[2025] UKUT 319 (AAC)

Ground 3 raises the issue whether Clearview itself undertakes behavioural monitoring of UK data subjects within the meaning of Article 3(2)(b) GDPR.

The FTT found that, while Clearview’s processing facilitates the efficiency of the Service and is processing that is “related to” behavioural monitoring by its clients, Clearview does not itself undertake monitoring of UK data subjects within the meaning of Article 3(2)(b) GDPR (see [129], [143] and [144] of the FTT’s decision).

At the hearing, Mr Susskind articulated the ICO’s case somewhat differently from the way it was put in the ICO’s skeleton argument. Looked at overall, he identified the following respects in which he said the FTT had fallen into error:

In terms of the first of these points, Mr Susskind argued that while Warby LJ observed in Soriano (at [103]) that mere gathering of behavioural data about a natural person “might” not be enough to amount to behavioural monitoring, nothing in Sorianoprecludes the possibility that it might be enough in some circumstances.

While it is true that Warby LJ does not go as far as to rule out that proposition entirely, we accept that he does not appear to consider it likely, and the text at page 20 of the EDPB Guidelines also does not support the proposition that the mere gathering of behavioural data will itself amount to behavioural monitoring. However, that is not by any means determinative of whether Clearview engages in behavioural monitoring because, as the FTT found, Clearview does a lot more than simply gather data: it gathers it, analyses it, sorts it and stores it, and it does so with a view to permitting clients to upload images to the Service to initiate a search of the database and potentially to engage in further processing in furtherance of their national security and/or criminal law enforcement functions. To the extent that Soriano requires “something further” in the nature of analysis, the FTT’s findings of fact (see [112] to [114] of the FTT’s decision) establish that Clearview engages in analysis, albeit without human involvement.

Clearview’s processing is digital, automated and passive. It is achieved by applying algorithms to the collected data and it involves no human intervention. Ms Proops told us that no one at Clearview is able to “see” the data, but there is nothing in the wording of Article 3, in the Recitals or in the EDPB Guidelines that indicates any requirement for “seeing” or “watching” to establish that monitoring is taking place.

As the example of CCTV surveillance we discussed at [266] to [267] above demonstrates, monitoring may occur as soon as a camera is switched to “record”. One does not have to wait until the recording is viewed for it to amount to monitoring, and it may amount to monitoring even if the recording is never viewed. The key to establishing monitoring is not that someone or something actually accesses the output; it is that the data is available to be accessed should access be needed, and the data has been gathered in contemplation of that potential eventuality. As we discussed at [260] to [275] above, Recital 24 and the EDPB Guidelines assist in highlighting the relevance of the controller’s purpose in processing the data and the relevance of the potential subsequent use of the data, including its use by another.

Turning to Mr Susskind’s second point, there is considerable overlap with what we have already discussed in relation to the first alleged error. In dismissing the ICO’s “indexing case” on the basis that Clearview’s processing “in itself reveals nothing about the behaviour of a person” (see [129] of the FTT’s decision), the FTT failed to factor in the two matters that Recital 24 and the EDPB Guidelines indicate are relevant:

There is also force in Mr Susskind’s third reason for attacking the FTT’s conclusion. The FTT’s reasoning in [129] focuses in terms on the creation of the facial vectors (from the images scraped from the internet) and the indexing of the images it holds according to these facial vectors, whereas Clearview’s processing of personal data extended significantly beyond this, as is apparent from the FTT’s own findings as to the nature and extent of Clearview’s processing, see [112] of the FFT’s findings in particular. In assessing whether Clearview undertakes behavioural monitoring, we can see no good reason for confining consideration to the activities that the FTT addressed at [129].

In relation to the fourth alleged error, for the reasons set out in [256] to [275] and in [314] above, we find that Clearview’s gathering, sorting and storing in a filing system organised person-by-person of “behaviourally rich” data (seethe findings of fact set out in the FTT’s decision at [22] to [69], and in particular at [38] and [49]) about natural persons amounts to “behavioural monitoring”, properly construed.

There was evidence before the FTT that entitled it to conclude, as it did, that the data gathered by Clearview was “behaviourally rich”. By way of example, in his cross-examination of Mr Mulcaire on day 1 of the FTT hearing (transcript at pages 59-60), Mr Pitt Payne put to Mr Mulcaire that Clearview had collected, sorted and stored the data relating to a specific individual shown at pages 1570 to 1662 of the FTT bundle.

The information Clearview had obtained, sorted and stored about this individual, highlighted features about him and about his behaviours. It included the individual having been:

The information described above reflects the categories identified by the FTT at paragraph [49] of its decision. This information was already gathered and sorted by Clearview and was ready to be searched as a result of Clearview’s Activity 1 processing even before any probe image of that individual might be uploaded by a Clearview client.

In relation to Mr Susskind’s fifth point, Ms Proops submitted that, because of the way its system is engineered, Clearview has no ability to “see” the data it gathers and she argued that “watchfulness” was an important element of monitoring. However, the FTT did not use any of the anthropomorphised terms to which Mr Susskind objected in its explanation of its decision making on the issue of whether Clearview’s processing involved behavioural monitoring. As such, we are not persuaded by this criticism.

Stepping back to assess Ground 3 in the round, we are persuaded that the FTT based its finding that Clearview does not itself undertake monitoring of UK data subjects within the meaning of Article 3(2)(b) GDPR on a misunderstanding of the proper meaning of “behavioural monitoring” for the purposes of Article 3(2) and an unduly narrow consideration of Clearview’s processing activities. Had it applied the proper construction of “behavioural monitoring” (explained in [256] to [275] above) to the facts it found about Clearview’s processing and about its clients’ potential subsequent processing, the FTT would have been bound to find that Clearview’s processing involved behavioural monitoring. We therefore find it made a material error of law.