ICO police facial recognition audits reveal ‘blended’ bag
UK knowledge regulator says “vital enhancements” are wanted in how UK police forces are utilizing facial recognition applied sciences, after official audits reveal “a blended image”.
In keeping with an “outcomes report” from the UK Data Commissioner’s Workplace (ICO), which has been printed alongside its latest facial recognition audits of West Yorkshire Police and Better Manchester Police, inconsistencies throughout how a pattern of 5 forces are utilizing the know-how have revealed the necessity for “pressing consideration” in a lot of areas.
The ICO mentioned that whereas there are “real areas of assurance” (together with forces usually having recognized and documented a lawful foundation for his or her facial recognition-related knowledge processing), motion is required to make sure there’s clear senior oversight, accountability and coaching for workers utilizing facial recognition applied sciences, and that they absolutely perceive their roles and obligations.
It added that forces may even have to preserve clear information of what private data is getting used, the place it comes from, how it’s used and who it’s shared with, in addition to take further steps to scale back the chance of unfairness or bias and guarantee techniques are correct.
The ICO mentioned that throughout audited forces – which additionally consists of South Wales and Gwent, Essex, and Leicestershire – it made 107 suggestions protecting each compliance and finest follow, all of which had been accepted or partially accepted.
The report and audit outcomes come amid a nationwide push to roll out facial recognition and synthetic intelligence (AI) instruments throughout UK policing. Previous to this, facial recognition was principally utilized by the Metropolitan and South Wales Police.
Additional suggestions made by the ICO embody forces growing their very own facial recognition audit procedures, guaranteeing there are logging capabilities in place to know how and why officers are utilizing folks’s private data, and conducing iterative knowledge safety influence assessments to make sure all dangers are recognized and mitigated.
Compliance charges
The regulator additionally highlighted that compliance charges had been usually greater for using stay facial recognition (LFR) than retrospective facial recognition (RFR), particularly noting that forces want to ensure photos used for the latter are obtained from acceptable sources and never saved for longer than obligatory.
“Our audit suggestions give forces the course they should get knowledge safety obligations proper,” mentioned the ICO. “The forces we now have audited all have motion plans in place to make sure compliance. We are going to observe up with forces to make sure they implement these.
“At nationwide degree, we’re working with the Nationwide Police Chiefs’ Council’s (NPCC’s) leads for FRT to help a constant strategy to compliance throughout forces in England and Wales. Drawing on the findings of our audits and the clear expectations set out on this report. We’re additionally partaking with the Dwelling Workplace on deliberate legislative reforms for FRT and nationwide policing.”
The ICO added that “if forces don’t make enhancements, or if we establish future contraventions of the regulation, we is not going to hesitate to make use of our regulatory instruments”.
An audit of how the Metropolitan Police – which first deployed LFR at Notting Hill Carnival 2016 – use facial recognition is because of be performed later in 2026.
Unlawfully held custody photos
The ICO was clear in its report that forces ought to restrict the dimensions of watchlists (in step with knowledge safety rules requiring private data to be enough, related and never extreme for the meant regulation enforcement goal), and may solely use photos which are correct, verifiable and lawfully held by the police on the time of use.
Nevertheless, regardless of the Excessive Courtroom ruling in 2012 that hundreds of thousands of custody photos – together with these of individuals by no means even charged with or convicted of a criminal offense – had been being unlawfully retained by the Dwelling Workplace within the Police Nationwide Database (PND), successive biometrics commissioners have warned that hundreds of thousands of those information are nonetheless being saved and will discover their method into police watchlists.
In February 2026, for instance, it got here to gentle that software program engineer Alvi Choudhury was arrested on account of an RFR search by Thames Valley Police, who was detained after the drive used a five-year-old custody picture to hyperlink him to a criminal offense that he was 80 miles away from on the time of the incident.
That custody picture was taken after Choudhury was beforehand detained – however by no means charged – in Portsmouth in 2021, following an altercation between two teams.
Senior officers from the Metropolitan and South Wales Police beforehand advised a Parliamentary committee in December 2023 that, given the large measurement of watchlists that may run into the 1000’s, photos are chosen based mostly on the crime class hooked up to the photograph, quite than context-specific intelligence about that particular person.
Laptop Weekly contacted the ICO about whether or not it appeared into the custody picture concern, and whether or not it might touch upon how the harms of unlawfully held photos discovering their method onto watchlists will be successfully mitigated given the above context.
An ICO spokesperson mentioned: “Public belief in police use of facial recognition know-how relies on strong governance and accountability. Forces should make sure that photos used inside facial recognition techniques are correct, verifiable and lawfully held in accordance with knowledge safety regulation.
“They need to additionally be capable of proof that watchlist photos are obligatory and related. We perceive that is an space of ongoing concern and we’re partaking with the Dwelling Workplace to know how these points are being addressed.”
Upcoming laws
In December 2025, the Dwelling Workplace launched a 10-week session on using LFR by UK police, permitting events and members of the general public to share their views on how the controversial know-how must be regulated.
The division has mentioned that though a “patchwork” authorized framework for police facial recognition exists (together with for the growing use of the retrospective and “operator-initiated” variations of the know-how), it doesn’t give police themselves the boldness to “use it at considerably better scale … nor does it persistently give the general public the boldness that it is going to be used responsibly”.
It added that the present guidelines governing police LFR use are “sophisticated and obscure”, and that an extraordinary member of the general public could be required to learn 4 items of laws, police nationwide steering paperwork and a variety of detailed authorized or knowledge safety paperwork from particular person forces to completely perceive the idea for LFR use on their excessive streets.
Digital surveillance a systemic risk
In June 2026, a landmark United Nations (UN) research discovered that the “profound” chilling results of digital surveillance – together with through facial recognition – on folks’s behaviour means it could possibly now not be seen as a focused measure towards particular actors, however as a systemic risk to democracy itself.
It highlighted how chilling results are amplified by the more and more distant and asymmetrical nature of latest surveillance, which disproportionately harms marginalised and racialised communities, in addition to these engaged in looking for accountability for human rights violations or difficult corruption.
One of many main issues with the remoteness and asymmetry of contemporary surveillance is that these topic to it are unable to realize certainty concerning the extent of scrutiny they might be positioned underneath, in flip leaving them unsure if they are going to be topic to authorized motion by the state.
The UN research was additionally clear that, quite than specializing in particular instruments or practices, it’s extra correct to view surveillance as an interconnected ecosystem comprised of assorted digital infrastructures operated by each state and non-state actors.
For instance, from the views of these topic to surveillance, using facial recognition at a protest, using spy ware to focus on a journalist or the infiltration of digital communication channels aren’t seen as discrete occurrences, however as a substitute as constituent elements of an total surveillance ecosystem that may be leveraged towards them.
“The consequence is that ostensibly discrete surveillance actions in reality exist throughout a surveillance continuum and persist over time, leaving deep, long-term, society-wide impacts,” it mentioned. “These impacts are enhanced with respect to marginalised and weak teams, and people engaged in socio-political actions clashing with the established order.
“It’s this ecosystem-related influence that performs a decisive function with respect to the diploma to which chilling results are skilled by completely different people and teams. This poses a problem to conventional human rights regulation evaluation as ecosystem-related chilling results aren’t typical ‘cause-and-effect’ harms, whereby a selected incident provides rise to an outlined hurt.”
