The UK’s Upper Tribunal (UT) has ruled in favour of the Information Commissioner’s Office (ICO) in its appeal against the First-tier Tribunal’s (FTT) decision on Clearview AI, strengthening the regulator’s case to enforce a £7.5m fine against the US facial recognition company.

In May 2022, the ICO fined Manhattan-based Clearview AI £7.5m and issued an enforcement notice for scraping images of UK residents from websites and social media platforms, then uploading them into a global database used for facial recognition by Clearview’s customers. The service enables clients to identify individuals and monitor their behaviour as a commercial offering.

Clearview appealed both the fine and the enforcement notice to the FTT, which initially found in the company’s favour. The ICO then appealed that decision to the UT.

Judging in the case, the UT upheld three of the ICO’s four grounds of appeal. It found that Clearview’s processing of personal information was related to monitoring the behaviour of UK residents, and that the company’s activities did not fall outside the reach of UK data protection law simply because it provided services to foreign law enforcement or government agencies.

The Tribunal also concluded that the FTT had applied the law incorrectly in finding that Clearview’s processing was outside the material scope of the UK GDPR.

The ICO said the decision clarifies both the material and territorial scope of the UK GDPR, reaffirming that companies monitoring the behaviour of UK residents fall within the remit of UK data protection law, regardless of where they are based.

John Edwards, UK Information Commissioner, said: “The UT’s decision has upheld our ability to protect UK residents from having their data, including images, unlawfully scraped and then used in a global online database without their knowledge.

“The ruling also gives greater confidence to people in the UK that we can and will act on their behalf, regardless of where the company handling their personal information is based. It is essential that foreign organisations are held accountable when their technologies impact the information rights and freedoms of individuals in the UK.”

Recommended

• Teenage Hackers with Lapsus$ Group Convicted for Cyber-attacks
• Why Are Young People Becoming Cyber-criminals?
• Four Arrested in Investigation Into UK Retail Cyber-attacks

The UT’s decision is legally binding and will serve as guidance for future cases involving similar questions of jurisdiction.

The Tribunal has directed that the case be returned to the FTT to determine the substantive appeal, on the basis that the ICO had jurisdiction to issue the monetary penalty and enforcement notice.

Clearview may now seek permission to appeal the UT’s ruling.