GRC

Clearview AI takes ICO’s £7.5m fine fight to the Court of Appeal

Clearview AI tells the Court of Appeal the ICO overstepped its powers with a £7.5m fine. What the UK GDPR reach ruling means for UK organisations.

Scales of justice graphic with the headline Clearview AI fights ICO fine on appeal

Clearview AI has taken its long fight against the Information Commissioner’s £7.5m penalty to the Court of Appeal, arguing the regulator went beyond its powers. The judgment is expected to clarify how far UK data protection law reaches into overseas companies that harvest data about people in Britain.

What happened

On Monday 19 October 2026, Clearview AI argued before the Court of Appeal that the UK’s data protection regulator had exceeded its powers when it fined the company £7.5m and ordered it to delete data, according to Law360. The US facial recognition firm reportedly told the court that the penalty and deletion order, taken together, would force it to close its facial recognition service altogether. No judgment has been given.

The hearing is the latest stage in a dispute that began years ago. In May 2022 the Information Commissioner’s Office (ICO) issued Clearview with a monetary penalty notice and an enforcement notice. The ICO’s case was that the company had scraped images of UK residents from social media and the wider web, then loaded them into a searchable global database that any Clearview customer could use for facial recognition. The enforcement notice told Clearview to stop collecting UK residents’ data and to delete what it already held.

Clearview won the first round. In October 2023 the First-tier Tribunal ruled that the ICO lacked jurisdiction, accepting that the company’s processing fell outside the material scope of data protection law because its customers were foreign law enforcement and national security bodies. Information Commissioner John Edwards appealed. In October 2025 the Upper Tribunal upheld three of his four grounds and sent the case back to the First-tier Tribunal to rule on the substance. On 19 December 2025 the Upper Tribunal gave Clearview permission to take the jurisdiction question to the Court of Appeal, which is the appeal now being heard.

The detail

The fight is about jurisdiction, and two questions matter.

The first is material scope. Article 2 of the UK GDPR excludes activity that sat outside the original EU regime, such as national security functions reserved to states. Clearview argued that because its platform served overseas police and security agencies, its processing inherited that exemption. The Upper Tribunal disagreed. It found the earlier tribunal’s conclusion that all of Clearview’s clients were performing state functions was not specific enough, noting that some clients were private sector organisations. More importantly, Clearview is a private company, not a state, and the exemption covers only activities reserved exclusively to states. A commercial supplier cannot borrow that protection simply because some customers are public bodies.

The second is territorial scope. Article 3(2)(b) brings non-UK organisations within the law where their processing relates to monitoring the behaviour of people in the UK. The Upper Tribunal took a wide view of monitoring. Human observation is not needed: an automated system that gathers and organises personal data over time, so it can later be analysed or used for profiling, can qualify. The tribunal compared this to CCTV, which monitors from the moment it records, whether or not anyone watches the footage. Images showing people drinking, smoking or at sporting events were treated as behaviourally rich data.

Estimates of the database vary. Pinsent Masons has described it as more than 30 billion scraped photos, while law firm Ashfords puts it at more than 60 billion images.

Timeline of the Clearview AI case against the ICO, from the 2022 fine to the October 2026 Court of Appeal hearing

Why it matters for UK organisations

If the Court of Appeal backs the Upper Tribunal, the ICO keeps a clear statutory basis for acting against overseas firms that never set up in the UK but profile people here. That matters well beyond facial recognition. Data brokers, people-search sites, adtech platforms and AI developers that scrape the open web for training data could all fall within Article 3(2)(b) if what they do amounts to monitoring. The Edwards line, that firms monitoring UK residents are in scope wherever they are based, would then become settled law.

If Clearview wins, the picture changes. A narrower reading of monitoring, or a broader state-function exemption, would make it harder for the regulator to touch foreign suppliers of surveillance and intelligence tooling. It would also open a gap with the EU, where the Dutch data protection authority has already fined Clearview €30.5m. Pinsent Masons noted that the Upper Tribunal ruling brought UK law back into line with the EU approach; a reversal would push the two apart again.

There is a practical point for UK buyers too. Organisations that procure investigative, OSINT or identity tools from overseas vendors are controllers in their own right. Whatever the court decides about the supplier, your own use of scraped biometric data still needs a lawful basis, a data protection impact assessment and a defensible purpose.

Expert view

In my experience, most organisations treat GDPR territorial scope as a box ticked during a vendor assessment, then forget it. This case shows why that is risky. The Upper Tribunal’s reasoning turns on what a system does, not where the company is incorporated, and that is the right test for anyone mapping data flows.

When we test environments that use third-party intelligence or enrichment services, the hardest question is often where the data came from. Suppliers describe their sources vaguely, and contracts rarely require proof of lawful collection. A judgment confirming the CCTV analogy would make that vagueness harder to defend, because collection alone, before any human looks at the results, would count as monitoring.

I would also warn against reading too much into the hearing. Appeal courts often narrow tribunal reasoning without overturning it, and the substantive merits still sit with the First-tier Tribunal. The fine is not final. Boards should treat this as a direction of travel, not a done deal.

What to do now

  1. Inventory scraped and enriched data. List every tool or supplier that supplies personal data gathered from public web sources, including OSINT, background screening, threat intelligence and marketing enrichment.
  2. Challenge suppliers on provenance. Ask overseas vendors to state, in writing, how data on UK residents is collected and which UK GDPR basis they rely on. Build this into due diligence and contract renewal.
  3. Refresh DPIAs for biometric processing. Facial recognition or face search used to identify people involves special category biometric data and needs a current impact assessment, signed off at senior level.
  4. Check your own scope. If you are a non-UK business that profiles UK users, assume Article 3(2)(b) applies and confirm whether you need a UK representative.
  5. Limit access to high-risk tools. Restrict who can run searches on intelligence platforms, log every query and review access regularly. This fits the Cyber Essentials user access control theme and supports accountability if the ICO asks questions.
  6. Watch for the judgment. Assign someone in legal or privacy to track the outcome and brief the board, as it may change the risk rating for several suppliers.

Bottom line

Clearview’s appeal is about whether the UK regulator can reach foreign companies whose systems quietly catalogue people in Britain. The Upper Tribunal said yes, in broad terms. Until the Court of Appeal rules, UK organisations should plan on the basis that the broad reading stands, and get their supplier due diligence on scraped data in order now.

Sources

Related Posts