TL;DR
Clearview AI, the US company that built a face search database from images gathered online, began a three-day Court of Appeal hearing on Monday 19 October over whether the Information Commissioner was entitled to act against it in 2022. PPC Land reports the penalty at more than £7.5 million. Privacy International is intervening on the Commissioner’s side, arguing that serving foreign governments does not lift a private contractor out of UK GDPR.
How the case got here
The ICO issued an enforcement notice and a monetary penalty in 2022. In 2023 the First-tier Tribunal decided the Commissioner had no jurisdiction to do so. The Upper Tribunal partly reversed that on 6 October 2025, a ruling we reported at the time, and Clearview is now appealing that decision under case number CA-2026-000226.
The question for the court, in the words of the case summary, is how far processing of UK residents’ data by a privately owned firm located abroad falls outside regulation, including when the work supports its foreign clients’ “national security or criminal law enforcement activities”.
The arguments
The documents surfaced through a LinkedIn post by Luis Alberto Montezuma, who works in data and privacy policy, and they do not include Clearview’s written submissions, so its case is known only through Privacy International’s account. On that account, Clearview has dropped an earlier argument and now says that monitoring done by state customers sits outside UK GDPR altogether, so there is nothing for the law to attach to.
The charity’s lawyers, led by Marie Demetriou KC, call that “misconceived”. The monitoring provision, Article 3(2)(b), sets no conditions, they argue, on who does the monitoring or where. A foreign state can be shielded by state immunity, but a contractor would have to show it was exercising sovereign authority itself, which they consider “highly unlikely” for a company serving several governments at once. Their comparison: caterers working for a state department are not immune from foreign enforcement simply because of who their customer is.
Five EU regulators, in France, Italy, Greece, Austria and the Netherlands, have already applied the equivalent EU rule to Clearview. As far as Privacy International knows, the company has neither complied with nor appealed those decisions.
Looking forward
The hearing was due to end on Wednesday 21 October, and the papers give no date for judgment. PPC Land suggests the ruling could matter well beyond facial recognition, because the same monitoring provision decides when non-UK firms fall under UK GDPR, which could touch suppliers whose clients do the tracking, from data brokers to measurement firms. That is the publication’s inference, not something the court papers state. For UK businesses that buy profiling or scraping tools from overseas suppliers, the outcome will show whether the supplier, as well as the buyer, answers to the ICO.