Clearview AI in the Court of Appeal: Does UK GDPR Reach a Company With No UK Presence?

In October the Court of Appeal heard Clearview AI’s challenge to the ruling that put it within reach of UK data protection law. The company is established in the United States and its customers are foreign law enforcement and government bodies, not British ones. The question the court has been asked to settle is whether that matters. For any business outside the UK that handles information about people in the UK, the answer will describe its own position.

How the case got here

In May 2022 the Information Commissioner fined Clearview AI Inc £7.5 million and issued an enforcement notice requiring it to stop collecting UK residents’ data and to delete what it held. The company scrapes images of people from the web and social media into a database that its customers can search with facial recognition. Its customers were foreign law enforcement and government bodies.

Clearview appealed. In October 2023 the First-tier Tribunal found in its favour, holding that the processing fell outside the material scope of the UK GDPR because it served foreign governments’ law enforcement functions. The Commissioner appealed that decision, and in October 2025 the Upper Tribunal allowed the appeal on three grounds: Clearview’s processing related to the monitoring of UK residents’ behaviour; supplying foreign law enforcement agencies did not take the processing outside UK data protection law; and the First-tier Tribunal had misapplied the material-scope exemption. The Upper Tribunal sent the case back to the First-tier Tribunal to decide the substantive appeal on the footing that the Commissioner did have jurisdiction, and in December 2025 gave Clearview permission to take the jurisdiction point to the Court of Appeal. The Commissioner said at the time that the ruling “upheld our ability to protect UK residents”.

The Court of Appeal hearing has been reported as taking place on 19 to 21 October 2026. No judgment date has been given. Whatever the court decides, the substantive appeal against the penalty itself is still to be heard.

Why a company with no UK presence is in scope at all

Article 3(2) of the UK GDPR applies the law to a controller or processor established outside the UK where its processing relates either to offering goods or services to people in the UK or to monitoring their behaviour within the UK. The Clearview litigation turns on the second limb: the Upper Tribunal accepted that building a searchable database of UK residents’ faces, and letting customers run searches against it, is monitoring of behaviour. The Court of Appeal has been asked to say whether that reading is right.

Article 3(2) has a practical consequence that is easy to miss. A controller caught by it must, unless an exemption applies, designate a representative in the UK under Article 27 — a named point of contact for the regulator and for the people whose data it holds. Occasional, low-risk processing of ordinary data is exempt; systematic processing at scale is not.

What it means if you are outside the UK

• If you offer goods or services to people in the UK, or track their behaviour online, the UK GDPR applies to that processing today. The Court of Appeal is deciding the edge of “monitoring”, not whether Article 3(2) exists.
• A UK representative is a legal requirement for most organisations in that position, not an optional comfort. The ICO can act against the controller directly, as this case shows, and the representative is where its correspondence lands.
• Scraping publicly available personal data is processing. “It was public” is not a lawful basis, in the UK or in the EU.

We act as the UK representative for organisations outside the UK that serve UK customers, from Privacy Core UK Ltd. If you are not sure whether Article 27 applies to you, our guide to the UK representative requirement walks through the test, and the UK representative service is the answer if it does. We will update this article when the Court of Appeal gives judgment.