Upper Tribunal Upholds ICO Jurisdiction Over Clearview AI

TL;DR: The UK Upper Tribunal has upheld the Information Commissioner’s Office (ICO) authority to enforce data protection law against US-based Clearview AI, confirming that foreign companies monitoring UK residents fall within UK jurisdiction regardless of where they operate.

The Upper Tribunal has delivered a landmark judgment supporting the ICO’s appeal against a First-tier Tribunal decision regarding Clearview AI’s facial recognition database. The ruling affirms that companies monitoring UK resident behaviour remain subject to UK data protection law, even when based overseas and serving foreign clients.

Context and Background

Clearview AI operates a global database built by scraping images from the web and social media, offering facial recognition services to law enforcement and government agencies worldwide. In May 2022, the ICO fined the company £7.5 million and issued an enforcement notice for collecting UK residents’ images without consent.

The Upper Tribunal upheld three of the ICO’s four appeal grounds, establishing that Clearview’s processing constitutes behaviour monitoring of UK residents and cannot claim exemption simply by serving foreign agencies. The tribunal concluded that the First-tier Tribunal had incorrectly applied UK GDPR scope provisions.

Information Commissioner John Edwards emphasised the ruling’s significance for protecting UK residents from unlawful data scraping. The decision clarifies that organisations cannot avoid UK data protection obligations by operating from overseas whilst processing UK residents’ personal information.

Looking Forward

The legally binding decision will guide future cases involving cross-border data protection enforcement and jurisdictional questions. The case returns to the First-tier Tribunal to determine the substantive appeal on the monetary penalty and enforcement notice, with the ICO’s jurisdiction now established.

Clearview AI retains the right to seek permission to appeal the Upper Tribunal’s decision. The outcome strengthens the ICO’s ability to hold foreign technology companies accountable when their services impact UK residents’ information rights and freedoms.

Source Attribution:

Share this article