Upper Tribunal finds in favour of ICO in appeal against First-tier Tribunal decision on Clearview AI

Background

In 2022, the ICO fined Clearview £7.5m. Clearview engaged in data scraping images of people in the UK from websites and social media to create an online database which allows customers, including the police, to check images against those in the database, using Clearview’s AI application. Notwithstanding that Clearview had no UK establishment and did not offer services to UK customers, the ICO determined that Clearview had breached several data protection requirements (under the GDPR before end 2020, and subsequently under the UK GDPR, the GDPRs), including by failing to inform individuals that their personal data was processed in this way.

In October 2023, Clearview appealed against this decision before the First-tier Tribunal, both in relation to the findings of breach and on the basis that the ICO did not have jurisdiction to take enforcement action. The First-tier Tribunal considered the issue of jurisdiction and concluded that Clearview’s activities fell within the territorial scope of the GDPRs, since Clearview was processing personal data related to its customers’ monitoring of individuals’ behaviour in the UK (Article 3(2)(b)). However, the First-tier Tribunal considered that the activities fell outside the material scope of the GDPRs because Clearview’s services were only provided to non-UK criminal law enforcement and national security entities. As such, the processing of personal data was in the course of an activity that was out of scope of Union and UK law, as applicable (Article 2(1)(a)).

Upper-tier Tribunal ICO appeal

The ICO challenged this finding before the Upper Tribunal on the basis that the First-tier Tribunal was wrong to decide that:

• the behavioural monitoring carried out by Clearview’s customers fell outside the scope of Union law (and therefore outside the material scope of the GDPRs);
• Clearview’s own processing fell outside the scope of Union law (and therefore outside the material scope of the GDPRs); and
• Clearview itself did not carry out behavioural monitoring.

Privacy International was also permitted to intervene in the proceedings and made submissions in support of some of these grounds for appeal.

The Upper Tribunal decided that:

• The First-tier Tribunal made a material error in law in concluding that all of Clearview’s customers were outside the material scope of the GDPRs. Foreign states fall outside the material scope of the GDPRs but the First-tier Tribunal had insufficient evidence to conclude that all private sector customers were also outside scope.
• The First-tier Tribunal made a material error in law when finding that Clearview’s own processing was outside the material scope of the GDPRs. In fact, as a result of the fact that it provided its services to foreign law enforcement and government agencies, Clearview’s own processing of personal data was not itself “in the course of an activity which falls outside the scope of Union law”.
• Clearview’s own processing of personal data did amount to monitoring of behaviour of individuals in the UK. The First-tier Tribunal took a narrow view of behavioural monitoring and concluded that Clearview did not undertake monitoring of behaviour itself. In contrast, the Upper Tribunal considered that behavioural monitoring should be broadly interpreted and could include (i) passive collection, (ii) sorting, (iii) classification and (iv) storage with a view to potential future use which consists of profiling of an individual. The phrase does not necessarily require active “watchfulness”. Separately, the Upper Tribunal agreed with the First-tier Tribunal (albeit for different reasons) that, in the context of Article 3(2)(b) territorial scope, the words “processing activities related to the monitoring of behaviour” can include processing by one controller relating to the behavioural monitoring carried out by a different controller.

Next Steps

The First-tier Tribunal must now consider Clearview’s substantive appeal against the ICO’s enforcement action and monetary penalty notice.

It is reported that Clearview will appeal the decision.

The ICO press release is available here and First-tier Tribunal judgment is available here.