Facts
Clearview AI Inc., a Delaware company, uses crawlers to collect images of human faces from the public internet, maps them with algorithms into facial vectors and stores them in a searchable database of tens of billions of images. It sells access to public and private clients working in national security and criminal law enforcement. On 18 May 2022 the Information Commissioner (ICO) issued an enforcement notice and a monetary penalty notice for £7,552,800, finding breaches of several provisions of the GDPR and the UK GDPR. Deciding a preliminary issue, the First-tier Tribunal held on 17 October 2023 that the processing fell outside the material scope of both regimes, so the ICO lacked jurisdiction. The ICO appealed.
Question
The appeal raised two jurisdictional questions. The first concerned the exclusion in Article 2(2)(a) of the GDPR (mirrored in Article 2(1)(a) of the UK GDPR) for processing “in the course of an activity which falls outside the scope of Union law”, and whether it covers a private company serving foreign law enforcement and security agencies. Clearview argued that its processing intersected with its clients’ quintessentially state functions and that comity between states put it beyond regulation. The second question was whether a company with no UK establishment was caught by Article 3(2)(b) because its processing was related to the monitoring of the behaviour of people in the UK, even though the searches were run by its clients.
Decision
The Upper Tribunal allowed the appeal on 6 October 2025. The Article 2(2)(a) exclusion covers only activities over which Member States have kept control and not conferred powers on the Union; it does not extend to third parties whose processing intersects with their clients’ state functions. “Behavioural monitoring” in Article 3(2)(b) is to be read broadly and can cover the passive, automated collection, sorting, classification and storage of data with a view to later profiling, including by another controller; human watchfulness is not required. “Related to” also catches controllers whose processing is linked to monitoring carried out by someone else. The case was remitted to the First-tier Tribunal to decide the merits on the basis that the ICO had jurisdiction.
Why it matters
The decision confirms that a facial recognition provider based outside the UK, serving foreign national security and law enforcement clients, can still be subject to UK data protection law because of the images it collects. Its broad reading of behavioural monitoring, which does not require human observation, is relevant to other AI developers that scrape personal data from the web. The ruling settles only jurisdiction; whether Clearview breached the law and whether the penalty stands are matters for the First-tier Tribunal.
Related stages
According to the ICO, the Upper Tribunal granted Clearview permission to appeal to the Court of Appeal on 19 December 2025.