[2025] UKUT 319 (AAC)

Clearview accepts that Article 3(2)(b) was intended by the legislature to afford the GDPR some degree of extra-territorial effect but says the FTT erred as to the nature and extent of that extra-territoriality.

Ms Proops argued that, looked at in the round, it is clear that Article 3 was not intended to achieve a wide and loose extra-territorial effect, but rather it was intended to remain significantly territorially focused. She submitted that Article 3(2) is the only “genuinely extra-territorial” provision in Article 3, Article 3(1) being about “conventional ‘boots on the ground’ territoriality” and Article 3(3) being about “UK outpost territoriality”. Ms Proops characterised even Article 3(2) as being “territorially anchored”, and indicative of an “avid desire” on the part of the EU legislators to avoid “exorbitance of approach” demanding that the degree of extra-territorial extent for which Article 3(2) provides, should be construed narrowly.

Both Clearview and the ICO pointed out that when the EU enacted the GDPR, it was clearly aware of the risks posed by large scale processing of personal data (as is clear from Recitals 6 and 7). Ms Proops argued that, while it would have been open to the legislators to legislate much more broadly, they chose to exercise restraint due to their wish to avoid affronting international comity principles. She said the practical result of this was that the GDPR was not intended to provide “all singing and all dancing” protection for data rights. Instead, it permits, without regulation, significant foreign processing operations that substantially engage the privacy rights of millions of EU data subjects, just as foreign state mass surveillance activities are excluded from regulation under international law. Ms Proops argued that this was simply the price that had to be paid to ensure that the protection of the interests of EU data subjects did not come at the expense of the protection of international comity.

Ms Proops argued that the degree of extra-territorial effect provided for by Article 3(2)(b) falls to be construed narrowly in line with the principles established by Al-Skeiniand KBR, and with wider comity principles. Because of the particularly weighty and onerous nature of the GDPR regime, and because of the need for legal certainty and proportionality, the need for “close confinement” in interpreting the extent of extra-territoriality in the context of the GDPR is, Ms Proops argued, even greater.

Ms Proops warned against treating data rights as a “trump card” that overrides other policy considerations, cautioning that concerns about comity, utility, certainty and proportionality must be given due weight. She referred us to a variety of authorities dealing with the construction of different legislative schemes with a view to demonstrating that even when there was a legitimate underlying protective purpose to legislation, that did not necessarily justify a broad construction.

In R (Black) Secretary of State for Justice[2017] UKSC 81, [2018] AC 215 (“Black”) the Supreme Court considered whether legislation banning smoking in public places in the UK applied to the Crown. It held that there was a presumption against legislation applying to the Crown unless such application was expressly provided for, and because the smoking ban legislation included no provision to that effect, it did not bind the Crown. The practical effect of this was that the smoking ban did not apply in UK prisons, so prisoners, staff and visitors would not be protected from the effects of passive smoking. Even though the policy driver for the legislation was a very important one (to protect public health by preventing passive smoking in public places) that was not enough, the Justices decided, to justify a broad interpretation that the Crown was bound by it.

Ms Proops said that, by analogy, Article 3(2)(b) GDPR should not be given a broad interpretation to bring third party controllers who do not engage in behavioural monitoring, within the scope of regulation, even though that might produce an optimal result in terms of the protection of the data rights of EU data subjects. Ms Proops argued that to extend the reach of regulation to such persons would be unduly exorbitant, because the policy intent can be achieved by capturing only those “doing the mischief” at which the provision is aimed, namely the behavioural monitoring of EU data subjects.

As explained at [160] to [162] above, we are not persuaded that KBR, Al-Skeini or any of the other authorities to which our attention was directed, establish a general proposition that where words in EU legislation are capable of bearing more than one meaning the meaning that results in the least degree of extra-territorial effect must be applied, even if the usual rules of statutory construction would favour a different meaning.

We do not accept the narrow interpretation that Ms Proops proposes. While we infer that the EU legislators intended to respect comity principles, and we factor that intention into our interpretation of these provisions, we reject the notion that we are compelled to accept the reading that gives the provision the least degree of extra-territorial extent provided that such a reading is “linguistically possible”, however unlikely. Instead, we take a conventional purposive approach to the construction of the GDPRs.