Clearview Tests the Reach of UK GDPR as the EU AI Act Clock Resets

Week of 26 October 2026 | Compiled by Team Paringa

Regulators are testing how far privacy law reaches into AI supply chains, while the EU AI Act timetable has been rewritten. Both shifts raise the cost of holding raw personal data in AI pipelines.

What Happened This Week

🔴 Clearview AI takes its ICO fine to the Court of Appeal

The Court of Appeal of England and Wales began hearing Clearview AI v Information Commissioner on Monday 19 October 2026, with the hearing scheduled to run three days. No judgment date has been given. The ICO issued an enforcement notice and a monetary penalty against the US facial recognition company in 2022, reported at more than £7.5 million. The First-tier Tribunal found in 2023 that the ICO lacked jurisdiction, and the Upper Tribunal partly reversed that on 6 October 2025.

The core question is how far UK GDPR applies to a privately owned firm based abroad that processes UK residents' data, including where it supports foreign governments' law enforcement or national security work. Clearview now argues that monitoring carried out for state customers falls outside UK GDPR altogether. Privacy International, intervening on the ICO's side, calls that argument misconceived and says the monitoring provision in Article 3(2)(b) sets no conditions on who monitors or where. Regulators in France, Italy, Greece, Austria and the Netherlands have already applied the equivalent EU rule to Clearview.

The wider context is an active enforcement season. The ICO became the Information Commission on 30 September 2026 while keeping its name and branding, TikTok withdrew its appeal against a £12.7 million ICO fine for mishandling children's data, and the Irish DPC announced a €403 million fine on Google over location data on 21 September. The EDPB's fining methodology consultation closes on 13 November. For UK organisations buying scraping, profiling or AI tools from overseas vendors, a ruling against Clearview would confirm that the supplier, and not only the buyer, is reachable by the regulator.

Sources: Resultsense | Ashurst Data Bytes 69

Whatever the judgment says, the direction of travel is clear: regulators are following personal data wherever it goes in the supply chain. If your AI vendors, data brokers or model providers hold raw PII on your behalf, you carry exposure you may not have mapped. The practical response is to stop sending real identifiers downstream at all. Tokenising PII before it reaches an AI pipeline, as Skyflow does, shrinks the data in scope for any regulator, in any jurisdiction. Ask every AI vendor this week: do you ever see our customers' raw data, and why?

🟡 EU AI Act: high-risk delayed to December 2027, but December 2026 still bites

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 after Parliament approved it on 16 June and the Council adopted it on 29 June. Annex III high-risk obligations (biometrics, employment, credit scoring, education, critical infrastructure) moved from 2 August 2026 to 2 December 2027. Annex I high-risk systems tied to product safety law move to 2 August 2028, and national AI sandboxes to 2 August 2027.

Not everything slipped. Article 50(2) watermarking applies from 2 December 2026 for generative AI systems already on the market before 2 August 2026, with no grace period for newer systems, and a new Article 5 prohibition on AI generating non-consensual intimate imagery or child sexual abuse material also starts on 2 December 2026. Maximum fines are unchanged at EUR 35 million or 7% of global annual turnover. Note that secondary commentary on the omnibus varies in quality, so confirm dates against the Official Journal text before acting.

Sources: Usercentrics

The delay is a reprieve, not a reason to pause. High-risk compliance still depends on knowing what personal data feeds each model, and that inventory takes longer than most teams expect. Use the extra year to build data minimisation into the architecture rather than bolting on controls in 2027. Teams that treat the delay as breathing room for data governance will be ready when the deadline returns.

What Data and Privacy Leaders Are Dealing With

The enforcement picture is converging from two directions. Courts and regulators are widening who counts as accountable, from the buyer of an AI tool to its overseas supplier, while the EU is giving high-risk AI more time but not softening the penalties. Together this means the safest design is the one where sensitive data never reaches the places regulators are now looking.

For privacy and security leads the pressure is practical: prove where PII lives, who can see it, and how it is protected when it enters training sets, prompts and logs. Tokenisation and vault-based approaches are moving from a nice-to-have to a standard answer in vendor due diligence.

Three Things Worth Watching Next Week

1. Clearview judgment timing — No date is set, but a reserved judgment could land at short notice. Watch for commentary on extraterritorial reach.

2. EDPB fining methodology consultation — It closes on 13 November, so expect industry submissions and early positioning on how penalties will be calculated.

3. 2 December 2026 readiness — Watermarking and the new Article 5 prohibition are six weeks away, so expect vendor announcements and guidance on generative AI obligations.

Questions? hello@paringa.ai

Paringa helps organisations keep sensitive data out of harm's way while still putting AI to work. We pair deep partner expertise with practical delivery so privacy becomes an enabler, not a blocker. | 26 October 2026 | © Paringa Ltd