[2025] UKUT 319 (AAC)

Clearview’s Additional Reason 4 raises the issue whether there was evidence before the FTT that was adequate to support its finding that its clients’ behavioural monitoring was related to the personal data of data subjects in the UK in relation to their behaviour in the UK.

Success on this issue can only assist Clearview if we are wrong that Clearview itself was engaged in behavioural monitoring.

The FTT proceeded from its primary findings about the way that Clearview goes about scraping the public facing internet for data and the sheer size of its database (see its finding at [40] that it contains billions of images), to make a secondary finding by inference that it was “inevitable” that the database includes images of data subjects in the UK (see its finding at [131]). That was clearly a finding that was open to it, even in the absence of specific evidence of specific individuals whose personal data was included in Clearview’s database.

The FTT proceeded from this finding, and its primary findings about the way that searches of Clearview’s database are made, to infer that it was also “inevitable” that the vectors assigned to UK data subjects’ facial images (constituting their personal biometric data) in the database will be processed during a search of the database since the matching process involves a comparison of the probe image uploaded by a client to Clearview’s system against its entire database (see [131] of its decision). That finding was also clearly open to it.

Clearview maintained, though, that there was insufficient evidence before the FTT to permit a finding that its clients actually received data of UK data subjects in any search results or that they engaged in behavioural monitoring in respect of UK data subjects.

The FTT’s findings in this regard were somewhat tentatively expressed: it said that it was “less likely that an image of a UK data subject will be produced as a successful match/partial match where the clients are investigating alleged crimes/threats within their jurisdiction (i.e. not in the UK), unless the UK data subject is an international criminal, has become involved in activity the subject of investigation, or the client is investigating a multinational threat” (see the FTT’s decision at [131]).

Clearview’s witness, Mr Mulcaire, spoke in his evidence in terms of possibilities only. Ms Proops encouraged us to read the FTT’s “less likely” in [131] (and the repetition of this phrase in [140]) of its decision) as meaning the converse of “more likely”, and as indicating that it was not satisfied of this matter to the civil standard of proof. That is not the only way to interpret what the FTT said. We are satisfied that, when read in context, the FTT was simply indicating that the likelihood of the data of a UK data subject being provided to a client in a search result was “less likely” than the “inevitability” of Clearview’s database including images of data subjects in the UK and the vectors assigned to their facial images being processed during a search of the database. When one reads on to [140], the FTT then expresses its conclusion in more conventional terms: “On the basis of our factual findings and having applied the law we have concluded that there is, more likely than not, monitoring of the behaviour of UK data subjects in the UK as far as their behaviour takes place within the UK” (our emphasis added).

Reading the decision as a whole, we are not persuaded that the FTT misdirected itself in law as to the appropriate standard of proof. We infer from the FTT’s conclusion that it was “more likely than not” that monitoring of the behaviour of UK data subjects occurred that, despite Mr Mulcaire’s evidence being expressed in terms of mere possibilities, the FTT was satisfied on the basis of the evidence as a whole that there was a greater likelihood of UK data subjects’ data being included in a search result. Given the FTT’s findings about the nature and scale of the database, the international nature of crime, law enforcement and national security concerns, and the nature of Clearview’s clients’ activities, the FTT was entitled to conclude as it did.

Ms Proops also relied upon the principle of proportionality (see [177] above), arguing that even if the FTT was entitled to find that monitoring of the behaviour of UK data subjects took place, as far as their behaviour takes place in the UK, it would be wholly disproportionate for Clearview to be brought within the weighty and onerous GDPR regime as a result of what would be de minimis processing in this regard.

While we acknowledge that proportionality is a relevant consideration in the context of assessing the regulatory action taken against Clearview, we accept Mr Susskind’s submission that issues of proportionality cannot be relevant to the binary question of whether or not the ICO had jurisdiction over Clearview’s activities at all. There is nothing in the wording of Article 3(2)(b) to suggest that a de minimis threshold applies to the application of its criteria and there is nothing in the Recitals, the EDPB Guidelines or in Soriano to support this suggestion. The appropriate juncture at which to consider proportionality is at the substantive stage, when enquiring whether a penalty should be imposed and, if so, what that penalty should be. Ms Proops’ submission elides these logically separate issues in suggesting that if it would be disproportionate to issue a penalty, the ICO should have no jurisdiction at all.

For these reasons we also dismiss Additional Reason 4.