The Upper Tribunal has overturned a judgment that found that Clearview AI’s processing was outside the material scope of the GDPR.
Shutterstoc.com/Mehaniq
The judgment, issued yesterday, sided with the UK Information Commissioner's Office (ICO) in its appeal against a First-tier Tribunal decision which had overturned its £7.5 million fine and enforcement order against Clearview AI on jurisdictional grounds. This latest move will see the case returning to the lower tribunal, which will decide on the substantive issues on appeal.
The ICO had enforced against the US-based AI company in May 2022 after finding it scraped online images of UK residents and uploaded them into a global database for clients to use for facial recognition purposes. The First-Tier Tribunal in October 2023 ruled that although the processing related to the monitoring of subjects’ behavior in the UK, it was outside the material scope of the GDPR and UK GDPR as its clients carry out law enforcement or national security functions.
Following a lengthy process, the ICO was ultimately allowed to appeal to the Upper Tribunal, which yesterday set aside the lower tribunal’s decision. UK Information Commissioner John Edwards said in a statement: "The UT’s decision has upheld our ability to protect UK residents from having their data, including images, unlawfully scraped and then used in a global online database without their knowledge.”
Mrs Justice Heather Williams, Judge Thomas Church and Judge Judith Butler notably clarified the exemption provided under GDPR article 2 on material scope for processing carried out “in the course of an activity which falls outside the scope of [European] Union law”.
They found that the exclusion from the GDPR’s scope must be interpreted strictly. It only applies to activities which member states “have reserved control to themselves and conferred no powers on the union to act”, and not to the activities of third parties whose processing merely intersects with client state functions, they ruled.
The judges sided with intervener Privacy International, which had said the article was only concerned with the division of responsibilities between the EU and its member states – “it had no need to say anything about the activities of foreign states,” the group had argued. The ruling added that this construction means the EU “does not presume to interfere with activities of foreign states at all” and therefore respects comity principles.
Clearview’s barrister Anya Proops KC had argued during the appeal hearing in June that there is a “fundamental intersection” between Clearview’s service and what it is used for, and that the entire Clearview service “exists in furtherance of state activity”. But the judges said it is unclear why the focus should only be on the moment the data was transferred between Clearview and its client, adding that this excludes other moments of processing without reason.
The Upper Tribunal additionally ruled that the First-tier Tribunal was correct in finding that Clearview’s processing fell within the territorial scope of the GDPR, "albeit that it differed in its reasoning”.
The judges ruled that the concept of behavioural monitoring under article 3 on territorial scope must be interpreted broadly “as a response to the challenges posed by Big Data in the digital age”. The lower tribunal had concluded that Clearview facilitates behavioral monitoring by its clients but that Clearview’s system itself – which categorises and stores images based on facial vectors – reveals nothing of the behaviour of individuals because it is an automated, mathematical exercise.
But the court said that such monitoring can encompass passive collection, sorting and classification of “behaviorally rich” data by automated means. It noted that concept does not require an element of “active watchfullness” which would imply human involvement, and ruled that the tribunal therefore made a material error of law in its findings.
Counsel to Clearview AI
11KBW
Anya Proops KC, Christopher Knight and Raphael Hogarth in London
Jenner & Block
Partner Robert Dalling in London
Counsel to the Information Commissioner’s Office
11KBW
Timothy Pitt-Payne KC and Jamie Susskind in London
Counsel to Privacy International
Brick Court Chambers
Marie Demetriou KC and Aarushi Sahore in London