The Information Commissioner v Clearview AI Incorporated

Article 2(2)(a) GDPR is a narrow exclusion concerned with activities reserved to EU Member States, such as national security, rather than every activity beyond Union competence or processing by private entities serving foreign state functions.

Article 3(2)(b) has an expansive territorial reach. “Related to” includes processing by one controller connected with behavioural monitoring by another. “Behavioural monitoring” may include automated, passive collection, sorting, classification and storage of behaviourally rich personal data for potential later profiling or use. Human watchfulness, further analysis and actual access to the stored data are unnecessary.

The Information Commissioner appealed against the First-tier Tribunal’s decision of 17 October 2023 in EA/2022/0165/FP. The First-tier Tribunal had held that Clearview, a US facial-recognition company, fell outside the material scope of the GDPRs and that the Information Commissioner lacked jurisdiction to issue enforcement and monetary penalty notices.

Clearview scraped publicly available facial images and related information, created a searchable database and supplied search results to clients involved in law enforcement and national security. The appeal concerned the interpretation of Articles 2(2)(a) and 3(2)(b) GDPR and corresponding UK GDPR provisions, including whether Clearview’s processing was related to behavioural monitoring in the UK and whether it was excluded because of its clients’ activities.

1. Appeal allowed. The First-tier Tribunal’s decision was materially erroneous in law. It was set aside under section 12(2)(a) of the Tribunals, Courts and Enforcement Act 2007 and remitted under section 12(2)(b)(i).
2. Article 2(2)(a) GDPR was to be construed strictly. The phrase “in the course of an activity which falls outside the scope of Union law” concerned the allocation of responsibility between the Union and its Member States. It did not extend to foreign states, or to private companies whose processing was connected with foreign state functions. Clearview’s own processing was therefore not excluded under Article 2(2)(a) or Article 3(2A) UK GDPR. The proposed “intersectional” construction was rejected. The Tribunal also found no sufficient basis in the authorities for extending state immunity to an independent commercial service provider which was neither a servant nor an agent of a foreign state.
3. Article 3(2)(b) was expressly extra-territorial and required ordinary purposive construction. “Related to” described a relationship or connection between processing and behavioural monitoring. It could apply where one controller’s processing was related to monitoring carried out by another controller. Clearview’s database creation, maintenance and operation had the requisite close connection with its clients’ monitoring.
4. “Behavioural monitoring” was interpreted broadly in light of the GDPR’s response to large-scale automated processing. It included passive automated collection, sorting, classification and storage of behaviourally rich personal data with a view to potential subsequent profiling or use. It did not require human involvement, active watchfulness, further analysis, or actual access to the stored data.
5. The First-tier Tribunal was entitled to find that Clearview’s processing related to monitoring of UK data subjects’ behaviour in the UK. Proportionality and any de minimis question were matters for the substantive appeal, not the threshold question of jurisdiction. The appeal concerning the UK Test Phase was dismissed because that issue had not been pursued before the First-tier Tribunal.
6. The matter was remitted to a new First-tier Tribunal. Its factual findings were preserved subject to the qualification at paragraph [287]. The substantive appeal was to proceed on the basis that the Information Commissioner had jurisdiction to issue the notices.

• Upper Tribunal (Administrative Appeals Chamber): [2025] UKUT 319 (AAC) — appeal allowed; the First-tier Tribunal’s decision was set aside and the substantive appeal remitted.
• First-tier Tribunal (General Regulatory Chamber): decision dated 17 October 2023 in EA/2022/0165/FP — held that the Information Commissioner lacked jurisdiction to issue the notices.