The Information Commissioner v Clearview AI Incorporated
This Upper Tribunal decision addresses an appeal by the Information Commissioner against a First-tier Tribunal ruling concerning the ICO's jurisdiction to issue an enforcement notice and monetary penalty notice to Clearview AI Inc. The Tribunal evaluates the proper interpretation of material and territorial scope provisions under the GDPR and UK GDPR regarding the processing of personal data by a non-UK based company utilizing facial recognition technology. Ultimately, the Tribunal concluded that Clearview's processing fell within both the material and territorial scope of the GDPRs, setting aside the lower tribunal's decision and remitting the case for a substantive hearing.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Legal practitioners, regulators, researchers, and data protection professionals interested in the extra-territorial and material reach of data protection laws regarding AI and biometric technologies.
What the document contains
The document addresses the jurisdictional scope of data protection regulations under the EU GDPR and UK GDPR over a foreign commercial entity engaged in web scraping and facial recognition processing. It details the legal interpretations of material scope exceptions, territorial scope triggers, behavioral monitoring, and related data processing connections.
The text does not adjudicate the substantive merits of whether Clearview infringed data protection articles or whether the monetary penalty was proportionate, as those matters were remitted back to the First-tier Tribunal.
- The phrase 'in the course of an activity which falls outside the scope of Union law' in Article 2(2)(a) GDPR must be interpreted strictly and relates to the division of responsibilities between the Union and its Member States.
- Processing of personal data by a non-established commercial entity via scraping and facial recognition indexing falls within the material scope of the GDPR.
- The term 'behavioural monitoring' under Article 3(2)(b) GDPR is to be interpreted broadly, encompassing passive collection, sorting, and storing of data by automated means with a view to potential subsequent profiling use.
- Article 3(2)(b) GDPR applies not only to controllers who themselves conduct behavioural monitoring, but also to controllers whose data processing is related to behavioural monitoring carried out by another controller.
- The Information Commissioner had jurisdiction to issue enforcement and monetary penalty notices to Clearview AI.
· Introduction · The issues in this appeal · Preliminary matters · Legal framework · Analysis - Article 2(2)(a) GDPR: material scope - Article 3(2)(b) GDPR: territorial scope - The Grounds of Appeal - Clearview’s Additional Reasons · Conclusion
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Fairness
0/5Non-discrimination and equitable treatment
screening score · 2026-10-24
Human Dignity
0/5Respect for the inherent worth of persons
screening score · 2026-10-24
Human Oversight
0/5Humans remain in control of consequential decisions
screening score · 2026-10-24
Privacy
4/5Protection of personal data and private life
This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.
Legal framework
screening score · 2026-10-24
Transparency
0/5Openness about how AI systems work and are used
screening score · 2026-10-24
Enforcement
4/5Consequences and compliance mechanisms with real force
The ICO imposed a monetary penalty administrative fine on Clearview of £7,552,800
Summary of the relevant factual background
screening score · 2026-10-24