Upper Tribunal v. Clearview AI Incorporated

Decided by

Upper Tribunal

Parties

The Information Commissioner v. Clearview AI Incorporated

Decision date

October 6, 2025

Remedy

The Upper Tribunal allowed the Information Commissioner's appeal, set aside the decision of the First-tier Tribunal, and remitted the case to the First-tier Tribunal to decide the substantive appeal on the basis that the Information Commissioner had jurisdiction to issue the notices.

Amount

£7,552,800

Appeal

Appeal status not stated

Key holdings

1. The Upper Tribunal allowed the Information Commissioner's appeal and set aside the First-tier Tribunal's finding that the regulator lacked jurisdiction.

   “The decision of the Upper Tribunal is to allow the appeal.” — DECISION

2. The exclusion from the material scope of data protection law for activities falling outside Union law applies only to matters reserved to Member States rather than all third-party state functions.

   “refer only to those activities in respect of which Member States have reserved control to themselves and not conferred powers on the Union to act” — SUMMARY OF DECISION, paragraph (1)

3. Behavioural monitoring under data protection law is interpreted broadly to include automated passive collection, sorting, and storage of profiling data without requiring human watchfulness.

   ““Behavioural monitoring” does not require an element of active “watchfulness” in the sense of human involvement;” — SUMMARY OF DECISION, paragraph (2)

4. Data processing falls within territorial scope if it is related to behavioural monitoring carried out either by the controller itself or by another controller.

   “apply not only to controllers who themselves conduct behavioural monitoring, but also to controllers whose data processing is related to behavioural monitoring carried out by another controller.” — SUMMARY OF DECISION, paragraph (3)

In plain English

The Information Commissioner issued an enforcement notice and a monetary penalty notice with an administrative fine of £7,552,800 against Clearview AI Incorporated on 18 May 2022. Clearview AI Incorporated is a US technology company that scrapes images of human faces from the public internet, creates facial vectors using machine learning algorithms, and stores them in a searchable database. The company sold access to this database to foreign law enforcement and national security clients who could search probe images to locate matching faces. Clearview appealed to the First-tier Tribunal, which ruled on 17 October 2023 that the Information Commissioner lacked jurisdiction because Clearview's processing fell outside the material scope of data protection law. The Information Commissioner appealed to the Upper Tribunal. The Upper Tribunal allowed the appeal and set aside the decision of the First-tier Tribunal. The Upper Tribunal held that Clearview's processing was not excluded from material scope under data protection law and fell within territorial scope. It determined that automated scraping, sorting, and indexing of personal data constitutes behavioural monitoring, and that processing related to behavioural monitoring carried out by third parties also falls within scope. The Upper Tribunal remitted the matter to the First-tier Tribunal to decide the substantive appeal on the basis that the Information Commissioner had jurisdiction to issue the notices.