[2025] UKUT 319 (AAC)

Ground 1 raises the issue whether the FTT erred in law in finding that Clearview’s clients were excluded from the material scope of the GDPR under Article 2(2)(a). The ICO argued two sub-grounds:

For the reasons explained in [141] and [144] to [147] above,we are unable to identify from its reasons how or why the FTT reached its conclusion that the exception from material scope in Article 2(2)(a) applied to Clearview’s clients. As such, we cannot say whether they erred in the specific ways alleged by the ICO’s two sub-grounds.

However, for the reasons set out above in [190] to [194] above, we accept Privacy International’s construction of Article 2(2)(a) that the provision deals only with the division of responsibility between the Union and its Member States, and is not about foreign states or private bodies providing services to foreign states at all. From this, it follows that the FTT erred in law in finding that Clearview’s clients’ processing fell within Article 2(2)(a), so Ground 1 succeeds on that more general basis.

Having identified an error of law by the FTT, we must consider whether that error was material. We must therefore consider whether the FTT’s conclusion that Clearview’s clients were beyond material scope of the GDPR was correct, albeit for the wrong reasons. That requires consideration of whether the processing carried out by Clearview’s clients was excluded from the scope of the GDPR by independent operation of public international law relating to comity principles.

It was agreed by the parties that the processing of Clearview’s foreign state clients fell outside the scope of regulation.

In relation to the processing of Clearview’s private sector contractor clients, Ms Proops relied heavily on the FTT’s finding (at [146] of its decision) that those private sector clients each “carry out criminal law enforcement and/or national security functions, and use the Service in furtherance of those functions”. She relied on this to support her argument that Clearview’s private sector contractor clients are also beyond the scope of regulation by the GDPR, even if Clearview’s intersectional construction is wrong, as we have decided it was (see [197] to [214] above).

Ms Proops characterised the statement at [146] of the FTT’s decision as an “unequivocal finding of fact” based on the FTT’s acceptance of Mr Mulcaire’s evidence, that went unchallenged at the hearing before the FTT (even though Mr Pitt-Payne had the opportunity to cross-examine Mr Mulcaire).

Mr Pitt-Payne accepted the finding of fact to the extent that it speaks to the clients providing assistance to foreign states in national security and/or criminal law enforcement matters. He argued, however, that those findings were insufficient, on their own, to found a conclusion that the contractor clients’ activities were carried out in exercise of sovereign authority and therefore attracted state immunity, or otherwise attracted protection from regulation by operation of comity principles as a matter of international law. Such a conclusion could, Mr Pitt-Payne argued, only be reached based on findings of fact as to the specific tasks carried out by the contractor clients in the context of their national security and/or criminal law enforcement functions, and as to the specific terms of the relationship between the contractor and its foreign state client.

While Ms Proops argued that the ICO could not rely on Mr Pitt-Payne’s failure to challenge Mr Mulcaire’s evidence, Mr Pitt-Payne responded that it was not for the ICO to fill the gaps in Clearview’s evidential case.

Ultimately, where a party seeks to challenge a penalty imposed by the ICO, the principles set out by the Court of Appeal in Doorstep Dispensaree apply (see [121] to [124] above), with the result that the burden of proof is on the party seeking to challenge the penalty. In respect of the question whether Clearview’s private sector clients fell out of scope, the burden of proof therefore lay on Clearview to establish its case that they were.

The finding made by the FTT in paragraph [146] of its decision that “all of [Clearview]’s current clients carry out criminal law enforcement and/or national security functions and use the Service in furtherance of those functions”, lacks specificity. If it amounts to a finding that those private sector clients carry out those activities in exercise of sovereign authority, the FTT’s primary findings of fact upon which that finding is based are inadequate to support such a conclusion, and, importantly, we have not been directed to any evidence that was before the FTT that would have justified findings of fact that would support such a conclusion.

For these reasons we are satisfied that the error of law established by Ground 1 was material.