Today, the Upper Tribunal found against Clearview AI, the US-based facial recognition technology company, allowing the Information Commissioner’s appeal against a decision of the First-Tier Tribunal which had found that the ICO lacked jurisdiction under the GDPR to take enforcement against the company. AWO acted for Privacy International in its third-party intervention in the appeal.
Background
The appeal was brought by the Information Commissioner (‘ICO’) against a decision of the First-Tier Tribunal (‘FTT’) that had found on 17 October 2023 that the ICO did not have jurisdiction to issue an Enforcement Notice nor Monetary Penalty Notice to Clearview AI Inc (‘Clearview’). Following a complaint by our client Privacy International in May 2021, the ICO had investigated Clearview AI and issued an enforcement notice, ordering the company to stop processing UK residents’ data and to delete any data obtained unlawfully, as well as a fine of £7,552,800.
Clearview challenged the ICO’s enforcement at the FTT. Despite finding that Clearview AI was processing UK data subjects’ data at scale and in particularly invasive ways, the FTT was swayed by Clearview AI’s argument that, as a US company providing services only to foreign state entities, it fell outside the ‘material scope’ of the GDPR (Article 2(2)(a)).
The ICO appealed against the FTT’s decision at the Upper Tribunal (‘UT’). A hearing was held on 9-11 June 2025.
The decision
The UT today found that the FTT erred materially in law in finding that Clearview’s processing was outside the material scope of the GDPR.
Our client’s third party intervention was crucial in convincing the UT that the words of Article 2(2)(a) of the GDPR refer only to activities reserved to EU Member States on which the EU does not have powers to act – rather than all matters outside the competence of the EU (as the ICO had argued), or all activities of third parties that ‘intersect’ with state clients’ processing (as Clearview had argued):
"190. We are persuaded that Privacy International’s interpretation is to be preferred. […] We accept Ms Demetriou’s submission that by the time the GDPR was enacted, the phrase “outside the scope of Union law” already had a recognised meaning in EU legislation. That meaning was not the literal meaning for which Ms Proops advocated (i.e. anything beyond the legislative competence of the Union, howsoever excluded). Rather, it referred to matters reserved to national governments of Member States."
Clearview’s processing therefore fell (and still falls) under the EU and UK GDPRs, and the ICO had jurisdiction to issue its notices.
Clearview had also asked the UT to set aside the decision of the FTT that the ICO had territorial scope, but the UT found that the FTT was right in that finding. Clearview had argued that its processing was not ‘related to’ ‘behavioural monitoring’ of EU/UK data subjects, and hence that it was not within the GDPR’s territorial scope either. The UT rejected this challenge, finding that both terms are to be interpreted broadly, ‘as a response to the challenges posed by “Big Data” in the digital age’.
The case is now remitted to the FTT to decide Clearview’s substantive appeal, on the basis that the ICO had jurisdiction to issue its notices.
Lucie Audibert of AWO and representative of Privacy International, the intervener, said:
“We are so pleased that our client’s intervention in this important appeal was influential on the outcome. The case had evolved to raise fundamental issues of international and EU law and their impact on the extraterritorial reach of EU and UK data protection law, such that our client was ideally placed to make its contributions. This decision will have important implications for the accountability of foreign companies when they process the data of UK data subjects. It rectifies the dangerous position the FTT had set – intrusive surveillance technology is still very much subject to the protection of our laws, whether sold to foreign state authorities or not.”
Tom West, Programme Director at Privacy International, said:
"This judgment confirms that private companies cannot escape data protection law just because they work closely with foreign law enforcement or national security agencies. It would be a massive problem if those agencies could outsource intrusive processing activities to private actors who were outside the scope of the law. This case also serves as an important reminder of the need for accountability as AI companies seek to expand what they do with our data."
Privacy International was represented pro bono by Ravi Naik and Lucie Audibert of AWO. AWO instructed Marie Demetriou KC and Aarushi Sahore of Brick Court Chambers, who also acted pro bono. We are grateful to our counsel team for their important and powerful contributions to the case.
The full judgment can be found here and at the bottom of this page.
CONTACT
Please contact Lucie Audibert (lucie.audibert@awo.legal) for enquiries.