Clearview AI Inc v The Information Commissioner
This is a First-tier Tribunal decision regarding an appeal by Clearview AI Inc against an Enforcement Notice and Monetary Penalty Notice issued by the UK Information Commissioner. The Tribunal concluded that although Clearview AI's data processing related to the monitoring of UK data subjects' behaviour under Article 3(2)(b) of the GDPR and UK GDPR, the processing fell outside the material scope of the regulations because it was in the course of activities (supporting foreign law enforcement and national security) falling outside EU law. Consequently, the Commissioner lacked jurisdiction, and the appeal was allowed.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Legal professionals, privacy regulators, and AI researchers interested in the extraterritorial application and material scope limits of data protection laws regarding facial recognition technologies.
What the document contains
The document addresses the jurisdictional scope of the UK GDPR and GDPR over a foreign entity (Clearview AI) that scrapes public internet images to provide facial recognition search services to law enforcement and national security agencies. It details the mechanics of web scraping, database storage, vector indexing, probe image comparison, and the legal tests for behavioural monitoring and material scope exclusions.
The document does not determine whether Clearview AI actually infringed the substantive data protection articles alleged by the Commissioner, nor does it address commercial use cases since those were withdrawn or restricted prior to the hearing.
- The First-tier Tribunal allowed Clearview AI's appeal, quashing the Information Commissioner's Enforcement Notice and Monetary Penalty Notice due to a lack of jurisdiction.
- Clearview AI's data processing was found to be related to the monitoring of behaviour under Article 3(2)(b) of both the EU GDPR and UK GDPR.
- However, the processing fell outside the material scope of the regulations because it was conducted in support of foreign criminal law enforcement and national security functions.
- The Tribunal established that data processing by a non-established entity can relate to behavioural monitoring carried out by third-party clients.
- The decision clarifies that extraterritorial enforcement is limited by material scope exclusions regarding sovereign law enforcement and national security activities.
· Introduction and Representation · The Enforcement Notice and the Monetary Penalty Notice · The Grounds of Appeal · The Issues for the determination of the preliminary issue · The Hearing and Evidence · The Facts · The Powers of the Tribunal · The Legal Framework · The Commissioner's case in the notices · CV's case in response to the notices · Conclusions and Reasons
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
4/5Clear responsibility for AI outcomes
We have concluded that CV is a joint data controller with their clients for Activity 2 processing.
Conclusions and Reasons
screening score · 2026-10-23
Fairness
0/5Non-discrimination and equitable treatment
screening score · 2026-10-23
Human Dignity
0/5Respect for the inherent worth of persons
screening score · 2026-10-23
Privacy
4/5Protection of personal data and private life
Both the GDPR and UK GDPR have some extraterritorial scope by virtue of Article 3 of each regime and as regards the UK, section 207 of the DPA 2018.
The Legal Framework
screening score · 2026-10-23
Transparency
0/5Openness about how AI systems work and are used
screening score · 2026-10-23
Enforcement
4/5Consequences and compliance mechanisms with real force
Section 149 DPA 2018 gives a discretion to the Commissioner to issue an EN when the Commissioner is satisfied
The Enforcement Notice and the Monetary Penalty Notice
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
the duty to carry out a Data Protection Impact Assessment under Article 35 GDPR and UK GDPR.
The Enforcement Notice and the Monetary Penalty Notice
screening score · 2026-10-23