Clearview AI Wins Appeal against the ICO

Clearview AI, a US-based company that provides facial recognition services to law enforcement and national security agencies, has won an appeal against a £7.5 million ($9.4 million) fine imposed by the UK’s privacy watchdog, the Information Commissioner’s Office (ICO).

The ICO had fined Clearview AI in May 2022 for illegally collecting and processing the personal data of UK residents, without their consent or knowledge, by scraping billions of images from social media platforms and the internet. The ICO had also ordered the company to delete the data of UK residents from its database and stop offering its services to UK organisations.

The challenge against the ICO

Clearview AI challenged the ICO’s decision at the First-tier Tribunal, arguing that the ICO had no jurisdiction over its activities, as it only provided its services to foreign law enforcement or national security bodies and their contractors, and that its data processing was exempt from UK data protection laws under the foreign government exemption.

The appeal

The tribunal agreed with Clearview AI and ruled that the ICO had no authority to fine or take enforcement action against the company, as its data processing was related to monitoring the behaviour of people in the UK, but was carried out by or on behalf of foreign governments, which fell outside the scope of UK data protection laws.

Our views

The tribunal’s decision has been criticised by privacy advocates and civil rights groups, who have expressed concerns over the implications of Clearview AI’s technology and practices for the rights and freedoms of people in the UK and around the world. They have called for stronger regulation and oversight of facial recognition and biometric data, and for the ICO to appeal the tribunal’s ruling.

Clearview AI has welcomed the tribunal’s decision and maintained that its technology is lawful and beneficial for society, as it helps to solve crimes and protect public safety. The company has also said that it respects the privacy of individuals and complies with all standards of privacy and law.

The ICO has said that it will carefully consider the tribunal’s judgement and its next steps, and that it will continue to act against companies that breach UK data protection laws, especially those that scrape data of people in the UK.

---

Read the other topical articles from our Autumn Data Protection Update:

• • UK-US Data Bridge approved as an extension of the Data Privacy Framework
  • ICO Guidance Overview: Lawfully Monitoring Workers
  • ICO Welcomes Views on its Draft Data Protection Fining Guidance
  • EU-US Data Privacy Framework challenge rejected by EU General Court

---

The content of this page is a summary of the law in force at the date of publication and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.