Cybersecurity Policy Report, U.K. Court Upholds ICO Sanctions Against Clearview AI, (Oct 8, 2025)
By Tony Foley
A decision by the United Kingdom’s First-tier Tribunal overturning a fine issued by the Information Commissioner’s Office against Clearview AI for collecting facial images of people in the U.K. has itself been overturned on review by the country’s Upper Tribunal, the ICO announced today.
The ICO issued a notice of enforcement and notice of a monetary penalty of 7.5 million pounds sterling ($10.05 million) to Clearview in October 2023, finding that the company’s data collection activities violated several U.K. data protection law laws. On appeal, however, the First-tier Tribunal ruled that the ICO did not have jurisdiction to penalize Clearview, finding that, although the processing undertaken by the company was related to the monitoring of data subject’s behavior in the U.K., the processing was beyond the material scope of the U.K. version of the General Data Protection Regulation (U.K. GDPR) and thus was not relevant processing under U.K. GDPR (CPR, Oct. 18, 2023).
On appeal, the Upper Tribunal upheld three of the ICO’s four grounds for appeal of the First-tier Tribunal decision, finding the following:
Clearview’s processing of personal information is related to monitoring of behavior of U.K. residents;
Clearview’s processing does not fall outside the reach of U.K. data protection law on the basis that it provides its services to foreign law enforcement and government agencies; and
The First-tier Tribunal applied the law incorrectly in finding that Clearview’s processing was outside the material scope of the U.K. GDPR article 2(2)a, which establishes that the U.K. GDPR does not apply to activities that were already outside the scope of the original European Union’s GDPR.
The ICO welcomed the Upper Tribunal decision, saying that it clarifies the material and territorial scope provisions of the U.K. GDPR and reaffirms that companies monitoring the behavior of U.K. residents will be in scope of U.K. data protection law, regardless of their physical location.
“The UT’s decision has upheld our ability to protect UK residents from having their data, including images, unlawfully scraped and then used in a global online database without their knowledge,” said ICO Commissioner John Edwards. "The ruling also gives greater confidence to people in the UK that we can and will act on their behalf, regardless of where the company handling their personal information is based. It is essential that foreign organisations are held accountable when their technologies impact the information rights and freedoms of individuals in the UK.”
The Upper Tribunal directed that the case be sent back to the First-tier Tribunal to determine the substantive appeal of the ICO’s original sanctions on the basis that the ICO had jurisdiction to issue the enforcement and monetary penalty notices, adding that Clearview may seek to appeal the Upper Tribunal decision.
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR