TECHNOMALIST
The UK Information Commissioner's Office (ICO) has published the results of audits into how police forces in England and Wales use facial recognition technology, concluding that significant improvements are needed.
The regulator's outcomes report, released alongside its audits of West Yorkshire Police and Greater Manchester Police, draws on a sample of five forces that also includes South Wales and Gwent, Essex, and Leicestershire. It describes a “mixed picture”: while forces have generally identified and documented a lawful basis for processing facial recognition data, the ICO says urgent attention is required in several areas.
According to the ICO, police forces must establish clear senior oversight, accountability and training so that staff understand their roles and responsibilities. They also need to keep detailed records of what personal information is used, where it comes from, how it is processed and who it is shared with. The regulator calls for additional steps to reduce the risk of unfairness or bias and to ensure systems are accurate.
Across the audited forces, the ICO made 107 recommendations covering both compliance and best practice. All were accepted or partially accepted, the regulator said.
The audits come amid a wider push to roll out facial recognition and AI tools across UK policing. Previously, live facial recognition was mostly deployed by the Metropolitan Police and South Wales Police.
The ICO found that compliance rates were generally higher for live facial recognition than for retrospective facial recognition (RFR), where officers search images after an incident. It specifically warned that forces must ensure images used for RFR are obtained from appropriate sources and not retained longer than necessary.
The regulator also said forces should limit the size of watchlists, in line with data protection principles requiring personal data to be adequate, relevant and not excessive. It stressed that only images that are accurate, verifiable and lawfully held by police at the time of use should be used.
In a statement, the ICO said its recommendations give forces direction on data protection obligations and that all audited forces have action plans in place. It said it will follow up to ensure implementation and is working with the National Police Chiefs' Council (NPCC) leads for facial recognition to support consistent compliance across England and Wales. The regulator is also engaging with the Home Office on planned legislative reforms, and warned that if forces do not improve or if future contraventions are identified, it will not hesitate to use its regulatory powers.
An audit of the Metropolitan Police – which first deployed live facial recognition at Notting Hill Carnival in 2016 – is due later in 2026.
Computer Weekly reported that despite a 2012 High Court ruling that millions of custody images were being unlawfully retained by the Home Office in the Police National Database, successive biometrics commissioners have warned that many records are still kept and could find their way into police watchlists. The article cites the February 2026 case of software engineer Alvi Choudhury, who was arrested after Thames Valley Police used a five-year-old custody image in an RFR search to link him to a crime that he was 80 miles away from at the time. Choudhury had been detained but never charged in Portsmouth in 2021.
Senior officers from the Metropolitan and South Wales Police previously told a parliamentary committee in December 2023 that, given watchlists can run into the thousands, images are selected based on the crime category attached to the photo rather than context-specific intelligence about the individual.
When asked about the custody image issue, an ICO spokesperson said public trust in police facial recognition depends on robust governance and accountability. Forces must ensure images are accurate, verifiable and lawfully held, and must be able to evidence that watchlist images are necessary and relevant. The spokesperson said the regulator is engaging with the Home Office to understand how these issues are being addressed.
The Home Office launched a 10-week consultation in December 2025 on the use of live facial recognition by UK police. It said the current “patchwork” legal framework does not give police confidence to use the technology at significantly greater scale, nor consistently give the public confidence it will be used responsibly. The department noted that existing rules are complicated and difficult to understand.
The article also highlights a June 2026 United Nations study that found the chilling effects of digital surveillance, including facial recognition, are so profound that they can no longer be viewed as targeted measures but as a systemic threat to democracy. The study described surveillance as an interconnected ecosystem, with impacts disproportionately harming marginalised and racialised communities and those seeking accountability for human rights violations.
See an error? Read our corrections policy or email [email protected].
