Office of the Australian Information Commissioner (OAIC) — Australian Federal Police (AFP)
The Commissioner determined the AFP breached the APP Code by trialling Clearview AI's facial recognition without a privacy impact assessment, and ordered it to engage an independent assessor and undertake privacy training.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text.
- Decided by
- Australian Information Commissioner
- Parties
- Office of the Australian Information Commissioner v. Australian Federal Police
- Decision date
- December 16, 2021
- Remedy
- The Australian Federal Police was directed to engage an independent assessor to review and report on residual deficiencies in its privacy governance practices and ensure relevant personnel complete updated privacy training.
- Appeal
- Appeal status not stated
Key holdings
The Australian Federal Police breached the Australian Government Agencies Privacy Code by failing to conduct a privacy impact assessment prior to using Clearview AI.
“Commissioner Falk found the AFP failed to complete a privacy impact assessment (PIA) before using the tool, in breach of clause 12 of the Australian Government Agencies Privacy Code”
The agency failed to take reasonable steps to implement adequate governance practices and systems, breaching Australian Privacy Principle 1.2.
“The AFP also breached Australian Privacy Principle (APP) 1.2 by failing to take reasonable steps to implement practices, procedures and systems in relation to its use of Clearview AI”
The Commissioner ordered the law enforcement agency to engage an independent assessor to review and report on its privacy governance deficiencies.
“engage an independent assessor to review and report to the OAIC on residual deficiencies in its practices, procedures, systems and training in relation to privacy assessments”
In plain English
The Australian Information Commissioner and Privacy Commissioner, Angelene Falk, found that the Australian Federal Police failed to meet its privacy obligations when trialing Clearview AI's facial recognition technology. Between 2 November 2019 and 22 January 2020, members of the Australian Centre to Counter Child Exploitation tested the tool by uploading photos of individuals to identify persons of interest and victims in active investigations. Clearview AI's system matches uploaded photos against images scraped from across the internet. The Commissioner determined that the Australian Federal Police did not complete a mandatory privacy impact assessment prior to using the technology, violating clause 12 of the Australian Government Agencies Privacy Code for high privacy risk projects. Additionally, the law enforcement agency failed to take reasonable steps to set up appropriate practices, procedures, and systems to ensure compliance, breaching Australian Privacy Principle 1.2. Internal gaps meant there was no coordinated approach to identify high risk projects or track investigative tools handling personal information, alongside insufficient mandatory privacy training. To address these shortcomings, the Commissioner ordered the agency to hire an independent assessor to evaluate and report on any remaining deficiencies in its privacy governance practices and training. The agency must also implement any recommended changes and ensure relevant personnel complete updated privacy training.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.