ICO’s £7.5m Clearview AI fine overturned

In May 2022 the Information Commissioner’s Office (ICO) claimed a high-profile scalp, fining Clearview AI Inc (CV) £7,552,800 for using images of UK residents through its web scraping practices. The ICO objected to the collection of people’s faces and data to create an online database, stating that in doing so CV failed to process data in a fair and transparent manner, had no lawful reason for processing, didn’t have adequate data retention policies in place and failed to meet the higher standards for special category data (this being biometric data). In October 2023, the First Tier Tribunal (FTT) in hearing CV’s appeal, overturned the ICO’s fine.

The FTT overturned the fine solely on the question of jurisdiction (a preliminary issue), finding that the ICO had none. CV’s activity was found to be related to the monitoring of UK residents’ behaviour by its clients. Consequently, CV’s activities fall within the extra-territorial scope of EU/UK GDPR by virtue of Article 3(2)(b) (in both versions of the regulation). However, while in the past CV did offer its services into the UK, it does not currently provide services to UK or EU clients, and importantly, only provides services to criminal law enforcement and national security agencies and their contractors. Unfortunately for the ICO, it was common ground that processing by a foreign government is not in the scope of EU GDPR (Article 2(2)(a)) or UK GDPR (Articles 2(1)(a) and 3(2A)) due to the principles of international law that mean that one state cannot seek to bind another. The ICO therefore did not have jurisdiction over the activity it was attempting to sanction.

Perhaps of some consolation to the ICO are the FTT’s findings on what constitutes monitoring activity and the confirmation of the extra-territorial scope of UK/ EU GDPR. Non-UK private companies scraping the web and social media platforms for UK residents’ data are not off the hook. In addition, the judgment leaves some questions unanswered, and is not uncontroversial. The FTT made a distinction between the activity of scraping and collecting the data (where CV was the only data controller) and the subsequent matching of that data against images held by its clients (where it was joint controller with its clients) so some processing is taking place without the involvement of foreign law enforcement agencies. Critics have also pointed to the freedom of CV to change its business model at any point and the conflation of the activities of private companies and national law enforcement. Similar fines across Europe still stand. If the ICO appeals, it will not be a surprise.