US surveillance and facial recognition firm Clearview AI wins GDPR appeal in UK court

According to court documents, the U.K. commissioner doesn’t have the authority or jurisdiction to cite or fine the “foreign” company for GDPR infractions.

United States surveillance and facial recognition firm Clearview AI has won a court appeal in the United Kingdom after being accused of alleged infractions related to the U.K.’s general data protection regulation (GDPR).

Originally, the company was fined nearly $10 million for breaches of the U.K.’s GDPR in May 2022. The recent victory will see that fine rescinded unless the U.K.’s Information Commissioner’s Office (ICO) further appeals the ruling.

Per a U.K. court tribunal led by Tribunal Judge Lynn Griffin, whether Clearview AI (called “CV” throughout the documents) ran afoul of GDPR is immaterial due to the jurisdictional limits on applying GDPR to foreign companies.

According to court documents released on Oct. 17:

“Whether or not CV has infringed the Articles of GDPR or UK GDPR as alleged or at all was not the issue before us. That would be the subject of any substantive hearing were this case to go forward.”

The document goes on to state that, despite the fact that Clearview AI has billions of images in its facial recognition and AI surveillance system (including, according to experts, those sourced from “public” internet repositories originating in the U.K.), the U.K.’s ICO doesn’t have the jurisdiction to offer GDPR protection to its citizenry in this case.

In reference to Clearview AI, the court document states, “It is a foreign company providing its service to ‘foreign clients, using foreign IP addresses, and in support of the public interest national security and criminal law enforcement functions’, such functions being targeted at behaviour within their jurisdiction and outside of the UK.”

In essence, it appears as though the appeal’s approval sets a legal precedent wherein the U.K. court system’s stance on enforcing GDPR has been relegated to only those companies firmly within the U.K.’s purview.

In contrast, Clearview AI has been sued and fined multiple times in Europe via the European Union’s GDPR, with fines being levied in France, Italy and Greece. In Sweden, the local police authority was fined more than $300,000 for its illegal use of Clearview AI products in 2021.

Related: UK to target potential AI threats at planned November summit

However, regarding these and other judgments, Clearview AI has managed to avoid following the court’s orders in at least some instances. Despite, for example, being fined $20 million for GDPR breaches in France in October 2022, the company refused payment and was found in breach of that order as of May 2023.

Currently, Clearview AI holds what appears to be a unique position within the U.S. tech ecosystem. Despite continuing allegations that its software and services violate civil rights and privacy protections afforded to all U.S. citizens, the company’s close ties with law enforcement have, according to some experts, afforded it a level of protection inconsistent with U.S. laws against unwarranted surveillance and the Fourth Amendment to the U.S. Constitution.

As such, it is nearly impossible for most people to have their data removed from the company’s data sets and systems.

Per Clearview AI’s Privacy Policy page, “Currently, only those who are a resident of one of the following states may submit a consumer request for access, opt-out, and/or delete.” Those states include California, Colorado, Connecticut, Illinois and Virginia.

Individuals outside of those areas have, so far, no explicit recourse to have their images, likeness and other data removed from the company’s data set.

The same document states explicitly that Clearview AI “may have sold this category of personal information [face vectors and photographs] to law enforcement, governmental agencies, authorized contractors of law enforcement or government agencies, security and national security professionals.”

Those living in the aforementioned U.S. states wishing to opt out must submit a “headshot” photograph, verify their government-issued identification, and provide “any additional information” required by the company in order to have their request for removal reviewed.