Artificial Intelligence (AI) is no longer just transforming technology—it is reshaping how governments, institutions, and individuals manage privacy, power, and control. At the center of this transformation lies personal data: how it is collected, stored, used, and regulated.
Two developments highlight the urgent relevance of this issue. One is the case of Clearview AI, a facial recognition company that harvested over 50 billion facial images from the internet and sold access to its database to law enforcement agencies around the world, including in Australia. The other is the rapid spread of AI-powered applications across Pacific Island Countries (PICs), where data privacy laws and oversight mechanisms are either weak or entirely absent.
This article connects these two cases to show how global tech firms exploit regulatory gaps and technological weaknesses, especially in regions without the capacity to monitor or control the flow of data. More broadly, it underscores the critical need for the Pacific region to strengthen its digital sovereignty through legal, infrastructural, and institutional reforms.
Clearview AI and Facial Recognition Technology
Clearview AI operates by scraping facial images from publicly available sources such as social media, blogs, and news sites. It uses machine learning to convert these images into biometric vectors—unique digital signatures of a person’s face—and stores them in a searchable database. Law enforcement can upload a facial image and receive likely matches, complete with links to where the original image appeared online.
While marketed as a crime-solving tool, the system functions as a global surveillance network. Most individuals whose images are stored are not suspects, criminals, or even aware their photos are being used. Consent is entirely bypassed.
Australia’s Legal Response
Between November 2019 and January 2020, the Australian Federal Police (AFP) tested Clearview AI’s technology. However, the AFP failed to conduct a Privacy Impact Assessment (PIA), as required under the Australian Government Agencies Privacy Code.
An investigation by the Office of the Australian Information Commissioner (OAIC) found that Clearview AI had violated multiple provisions of the Privacy Act 1988, including:
- Collecting biometric data without consent (APP 3.3)
- Using covert and unfair collection methods (APP 3.5)
- Failing to inform individuals about data collection (APP 5)
- Not verifying the accuracy of matched data (APP 10.2)
- Lacking internal governance procedures for managing personal data (APP 1.2)
Clearview was ordered to delete all Australian data. It resisted, arguing it did not operate in Australia and wasn’t subject to its laws. In 2023, the Administrative Appeals Tribunal (AAT) rejected this, affirming that publicly available facial images are still personal information.
Despite this, Clearview has not proven compliance. In 2024, the OAIC announced it would not pursue further enforcement, citing resource constraints and the company’s ongoing legal battles in other jurisdictions. This illustrates a grim reality: regulators can be overpowered or outpaced by transnational tech firms.
The Pacific Islands: Digital Growth Without Digital Defenses
Meanwhile, the Pacific Islands are seeing a surge in digital adoption. Smartphones are lifelines for banking, healthcare, education, booking tickets and more. Alongside this, AI-powered apps—like ChatGPT, Gemini, Durable, and DeepSeek—are flooding into the region.
But here’s the problem: most PICs lack comprehensive data protection laws. Only a few, such as Papua New Guinea and Samoa, have begun exploring governance frameworks. This leaves millions vulnerable to unregulated digital surveillance.
DeepSeek AI: A Warning Sign
One cautionary tale is DeepSeek, a Chinese AI assistant that grew popular across the Pacific in 2023. It offered voice-based help and chatbot services. However, a cybersecurity audit by Feroot Security uncovered covert data transfers to CMPassport.com, linked to China Mobile, a company blacklisted by the U.S. government.
Though DeepSeek denied wrongdoing, the case reveals the stakes: in regions with weak oversight, AI tools can silently function as surveillance infrastructure.
Digital Sovereignty
The Clearview and DeepSeek cases raise a fundamental question: Who controls the data?
Country Code Top-Level Domains (ccTLDs)
Internet infrastructure is central to digital sovereignty. The island of Niue lost control of its .nu domain—sold to a Swedish foundation without its consent. Sweden profits, while Niue receives no benefits or oversight.
In contrast, Papua New Guinea’s DataCo manages its .pg domain and data networks. Samoa’s Levili Data Centre hosts critical government services and is among the most secure in the Pacific.
Owning digital infrastructure is key. Without it, nations must rely on foreign tech giants—like Google, Amazon, or Huawei—for data processing and storage, risking both security and autonomy.
Surveillance, Geopolitics, and Future Risks
Surveillance is not just a technology issue—it’s a geopolitical one. U.S. companies like Google and Meta routinely comply with government data requests. Chinese firms like Huawei and China Mobile are deeply integrated into national surveillance strategies.
As Edward Snowden’s 2013 revelations showed, surveillance often happens quietly—through backend access to cloud platforms. Now, AI supercharges this: voice recognition, real-time video analysis, behavioral prediction.
For small nations, outsourcing infrastructure leads to long-term digital dependency. Control over national policy, economic decisions, and security becomes compromised.
Future Outlook and Recommendations
- Enforce Cross-Border Accountability
Use regional treaties, trade mechanisms, and sovereignty clauses to enforce privacy laws beyond borders. - Create a Pacific Data Governance Framework
Inspired by the GDPR or Australia’s Privacy Act, build regional standards for consent, data retention, and lawful processing. - Invest in National Infrastructure
Own and operate data centers, control ccTLDs, and develop secure public clouds. - Make Consent Meaningful
Require clear, accessible disclosures from AI apps about what data is collected and why. - Build Digital Literacy
Launch community workshops, school curricula, and media campaigns to raise awareness and resilience.
Conclusion
What links Clearview AI and the Pacific Islands is the imbalance of power in the digital ecosystem. AI companies, backed by global infrastructure, can harvest data unchecked. For smaller nations, the cost is sovereignty.This is not just about privacy. It is about who holds power in the digital age. Data is the new oil and those who control it will shape the future.
By Songo Nore and Rohan Sachdeva