[2025] UKUT 319 (AAC)

We heard a substantial amount of argument about the meaning of the words “related to” in Article 3(2). They are everyday words, and our starting point is their natural meaning, which is to denote a relationship of connection or association between two or more things.

Mr Pitt-Payne argued that as the EDPB Guidelines indicate that one can have a situation where a processor’s activities are related to monitoring by a controller, one can equally have a situation where processing by one controller is related to monitoring by another controller. Mr Pitt-Payne submitted that Article 3(2)(b) should be interpreted to include this situation.

Ms Proops argued that, because the stem phrase “related to” in Article 3(2) applies to both paragraph (a) which concerns the offering of goods and services to data subjects in the Union, and paragraph (b) which concerns monitoring of behaviour within the Union, its meaning must be the same in relation to both limbs. She said that, because it is clear that in (a) the only controllers who are caught are the people offering goods and services into the Union, it must follow that paragraph (b) can only catch controllers who are the people actually doing the behavioural monitoring.

We do not agree. The fact that paragraphs (a) and (b) proceed from the same stem does not mean that “related to” describes the same relationship or connection in both sub-paragraphs. Rather, in each instance, “related to” indicates that there is a relationship or connection (between two or more things) and each relationship is then defined by the respective wording in the two sub-paragraphs that follow.

Ms Proops directed us to the principle described by Lord Hutton in R v Kansal (No. 2) [2002] 2 AC 69 (at [102]) (“Kansal”) that where Parliament uses words in a statute it is to be presumed that those words should be given a similar meaning in other parts of the statute unless there is some reason to give them a different meaning. We accept that principle, but a reading of Article 3(2) to the effect that sub-paragraphs (a) and (b) deal with different relationships does not prevent the words “related to” from having a consistent and coherent meaning, so it does not offend against Lord Hutton’s principle in Kansal.

We note that the EDPB Guidelines are not consistent with this part of Ms Proops’ interpretation. See [238] to [241] above, and also page 21 of the EDPB Guidelines, which explains that for a data processor not established in the Union, it is necessary to look at whether the processing activities by the processor are related to the targeting activities of the controller. As we have noted, these examples highlight that a processor can be caught by Article 3(2)(b) where its processing is related to the actions of a separate data controller.

Ms Proops encouraged us to read the words “related to” as serving two functions where they appear in relation to Article 3(2)(b):

We did not find this to be a natural or desirable approach. Had the legislators intended a narrowing of the scope of Article 3(2)(b) this could have been achieved simply by omitting the words “related to” altogether, and referring, instead, to “the monitoring of their behaviour”.

Again, we note that neither the wording of the provision, nor the examples in the EDPB Guidelines, support Ms Proops’ favoured interpretation of Article 3(2)(b). The EDPB Guidelines confirm the importance of assessing monitoring, which they explain implies the controller has a specific purpose in mind for the collection and subsequent reuse of the relevant data about an individual’s behaviour in the EU. It is necessary to consider the controller’s purposes for processing the data and any subsequent behavioural analysis or profiling techniques involving that data (see page 21 of the EDPB Guidelines). The EDPB Guidelines indicate that where this is confirmed to amount to monitoring, the test is whether the processing relates to it. Example 18 explains that a processor in the US that optimises and maintains an app designed by an app developer (in Canada) to monitor the behaviour of data subjects in the EU, will be caught by Article 3(2)(b).

Ms Proops accepted that the language of Article 3(2)(b) was sufficiently flexible to make the reading advocated by Mr Pitt-Payne “tenable”, and ultimately conceded that if the proper construction turned on an ordinary linguistic interpretation of the provisions, Clearview would be in “grave difficulty”. She argued, however, that because of the principle of “close confinement” that falls to be applied when considering extra-territorial effect (see [155] to [162] and [170] to [175] above), and because of the four imperatives of comity, utility, certainty and proportionality (discussed in [155] to [178] above), we could only adopt Mr Pitt-Payne’s (and the FTT’s) reading if we were compelled to do so because there was no other tenable reading.

For the reasons set out in the preceding paragraphs,we do not agree that this is the proper approach. Instead, we approach the construction of Article 3(2)(b) on the basis that it expressly provides for extra-territorial effect. As such, while our construction is informed by our inference that the legislators would have intended to respect comity principles, we apply the ordinary rules of statutory construction to determining the extent of its extra-territorial effect. There is no requirement for us to interpret the words artificially so as to restrict the extent of the provision’s extra-territorial effect as far as the words can linguistically bear. To do so would frustrate the legislators’ intent.

In Soriano,at [100], Warby LJ acknowledged the words “related to” can bear different interpretations, and he applied an expansive meaning to them in relation to Article 3(2)(a), such that the data subject whose data is processed need not be the same person as the offeree of the goods or services:

“The language could be read as indicating a legislative intention to ensure that the Regulation should apply to processing of an individual’s personal data that has some relationship with offering goods or services to that individual. That is not the position here. But the case has never been argued on that basis, so I approach the issue – as everyone appears to have done so far – on the footing that article 3(2)(a) applies to the processing of personal data of data subjects who are in the Union whether or not they are the same individuals as those to whom the goods or services are offered, providing the two activities are “related to” one another.”

Just as Warby LJ gave the words “related to” in Article 3(2)(a) an expansive meaning, we have given them an expansive meaning in Article 3(2)(b). We read Article 3(2)(b) as applying, not only to controllers who themselves conduct behavioural monitoring, but also to controllers whose data processing is related to behavioural monitoring carried out by another controller. The words “related to” require a relationship between the processing of the individual’s personal data and the monitoring of the behaviour, and there is (as the FTT was entitled to find) “such a close connection between the creation, maintenance and operation of the Database and the monitoring of behaviour undertaken by the clients that Clearview’s processing activities are related to that monitoring” (see [143] and [144] of the FTT’s decision).

Furthermore, we consider that our reading of Article 3(2)(b) is also consistent with the wording in the EDPB Guidelines, which we have considered on the basis that Soriano confirmed them to be relevant to the construction of Article 3.