The Dutch Data Protection Authority (DPA) has levied a €30.5 million ($33.7 million) fine on U.S. based facial recognition company Clearview AI for building an illegal database. The watchdog said that the company “automatically” harvests billions of photos of people from the internet, which it “then converts… into a unique biometric code per face.”

DPA also issued an additional order, imposing a penalty of up to €5 million on Clearview for non-compliance.

“Clearview AI does not have a place of business in the Netherlands or the European Union; it does not have any customers in the Netherlands or the EU,” Jack Mulcaire, Clearview AI’s Chief Legal Officer, reportedly said. “The company does not undertake any activities that would otherwise mean it is subject to the GDPR (the EU’s General Data Protection Regulation). This decision is unlawful, devoid of due process, and is unenforceable.”

In its statement, DPA stated that Clearview had no objection to its decision and therefore cannot appeal against the fine.

“Facial recognition is a highly intrusive technology that you cannot simply unleash on anyone in the world,” DPA Chairman Aleid Wolfsen said in a statement, which warned that using Clearview’s services was also illegal under Dutch regulations.