On Friday, 17 November, the Information Commissioner's Office announced that it is seeking permission to appeal the First Tier Tribunal (FTT) judgment on Clearview AI Inc., which overturned the £7.5 million monetary penalty and enforcement notice issued in May 2022.
Information Commissioner John Edwards welcomed the clarification on UK data protection law, indicating that companies processing billions of facial images for access and analysis using AI will be subject to UK legislation, even if they are not established in the UK.
The Commissioner believes, however, that the FTT wrongly interpreted the law by finding that Clearview's processing fell outside the scope of UK data protection law. As such, the Commissioner considers Clearview should be subject to UK law, even if it provides its services to foreign law enforcement agencies.
In a statement, John Edwards said, "I fully respect the role of the Tribunal to provide scrutiny of my decisions - but as the defender of the public's privacy, I need to challenge this judgment to clarify whether commercial enterprises profiting from processing digital images of UK people, are entitled to claim they are engaged in 'law enforcement'... This is an important issue within the AI sphere and whilst my office supports businesses that innovate with AI solutions, we will always take the appropriate action to protect UK people when we believe their privacy rights are not being respected."
The announcement follows a legal analysis from Bird & Bird's Ruth Boardman, Emily Mason, and James Moss earlier in the week. In an article for the IAPP examining the FTTs decision, the authors argue that the conclusion Clearview AI is both a controller and processor for the same processing activities is inconsistent with European Data Protection Board and ICO guidance.
Furthermore, the conclusion that Clearview AI and its clients can be joint controllers is also inconsistent with CJEU case law and the guidance mentioned above. This suggests a lack of analysis by the FTT, which may affect the weight that should be given to the other aspects of the decision. Given FTT decisions do not constitute binding authority, any future Tribunal would not be bound to follow it should the ICO be inclined to pursue the matter further.
UPDATE: 211123 - In their legal analysis, Pinsent Masons argued that it is unsurprising that the ICO is seeking leave to appeal, considering the potential implications of facial recognition technology. Emily Cox, Partner at the law firm, said: "The regulator will want absolute clarity as to an interpretation of GDPR which allows a commercial enterprise to benefit from an exemption for the law enforcement agencies which it serves... It will also be conscious of the divergent regulatory outcome thus far when compared with other jurisdictions in the EU."
Related articles:
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 4,350 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
