Can a private facial-recognition company rely on the governmental functions of its overseas customers to place its processing beyond UK privacy regulation?
That question sits at the centre of Clearview AI’s appeal before England and Wales’ Court of Appeal, scheduled for October 19-21.
The proceedings concern the Information Commissioner’s jurisdiction to issue enforcement and monetary penalty notices in 2022. The current hearing is not a new fine or a final appellate judgment. Court of Appeal: hearing summary and dates.
The company’s activities and its customers’ functions
The official hearing summary identifies the dispute as one about the reach of UK and EU data-protection legislation.
It asks when processing UK residents’ personal data by an overseas private company falls outside regulation, including processing connected with foreign customers’ national-security or criminal-law-enforcement activities.
Clearview is appealing an October 2025 Upper Tribunal decision that partly allowed the Commissioner’s challenge to an earlier jurisdictional ruling. Privacy International is intervening. Court of Appeal: hearing summary and dates.
The distinction is consequential. A private supplier’s processing and a government customer’s use of the resulting service are related activities, but their legal characterization requires separate examination.
Why technology counsel should follow the appeal
For companies serving public authorities across borders, the case highlights the need to map more than customer location.
Counsel may need to distinguish what information is collected, whose information it is, what processing the supplier performs and how the customer subsequently uses the service.
That exercise matters because a customer’s public function does not, without further legal analysis, answer every question about the supplier’s obligations.
For Canadian businesses, the appeal offers a comparative discussion of cross-border regulatory reach. Its eventual interpretation of UK and EU legislation will not determine Canadian privacy law.
The practical lesson is to test jurisdictional assumptions against the supplier’s own activities. Describing a product as a law-enforcement service is a starting point for analysis, not a complete regulatory classification.
The Court of Appeal’s reasons will matter most in explaining how those distinctions fit together.
The customer’s mandate does not eliminate the need to examine the supplier’s conduct.
Related coverage: AI Agents Reportedly Probed a Canadian Government Website: What Is Known.
Sources: Court of Appeal: hearing summary and dates · Upper Tribunal: October 2025 decision .