ICO calls for stronger governance as police facial recognition expands
The Information Commissioner’s Office has warned that stronger and more consistent data protection governance is needed as police forces across England and Wales expand their use of facial recognition technology.
The regulator’s conclusions follow a programme of consensual audits covering five forces. The review examined a period of rapid operational change: live facial recognition had previously been concentrated in two forces, but its use was spreading, while police were also exploring operator initiated facial recognition that
could allow an officer to check a person against a watchlist using a mobile device.
The ICO found a mixed compliance picture. Forces generally identified and documented lawful bases, limited the personal data used during live facial recognition deployments and maintained procedures for reporting personal data breaches. Compliance was generally stronger for live facial recognition than for retrospective facial recognition.
However, the audits also identified inconsistencies and areas requiring urgent improvement. The ICO’s central concern is that the consequences of error can be serious: a false match may lead to an unnecessary police intervention, accusation or arrest. Governance must therefore do more than confirm that the technology works technically. Forces must be able to demonstrate why a particular deployment is necessary and proportionate, how watchlists are compiled and controlled, how accuracy and bias risks are assessed, and where responsibility lies when the system produces a match.
The regulator said public support for police use of facial recognition is conditional. People expect the technology to be accurate and unbiased, to respect privacy and to be used for a clear social benefit. Visible safeguards, oversight and accountability are therefore integral to maintaining legitimacy rather than ancillary compliance measures.
The five audited forces have submitted action plans, and the ICO is encouraging other forces to use the published findings to assess their own arrangements. An audit of the Metropolitan Police Service is expected later in 2026.
For organisations outside policing, the findings provide a useful governance checklist for any high-impact biometric deployment: establish and record a lawful basis; complete a detailed data protection impact assessment; define necessity and proportionality; minimise input data; test accuracy and demographic performance; maintain meaningful human oversight; and monitor the system after deployment.
For more information, see our new course on Biometrics and Data Protection.
