Information Commissioner's Office (ICO)

What is the ICO?

The ICO is a non-departmental public body headed by the Information Commissioner, based in Wilmslow, Cheshire. It regulates the UK GDPR and the Data Protection Act 2018 along with the Privacy and Electronic Communications Regulations and the Freedom of Information Act. It can issue enforcement notices, require organisations to stop processing, and impose fines of up to 17.5 million pounds or 4 percent of global turnover.

What has it done about face search?

The ICO's most visible action in this field is ICO v Clearview. In May 2022 it fined Clearview AI 7.5 million pounds and ordered it to delete UK residents' data from its index of scraped face images. The First-tier Tribunal set the fine aside in October 2023 on jurisdictional grounds; the Upper Tribunal reversed that in October 2025, and Clearview was granted permission to appeal to the Court of Appeal. The case decides whether a foreign company that indexes UK faces falls under UK law at all.

In February 2024 the ICO published its first phase of guidance on biometric data and biometric recognition, which treats a face template used to identify someone as special category data under Article 9. Big Brother Watch has filed a complaint with the ICO against PimEyes; no public outcome had been announced on the date this entry was checked.

1. 1984

   Data Protection Registrar created

   Under the Data Protection Act 1984; renamed Information Commissioner in 2001.

2. 2018-05

   UK GDPR era begins

   The Data Protection Act 2018 and, after Brexit, the UK GDPR become the ICO's main tools.

3. 2022-05-23

   Clearview AI fined 7.5 million pounds

   Enforcement and penalty notices for scraping UK faces without a lawful basis.

4. 2023-10-17

   First-tier Tribunal sets the fine aside

   The tribunal found Clearview's processing fell outside UK jurisdiction.

5. 2024-02-23

   Biometric data guidance published

   First phase of guidance on biometric recognition under UK GDPR.

6. 2025-10-08

   Upper Tribunal rules for the ICO

   Three of four grounds upheld; the case is sent back to the First-tier Tribunal; Clearview granted permission to appeal to the Court of Appeal in December 2025.

How do you use the ICO?

• Complain about an organisation: use the complaints form on ico.org.uk after raising the matter with the organisation first. The ICO assesses complaints but does not award compensation.
• Report a breach: organisations report personal data breaches within 72 hours through the ICO's online form.
• Helpline: 0303 123 1113 for individuals and small organisations.
• Subject access: the ICO explains how to ask any organisation, including a face search engine, what data it holds about you.