UK Tribunal Reinstates £7.5m GDPR Fine Against Clearview AI for Unlawful Facial Recognition
The UK Upper Tribunal reinstated a £7.5m fine against US-based Clearview AI for unlawfully scraping facial images of UK residents from websites and social media without consent and incorporating them into a global facial recognition database. The tribunal overturned a lower court's finding that the company was exempt from UK data protection law because it served foreign governments, clarifying that UK GDPR applies to foreign companies processing personal data of UK residents regardless of their clients' identity.
What happened
The UK Information Commissioner's Office issued a £7.5m fine against Clearview AI in May 2022 after finding the company had unlawfully scraped images of UK residents from websites and social media and uploaded them to a global facial recognition database without consent.
Clearview AI appealed and the First-Tier Tribunal ruled in October 2023 that the company's actions fell outside the scope of UK GDPR because its processing was exclusively in support of foreign governments.
The Upper Tribunal reversed this decision in October 2025, finding that Clearview's processing is related to monitoring UK residents' behavior and does not fall outside UK data protection law based on its clients being foreign law enforcement or government agencies.
Reported impact
UK residents had their facial images unlawfully scraped from public web pages and social media and incorporated into a global database used for facial recognition without their knowledge or consent.
Index analysis
The Upper Tribunal confirmed that UK data protection law applies to foreign companies processing personal data of UK residents, regardless of whether those companies provide services to foreign governments.
The ruling clarifies that processing by a company's clients does not determine whether the company's own processing falls outside the scope of UK GDPR.
Governance controls
The Information Commissioner confirmed that the ruling upholds the ICO's ability to protect UK residents from unlawful data scraping and use in online databases, and that foreign organizations will be held accountable when their technologies impact the information rights and freedoms of individuals in the UK.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.