![[2025] UKUT 319 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png){kind=logo}
A summary of the relevant factual background
A summary of the relevant factual background
The appeal arose from the Notices issued by the ICO following completion of his investigation into Clearview’s activities in the UK. The Notices were issued on the basis that the ICO was satisfied that:
Clearview was a controller of data, as defined in sections 3(6) and 5 of the Data Protection Act 2018 (“DPA 2018”), Article 4(7) of the GDPR and Article 4(7) of the UK GDPR; and
Clearview’s processing of the personal data of UK residents came within (and / or had previously come within) the scope of the GDPR (in relation to processing before 11pm on 31 December 2020) and the UK GDPR (in relation to subsequent processing), as a result of the application of Article 3(2)(b) of the GDPR and Article 3(2)(b) of the UK GDPR.
The ICO decided that Clearview had infringed Articles 5, 6, 9, 14, 15 to 17, 21 and 22 of the two GDPRs, and had failed to carry out a Data Protection Impact Assessment under Article 35. The ICO imposed a monetary penalty administrative fine on Clearview of £7,552,800 (equivalent to €9 million, using the exchange rate applicable at 25 April 2022).
Clearview appealed to the FTT on 29 June 2022. It challenged not only the identified breaches, but also whether the ICO had jurisdiction to issue the Notices. Clearview argued that, because it is a foreign company and because of the nature of the service it offered, and the clients to which it offered its service, it did not fall within the territorial scope of the GDPRs.
Clearview is an American technology company incorporated in Delaware. At the date of enforcement action taken by the ICO, Clearview did not have a corporate presence in the UK. The FTT found that when the ICO issued the Notices, Clearview had clients in the USA and other countries around the world including Panama, Brazil, Mexico, and the Dominican Republic.
The FTT described Clearview’s principal service as supporting clients in the discharge of their criminal law enforcement / national security functions (with a view to assisting those clients in identifying criminal suspects / national security threats and the victims of crime) through the use of facial recognition technology that makes a comparison of an image submitted by the client against a database of images copied from the internet and saved by Clearview (the “Service”).
Between June 2019 and March 2020, Clearview provided the Service to what it described as a small number of UK clients on a trial basis. The FTT referred to this in its decision as the “UK Test Phase”, and found that during the UK Test Phase, 721 searches were made by UK clients.
- Heading
- The decision of the Upper Tribunal is to allow the appeal The decision of the First-tier Tribunal made on 17 October 2023 was materially in error of law. It is SET ASIDE under section 12(2)(a) of the Tribunals, Courts and Enforcement Act 2007 (“TCEA
- REASONS FOR DECISION
- Introduction
- The decision under appeal
- A summary of the relevant factual background
- The FTT’s decision
- The FTT’s findings of fact
- The FTT’s conclusions
- The issues in this appeal
- Appeal ground 1
- Appeal ground 2
- Appeal ground 4
- Additional Reason 1
- The scope of the appeal - admitting the additional reasons arguments for consideration
- Permitting Privacy International to intervene in the appeal
- Permitting Clearview to rely on a written reply to Privacy International’s skeleton argument
- Reliance on the evidence filed by Privacy International
- Reliance on legal arguments not raised before the FTT
- Legal framework
- Relevant legislative provisions
- The GDPR
- The UK GDPR
- “Article 2 This Regulation applies to the automated or structured processing of personal data, including
- 1A. This Regulation also applies to the manual unstructured processing of personal data held by an FOI public authority This Regulation does not apply to
- “Article 3
- The 95 Directive
- The Law Enforcement Directive
- State immunity and foreign act of state
- Material scope: the caselaw
- Territorial scope: the caselaw
- The Travaux in respect of the GDPR
- The EDPB Guidelines
- Data subjects in the Union
- The burden of proof in appeals against ICO Notices
- Analysis
- The parties’ positions on material scope in brief
- What the FTT decided in relation to Article 2(2)(a)
- General approach to construction of the GDPRs
- Domestic authorities on comity, extra-territoriality and utility
- EU authorities on extra-territorial effect and comity
- Certainty and foreseeability
- Proportionality
- EU law authorities on the construction of Article 2(2)(a) of the GDPR
- Relevant comity principles
- Our construction of Article 2(2)(a)
- Analysis of Clearview’s proposed intersectional construction
- Alternative analysis based on the ICO’s construction
- Would regulation of Clearview’s data processing breach comity principles?
- Article 3(2)(b) GDPR: territorial scope
- What was the policy objective behind Article 3(2)(b)?
- The meaning of “related to” in Article 3(2)(b)
- The meaning of “behavioural monitoring” in Article 3(2)(b)
- Ground 1
- Ground 2
- Ground 3
- Ground 4
- Clearview’s Additional Reasons
- Additional Reason 1
- Additional Reason 2
- Additional Reason 3
- Additional Reason 4
- Conclusions