We have previously written about Clearview’s AI’s successful appeal to the First-Tier Tribunal against a £7.5m fine issued against it by the Information Commissioner’s Office (ICO). This was an important decision relating to how AI companies can use personal data for training models and whether the ICO has jurisdiction to regulate the activities of overseas businesses in respect of UK data subjects.
The ICO subsequently appealed to the Upper Tribunal and succeeded on three of four grounds, with a finding that the UK's Data Protection Authority did indeed have jurisdiction to regulate Clearview AI's activities, so far as they related to the monitoring of UK data subjects.
This led to Clearview AI seeking permission to appeal to the Court of Appeal, which was granted on 19 December 2025. This article explores the key findings of the Upper Tribunal decision.
Clearview AI is a privately owned US organisation which markets itself as a cutting edge tech firm - selling its services around the world to law enforcement, government agencies, intelligence services and the military. Its searchable, web-based intelligence platform, which harnesses facial recognition technology, is said to hold in excess of 60 billion facial images, sourced from publicly available web sources including news outlets, 'mugshot websites' and a broad range of social media.
Clearview AI's platform purportedly enables its clients to investigate crimes, enhance public safety, secure communities and provide justice to victims. However, in 2021 the ICO fined Clearview AI £7.5m and issued it with an enforcement notice demanding that the company stop obtaining and using the personal data of UK residents, and delete their data from its systems, on the basis that Clearview AI had scraped this information from the internet without the knowledge or consent of the affected individuals.
The Upper Tribunal's ruling overturned the earlier 2023 decision by the First‑Tier Tribunal. The First‑Tier Tribunal had found that the ICO lacked jurisdiction to regulate Clearview AI because the company’s processing of personal data - carried out solely for foreign law enforcement and national security agencies - fell outside the “material scope” of the EU and UK GDPR.
Therefore on appeal, the central question for the Upper Tribunal was whether the UK data protection law could apply to private companies based outside of the UK, whose services were being used by overseas law enforcement and national security agencies. The Upper Tribunal made a number of important findings.
Firstly, the Upper Tribunal found the First-Tier Tribunal had erred materially in law in finding that Clearview AI's clients were processing personal data in the course of activities which fell outside the scope of EU/Union law, i.e. its material scope. Such processing would concern only activities which were reserved exclusively for member states, for example - activities concerning a country's national security.
The Upper Tribunal held that the First-Tier Tribunal's finding that "all of" Clearview AI’s clients were carrying out criminal law enforcement and/or national security functions and used Clearview AI's services in the furtherance of those functions, "lacked specificity". This was a key point as some of Clearview AI's clients were private sector organisations. If the First-Tier Tribunal had concluded that these clients were carrying out their activities solely in the exercise of sovereign authority, the Upper Tribunal considered that the First-Tier Tribunal’s findings of fact upon which that finding was based were inadequate to support that conclusion.
Another key issue was whether Clearview AI’s data processing activities were themselves outside the scope of the General Data Protection Regulation and/or UK General Data Protection Regulation. The Upper Tribunal rejected the idea that they were.
At the heart of this matter was the unarguable finding that Clearview AI is not a foreign state; it's a private company, and therefore nothing in the processing that Clearview AI itself carried out, made it suitable only for being used in conjunction with state functions. The Upper Tribunal reiterated that the material scope exemption applied only to activities which were exclusively reserved to member states. Clearview AI could not claim that this exemption would apply to its activities, simply on the basis that its services might be used by foreign law enforcement.
The Upper Tribunal also addressed whether Clearview AI’s activities amounted to “behavioural monitoring". The Upper Tribunal adopted a broad interpretation of monitoring. It explained that monitoring does not require active observation by humans. Automated systems that collect and organise large amounts of personal data over time, particularly where that data can later be analysed or used to profile individuals, can also count as monitoring.
The Upper Tribunal drew analogy to CCTV systems, which it considered would be monitoring from the point they began recording, regardless of whether the footage was ever reviewed by someone or something. Clearview’s technology was found to meet this definition. Its systems continuously scanned the internet, collected multiple images of individuals from different times and places, and stored them along with additional information. This structure allowed individuals to be identified and analysed at a later point in time, which the Upper Tribunal said clearly amounted to monitoring behaviour.
Further, it considered Clearview AI's gathering, sorting and storing of “behaviourally rich” data about individuals, for example images showing an individual drinking alcohol, smoking, holding money or attending a sporting event amounted to behavioural monitoring. The Upper Tribunal therefore found the First-Tier Tribunal had made a further error of law in concluding that Clearview AI's processing did not constitute behavioural monitoring.
Clearview's appeal to the Court of Appeal demonstrates that this matter is far from settled. However, the Upper Tribunal's emphatic rejection of the First-Tier Tribunal's findings will be of some comfort to the ICO. Any companies which are based outside of the UK but are engaged in the monitoring of UK data subjects should take note, as last year's decision suggests the regulator has wider jurisdiction than initially thought.
Whilst Clearview AI's activities might be relatively niche, it remains to be seen how significant this case will prove for other organisations involved in any form of behavioural monitoring, and how this case might be applied by analogy to safeguard the rights of UK data subjects.
All eyes on the Court of Appeal.
For further information, please contact our data protection team.
We produce a range of insights and publications to help keep our clients up-to-date with legal and sector developments.
Sign up
