UK court v. Clearview AI Inc

Decided by

First-tier Tribunal General Regulatory Chamber Information Rights

Parties

Clearview AI Inc v. The Information Commissioner

Decision date

October 17, 2023

Remedy

The tribunal allowed Clearview AI Inc's appeal and set aside the Information Commissioner's Enforcement Notice and Monetary Penalty Notice on jurisdictional grounds.

Appeal

Appeal status not stated

Key holdings

1. The tribunal held that the Information Commissioner lacked jurisdiction to issue the enforcement and monetary penalty notices because Clearview's data processing fell outside the material scope of data protection law.

   “We have concluded that the Information Commissioner (“the Commissioner”) did not have jurisdiction to issue the Enforcement Notice and the Monetary Penalty Notice to Clearview AI Inc” — paragraph 1

2. Territorial monitoring provisions can apply even where the monitoring of behaviour is carried out by a third-party customer rather than the data controller itself.

   “as a matter of law Art (3)(2)(b) can apply where the monitoring of behaviour is carried out by a third party rather than the data controller;” — paragraph 157

3. Clearview's processing fell outside the scope of EU law because its service was provided exclusively to foreign law enforcement and national security agencies.

   “CV’s processing was in the course of an activity which, immediately before IP completion day, fell outside the scope of EU law.” — paragraph 154

4. Clearview's automated creation and mathematical clustering of facial vectors does not in itself constitute monitoring of data subject behaviour.

   “We find that the indexing case fails because the behaviour of a data subject is not used in the creation of the vectors or the indexing of the images” — paragraph 129

In plain English

Clearview AI Inc appealed an Enforcement Notice and a Monetary Penalty Notice issued by the Information Commissioner on 18 May 2022. The Information Commissioner alleged that Clearview infringed data protection rules by scraping facial images from the public internet, creating facial vectors, and operating a database used by clients to search probe images. Clearview argued that it is a foreign company based in the United States that provides its internet search engine service exclusively to foreign criminal law enforcement and national security agencies. The First-tier Tribunal considered whether the processing fell within the territorial and material scope of data protection legislation. The tribunal found that Clearview's database held images of residents in the United Kingdom, and that foreign clients used the service to monitor individual behaviour. It also noted that third-party monitoring could engage territorial scope. However, the tribunal concluded that Clearview's processing was performed for foreign law enforcement and national security functions, which fall outside the scope of Union law. Consequently, the tribunal held that the Information Commissioner lacked jurisdiction to issue the notices. The tribunal allowed the appeal on 17 October 2023.