General Data Protection Regulation Fine ... Overturned!

In a surprising turn of events, on Oct. 18 a First-tier Tribunal in the U.K. overturned a fine previously issued by the U.K. Information Commissioner's Office (ICO) against facial recognition company Clearview AI for failing to comply with the principles of the General Data Protection Regulation (GDPR), lacking a lawful basis to process personal data, and unlawful processing of special category and biometric data.

Clearview successfully argued that ICO has no authority over Clearview's data processing practices, or to fine Clearview for such practices despite some of the processed data belonging to U.K. residents. The Tribunal agreed with Clearview on the basis that Clearview is only providing its facial recognition services to law enforcement and government agencies based outside the U.K., and that the GDPR does not allow ICO to interfere with the policies and operations of other governments. Interestingly, processing of personal data by U.S. agencies was a point