UK ICO finds police facial recognition use mostly compliant with data regulations

The UK Information Commissioner’s Office says police are using facial recognition in ways that meet their regulatory compliance obligations, for the most part. Their compliance rate is higher with live facial recognition than with retrospective or forensic applications, however, according to the ICO’s findings from audits of five forces in England and Wales.

A blog post by Deputy Commissioner for Regulatory Policy Emily Keaney makes the case for strong data protection governance as a pillar of public trust in facial recognition, and therefore suggests police using the technology draw on the audit findings to improve theirs. The ICO makes 107 recommendations overall related to compliance and best practices. The forces accepted all of the recommendations, at least in part, and the regulator gives the police good marks for participating in and cooperating with the audits.

Keaney also writes that Home Office and the National Police Chief’s Council (NPCC) told the ICO they are dealing with the demographic differentials found by the National Physics Lab in the legacy Cognitec algorithm released in 2020 with additional staff training, oversight reporting, equality impact assessments and plans to replace the algorithm, presumably to a newer release.

In the meantime, Home Office held consultations on the introduction of a legal framework for police use of facial recognition. The ICO participated, calling for greater specificity in guidance for law enforcement. The data protection authority is also contributing guidance for businesses, government bodies and the public to help nurture trust in police use of face biometrics.

Scotland and Northern Ireland are also advancing toward more use of facial recognition by police, and the ICO says its recommendations hold for those countries as well.

Greater Manchester Police need PND policy

Overall, the ICO sees some forces have room to improve senior oversight. Police boards should have facial recognition as a standing item, according to the report, but only some do. The regulator also found that one force has a large hole in its compliance practices.

The five audits of police forces include previously published audits of police forces in South Wales and Gwent, Essex and Leicestershire. The audit of Essex’ facial recognition use followed a data protection impact assessment (DPIA) from the force showing only one false match out of 383,000 scans with its system from Corsight AI and Digital Barriers. One audit remains, of London’s Metropolitan Police, which will be conducted later this year.

The audits of West Yorkshire Police and Greater Manchester Police, published Tuesday, were conducted between June, 2025 and March, 2026. Like the previous three, they consisted of policy and procedure reviews, interviews, records inspections, technology demonstrations and a virtual review of evidence documentation.

Both forces were found to have “reasonable” assurance of compliance for live facial recognition technology.  West Yorkshire Police was also found “reasonable” in its assurance of compliance for retrospective facial recognition, but Greater Manchester Police’s was only “limited” due to a lack of policy for using the Police National Database (PND), or defined roles for using the technology.

Recommendations for all UK police forces include the development of internal audit procedures, comprehensive logging of facial recognition use and planning sufficient time to carry out DPIAs. Image quality standards should be set and used, accuracy regularly checked and bias mitigation not just put in place, but clearly stated.

The police forces collectively have accepted 93 of the recommendations fully, and have partially accepted the remaining 14.

Article Topics

biometrics  |  criminal ID  |  facial recognition  |  Information Commissioner’s Office (ICO)  |  live facial recognition  |  UK