ICO Appeal Overturns Clearview GDPR Decision

In the UK, an appeal by the Information Commissioner has succeeded in substantially overturning a 2023 ruling, which declared that facial recognition specialist Clearview AI could not be fined under GDPR.

In 2021 the ICO said it planned to impose a fine of just over £17m on Clearview for using images of people in the UK, and elsewhere, collected from the web and social media to create an online database - the amount was subsequently reduced to £7.5m. At the time Information Commissioner John Edwards (pictured) said: 'Clearview AI not only enables identification of people, but effectively monitors their behaviour and offers it as a commercial service. That is unacceptable. That is why we have acted to protect people in the UK by both fining the company and issuing an enforcement notice'.

Two years ago, a judge in the First-Tier Tribunal (FTT) of the UK General Regulatory Chamber disagreed, and said Clearview had successfully argued that - as a company based outside the EU and UK, and acting on behalf of foreign law enforcement authorities - it was not subject to GDPR. The judge said one government is not able to bind or control the activities of another sovereign state.

The ICO in turn appealed this decision to the Chamber's Upper Tribunal (UT), and this week the UT handed down a reversal of the FTT's judgement, upholding three of the Commissioner's four grounds of appeal. It concluded that Clearview's processing of personal information does relate to the monitoring of behaviour of UK residents; that its processing does not fall outside the reach of UK data protection law; and that the FTT applied the law incorrectly in finding the processing to be outside the material scope of the UK GDPR under Article 2(2)a.

'The UT's decision has upheld our ability to protect UK residents from having their data, including images, unlawfully scraped and then used in a global online database without their knowledge,' Edwards said in a statement. 'The ruling also gives greater confidence to people in the UK that we can and will act on their behalf, regardless of where the company handling their personal information is based. It is essential that foreign organisations are held accountable when their technologies impact the information rights and freedoms of individuals in the UK.'

The UT's decision is legally binding and should guide similar cases in future - however Clearview can still seek permission to appeal the decision.

Clearview's CEO resigned the position in February this year. The company has also faced lawsuits and fines in Europe, Australia and the US, and (as of February) remained unprofitable.

Web sites: www.ico.org.uk and www.clearview.ai .