Facial Recognition Technology

The ICO describes facial recognition technology (FRT) as technology which identifies or otherwise recognises a person from a digital facial image, using cameras to capture images and software to measure and analyse facial features to produce a biometric template, typically to identify, authenticate, verify or categorise individuals. Because this usually involves processing biometric data — and, in most cases the ICO sees, special category personal data — organisations must have a lawful basis under Article 6 UK GDPR and satisfy a condition under Article 9 (uniquely identifying biometric processing is otherwise prohibited), alongside any additional conditions in the Data Protection Act 2018.

In R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058, the Court of Appeal held that South Wales Police's use of live automated facial recognition (AFR) — 'a way of assessing whether two facial images depict the same person' — on two specific occasions and on an ongoing basis was not in accordance with the law for the purposes of Article 8(2) ECHR, that its Data Protection Impact Assessment did not comply with s.64(3)(b) and (c) of the Data Protection Act 2018, and that the force did not comply with the Public Sector Equality Duty in s.149 of the Equality Act 2010. The appeal was allowed on those grounds (Grounds 1, 3 and 5), establishing that police forces need clear, published policies constraining who can be put on a watchlist and where AFR can be deployed, a compliant DPIA, and evidence that the equality implications of the technology have actually been considered — not merely a general assurance of due regard.