ongoing accuracy reporting for police LFR. Demonstrated that principles-based UK regime can produce binding outcomes via sector-regulator action — but slowly (action initiated 2019, settled 2023). Cited as evidence FOR the principles-based regime (operationally adapts to context) AND AGAINST it (slow + uneven coverage).
Editorial scope
This timeline reflects enforcement cases tracked in the Policy Window catalog. It is not exhaustive; coverage focuses on high-precedent matters relevant to the catalogued instruments (currently 13 cases across EU, US, UK, China, India, Italy, France). The catalog deliberately omits routine regulator letters and ongoing investigations whose materials are not public.
For the inclusion rubric (when a case enters the catalog, what level of source-defensibility is required, how jurisdictional balance is managed), see /wiki/methodology. Cases marked “ongoing” remain editorial-watch items; outcomes get backfilled as the public record settles.