UK Upper Tribunal hands down judgement on Clearview AI Inc

Back in May 2022, the Information Commissioner fined US-based company Clearview the sum of £7.5 million and issued an Enforcement Notice for scraping images of UK residents from the Internet and social media and then uploading them into its global online database that could be used for facial recognition by any Clearview customer.

The company not only enables identification of those individuals, but monitors their behaviour, offering it as a commercial service.

Clearview appealed the fine and Enforcement Notice to the First-Tier Tribunal, with the Information Commissioner’s Office appealing the First-Tier Tribunal’s decision to the Upper Tribunal.

This month, the Upper Tribunal upheld three of the Information Commissioner’s four grounds of appeal, concluding that: 

*Clearview’s processing of personal information is related to monitoring of the behaviour of UK residents 

*Clearview’s processing does not fall outside the reach of UK data protection law on the basis that it provided its services to foreign law enforcement and government agencies.  

*The First-Tier Tribunal applied the law incorrectly in finding that Clearview’s processing of personal information was outside the material scope of the UK General Data Protection Regulation (GDPR) under Article 2(1)(a), which establishes that the UK GDPR doesn’t apply to activities that were already outside the scope of the original European Union data protection law

Material and territorial scope 

The Information Commissioner welcomes the Upper Tribunal decision as it clarifies the material and territorial scope provisions of the UK GDPR. The ruling reaffirms that companies wishing to monitor the behaviour of UK residents will be in scope of UK data protection law, regardless of where the company is based in the world.  

John Edwards, the UK’s Information Commissioner, said: “The Upper Tribunal’s decision has upheld our ability to protect UK residents from having their data, including images, unlawfully scraped and then used in a global online database without their knowledge.”

Edwards continued: “The ruling also gives greater confidence to people in the UK that we can and will act on their behalf, regardless of where the company handling their personal information is based. It’s essential that foreign organisations are held accountable when their technologies impact the information rights and freedoms of individuals in the UK.”

The Upper Tribunal’s decision is legally binding and will guide future cases involving similar jurisdictional questions.

The Upper Tribunal directed that this case should be sent back to the First-Tier Tribunal to determine the substantive appeal on the basis that the Information Commissioner had jurisdiction to issue the monetary penalty notice and Enforcement Notice.

Clearview can seek permission to appeal the Upper Tribunal’s decision.