Updated The UK's Information Commissioner's Office (ICO) is looking to appeal against last month's decision by a tribunal that decided it wasn't legally authorized to fine Clearview AI over alleged privacy violations.

The data protection watchdog said it believes the law was misinterpreted and that the US selfie-scraper shouldn't be shielded from the scope of UK GDPR.

Clearview was originally targeted by the ICO earlier this year and slapped with a £7.5 million ($9.3 million) fine for its allegedly unlawful collection of UK citizens' biometric data. 

It claims to have a database exceeding 20 million facial images, most of which have been scraped from social media sites. It uses this data to train the facial recognition technology it's aiming to patent.

Last month a UK tribunal ruled the ICO was not authorized to issue the fine due to Clearview providing services to foreign law enforcement agencies.

The tribunal applied the wording of the original Data Protection Act 2018 to the Clearview case, referencing Article 2(2)(a) which stipulates that the regulations don't apply to an activity that "falls outside the scope of Union law."

It essentially means that if a foreign law enforcement agency was pursuing a UK national for breaking one of their domestic laws, it can lawfully process that person's data outside of the scope of the UK data protection law.

The wording of Article 2 has since changed, but the exclusion of processing for the purposes of law enforcement by a competent authority remains.

The ICO's argument focuses on this in particular, saying it believes the tribunal misinterpreted the law. 

Its main counter-argument hinges on the idea that because Clearview isn't primarily processing data for foreign law enforcement purposes, it shouldn't be allowed to use that defense to escape regulatory clutches.

"I fully respect the role of the tribunal to provide scrutiny of my decisions - but as the defender of the public's privacy, I need to challenge this judgment to clarify whether commercial enterprises profiting from processing digital images of UK people, are entitled to claim they are engaged in 'law enforcement'," said John Edwards, UK information commissioner.

"It is my job to protect the data rights of the people of the United Kingdom and it is my view that there are too many who are being affected by the sheer scale and intrusiveness of Clearview's mass scraping of personal information.

"This is an important issue within the AI sphere and whilst my office supports businesses that innovate with AI solutions, we will always take the appropriate action to protect UK people when we believe their privacy rights are not being respected."

The ICO welcomed part of the tribunal's judgment, including the clarification that companies not established in the UK are still bound by UK data protection law in cases where people in the UK are being monitored. It feels this also lends support for its stance that Clearview should be subject to the ICO's jurisdiction.

Neil Brown, specialist senior solicitor at decoded.legal, said that the ICO could take one of two approaches to this appeal but at this time it's not clear in what direction the watchdog will go.

The first route could be to argue that the tribunal applied the wrong version of UK GDPR, that there was no relevant exclusion for Clearview's activities. The ICO could also argue that the tribunal simply misinterpreted the wording that it did apply to the case.

"The ICO has a reasonable argument to make here, but it is not a cut-and-dry case, as there's a reasonable counter-argument too," Brown told The Register. ®

Updated to add at 1455:

Jack Mulcaire, General Counsel, Clearview AI, said in a statement: "The tribunal decision vindicated the common-sense position that Clearview AI has taken all along: Clearview AI is not subject to the ICO's jurisdiction. We oppose the ICO's meritless appeal."

https://www.theregister.com//2023/11/17/ico_clearview_fine/