Why the latest consultation on UK police biometrics watchdog leaves too many questions

By Professor Fraser Sampson, former UK Biometrics & Surveillance Camera Commissioner

How should we regulate the police use of facial recognition technology (FRT)? This has been a challenge for successive UK governments and the latest consultation window for a new regulator has just closed. In answering its 17 questions, I was left with several of my own, the first being what are they proposing this time? It’s neither a police biometrics regulator nor a regulator for policing biometrics – it’s more like a new body that will oversee some uses of some biometrics for some law enforcement purposes.

The proposed framework will be limited to FRT and similar capabilities used by the police and law enforcement organisations, which is inexplicable for several reasons. First, the government has just put this “transformative technology” at the heart of its policing reforms announced in a White Paper. If the Home Secretary’s promised reforms make the police more accountable to their communities through democratic bodies like mayors and local councils, it’s unclear why they will need a separate regulator. These newly empowered bodies will be holding the police to account for their use of AI-enabled technology and biometrics generally, so what’s different about FRT?

Who watches the watchdogs is a valid question, but the answer can’t depend on the breed – the accountability issues for police biometrics are homogeneous.

Second, parliament has accepted that the police need a specific framework when applying scientific methods for purposes relating to the detection or investigation of crime, or the preparation, analysis or presentation of evidence. Which is why they already have one – in fact that description is taken directly from the Forensic Science Regulator Act 2021. It’s been fully in force for over two years, already has a regulator and a code of practice being followed by the police. The forensic science framework covers fingerprint and DNA analysis but the consultation expressly excludes it. Why? Do the police plan to use FRT for purposes other than those described? If so, what are they? Policing has successfully adopted type-approval schemes and technical testing in areas like road safety, toxicology and DNA profiling – why not FRT?

If FRT needs clear published standards of its own, those standards must be readily accessible to the public and the best place to put them is where people would expect to find them – in this case alongside all the other national standards and technological specifications for scientific policing tools. Putting FRT somewhere else feeds suspicions and contradicts repeated assurances that this technology is simply an extension to existing police capabilities. How will that help public trust and confidence in the police use of FRT that’s just beginning to recover?

Third, the last consultation argued that FRT was adequately covered by data protection arrangements; this latest one says it needs exceptional regulation. Which is right? Either way, the consultation endorses the self-defeating ‘data rights’ approach that allows people who are wanted by the police to ‘opt out’ of being found by the very technology that has been bought to find them. We don’t do that with any other police biometrics – why continue to do it with FRT?

Fourth, the consultation doesn’t recognise that much of the digital imagery used by the police now comes from outside policing. As I have attested many times, we’ve changed from a society where the police collected images of us to one where they collect images from us. The consultation says nothing about the sharing, retention and use of citizen-generated biometrics, yet we are no longer just the object of state surveillance apparatus, we are a key component in its effective operation. Our surveillance infrastructure depends on communities working in close partnership with the police, a partnership that the government’s White Paper acknowledges. Where does all this fit within the proposed framework?

Perhaps the biggest question, unasked but begged by the consultation, is ‘to what problem is this the solution?’ Let’s face it – if we don’t trust the police with FRT the problem isn’t the technology and the tenor of the consultation suggests we don’t.

If ministers want to create biometric policy that meets the expectations of the public, they might look at where it’s already doing so, in public/private settings like international air travel where the focus of FRT and other ID confirmation has been convenience and safety rather than just ‘law enforcement’. They could look at how retailers are discovering the immediate, substantial and sustained preventative effect of FRT on crime rather than enforcing the law, but also how ‘plug-and-play’ FRT products are now being sold without any regulatory intervention. The latest proposals would leave this area unregulated, carrying a real risk of confusion, reputational damage and ultimately undermining public confidence in the proper use of biometric technology by any organisations, including police and law enforcement agencies. Shouldn’t this regulatory gap be closed?

In the other direction, the use of FRT is a significant and immediate risk to law enforcement agents operating under assumed or concealed identities. How can we explain still less defend regulating its use by those agents but not its deployment against them?

If a new framework is needed (which remains far from clear) it must be grounded in technological and sociological reality. Demonising or fetishising specific applications of AI-enabled biometrics is irrational. To be credible and effective, any regulatory framework must cover the whole biometric ecosystem in which any single element operates.

At strategic level the purpose of biometric regulation is to ensure the balancing of the possible (what can be done), the permissible (what must/must not be done) and the acceptable (what we support being done), not just by the police but by all of us. As the gap between the three is widening, opportunities to close it are narrowing. This latest consultation is in danger of missing another one.

About the author

Fraser Sampson, former UK Biometrics & Surveillance Camera Commissioner, is Professor of Governance and National Security at CENTRIC (Centre for Excellence in Terrorism, Resilience, Intelligence & Organised Crime Research) and a non-executive director at Facewatch.

Article Topics

biometrics  |  criminal ID  |  facial recognition  |  Fraser Sampson  |  law enforcement  |  police  |  regulation