Clearview AI has been dealt its biggest blow yet, with Canada calling the app illegal and demanding it delete photos of Canadian citizens.

Clearview AI made headlines last year when the depth of its activities were uncovered. The company scraped photos from countless websites, including the top social media platforms, and amassed a database of billions of photos. Clearview then sold access to that database to law enforcement officials all over the country.

Despite its claims, however, Clearview wasn’t the responsible purveyor of information it claimed to be. Instead, it gave investors, clients and friends access to the company’s database for their own personal uses, including entertainment. The company also began expanding internationally, working on deals with authoritarian regimes.

Despite multiple investigations in the US, it appears Canada has taken the strongest stance yet, declaring the software illegal.

“Clearview sells a facial recognition tool that allows law enforcement and commercial organizations to match photographs of unknown people against a massive databank of 3 billion images, scraped from the Internet,” said Daniel Therrien, Privacy Commissioner of Canada. “The vast majority of these people have never been, and will never be, implicated in any crime.

“What Clearview does is mass surveillance and it is illegal. It is an affront to individuals’ privacy rights and inflicts broad-based harm on all members of society, who find themselves continually in a police lineup. This is completely unacceptable.”

Clearview tried to make the claim that it did not need permission to collect the photos it uses, since they’re already posted on social media. The Canadian government disagreed, since Clearview’s purpose for collecting the photos differed from the reason people uploaded them.

As a result, the investigation came to the following conclusion:

We recommended that Clearview: (i) cease offering its facial recognition tool to clients in Canada; (ii) cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Canada; and (iii) delete images and biometric facial arrays collected from individuals in Canada in its possession.

While the government doesn’t yet have the authority to enforce the investigation’s recommendations, Therrien is hopeful Parliament will take them under advisement when it considers upcoming privacy legislation.

“The company essentially claims that individuals who placed or permitted their images to be placed on the Internet lacked a reasonable expectation of privacy in such images, that the information was publicly available, and that the company’s appropriate business interests and freedom of expression should prevail,” Therrien added.

“My colleagues and I think these arguments must be rejected. As federal Commissioner, I hope that Parliament considers this case as it reviews Bill C-11, the proposed new private-sector privacy legislation. I hope Parliamentarians will send a clear message that where, as here, there is a conflict between commercial objectives and privacy protection, Canadians’ privacy rights should prevail.”