Why biometrics are an urgent agenda item for police oversight boards

By Professor Fraser Sampson, former UK Biometrics & Surveillance Camera Commissioner

The more that the police can do with biometric technology, the more they will need to assure us what they’re not doing with it. This will require public trust, which must itself be earned through strong data governance. And that’s basically the title of the latest blog by the UK’s data regulator summing up its findings on the police use of facial recognition technology (FRT).

Based on reviews of policy and practice in several police forces, the report identifies matters which the regulator says require urgent attention. They include:

• making sure there is clear senior oversight, accountability and training for staff using FRT and that they understand their roles and responsibilities;
• keeping clear records of what personal information is being used, where it comes from, how it is used and who it is shared with;
• making sure images used for retrospective facial recognition (RFR) are obtained from appropriate sources and not kept for longer than necessary and
• checking that facial recognition systems are accurate, with appropriate steps to reduce the risk of unfairness or bias.

If this list seems familiar, it should. In many respects it’s a rehearsal of things that are already a legal requirement under the relevant legislation. But the key governance takeaway is for oversight boards – and in particular the urgent need to get AI-enabled biometrics as a standing item on their agendas.

Biometric information is special category personal data: at strategic level, all organisations controlling and processing it should treat it like they treat their money. They should know how much they hold; where it is, where it came from and who’s accessing it. In the environment of policing and law enforcement, that need is amplified because of their extraordinary powers to capture, retain and use our most sensitive data and the consequences for us when they do so.

Accountability is about people with power using it properly; in policing, advanced technology must come with advanced accountability. However, the regulator points out that, where they might have expected to see FRT as a standing item for relevant accountability boards and meetings, this was not always the case. The ICO found one force lacking a policy framework for accessing Police National Database (PND) images and how they used the database for RFR, indicating “insufficient oversight”. It also found other forces that couldn’t “fully account for risks to personal rights and information”, issues with the timely ‘weeding’ of data to ensure compliance with national Management of Police Information (MoPI) requirements and an ‘urgent need to press ahead’ with plans for the review, retention and disposal of legacy records.

Remarkably, it found a force still keeping custody images of people without conviction or charge beyond the proper retention period. When the High Court gave the Metropolitan Police a ‘reasonable’ period in which to revise its policy on retaining custody images, the judge cautioned that the period must be measured in ‘months rather than years’. Using that judicial metric, it was 170 months ago. The force reviewed by the recent ICO review was not the Met (who have made significant progress in their use of FRT), but the finding is policing’s collective problem. Trust in the police is not geographically defined or even systemically distributed – it’s organic. Compromising part of the organism means compromising the whole.

This is familiar territory. As Biometrics and Surveillance Camera Commissioner I was called before the Joint Committee on Human Rights and asked whether, in my visits to police forces, I had found a ‘culture of retention’ of biometrics. What I found was a culture of non-deletion which of course is the same thing legally but culturally was seen as different – and, to reprise the apocryphal Druckerism, culture still eats strategy for breakfast.

With a ‘common theme’ in the regulator’s findings being a lack of review of personal information held, the report emphasises transparency, accountability and public trust when using new technologies, particularly biometric data used to identify people. The ICO report highlights the need to follow retention schedules and ensure effective training for data protection compliance in FRT, underscoring the importance of strong governance structures.

For those who fear over-regulation, it’s worth noting that the international legal framework governing data protection has been shaped less by forward thinking policy and more by dogged litigation. The data protection landscape in Europe is where the citizen fought the law and the law lost. Some argue for greater latitude in deploying the technology but constant legal challenges are unlikely to engender public trust and confidence in the police use of it, irrespective of who ‘wins’.

The content of the report supplies the narrative, but the tone and approach are also telling. With loud voices continually calling for bans while policing decries the unfairness of a technologically charged society weighted against them, effective regulation must find the balance, both enforcing and enabling. The report is pitched in that way.

As the government puts AI-enabled technologies at the heart of its reforms, and with plans for a nationwide roll out of FRT across UK policing, effective accountability is sectoral. Having committed to proportionate, risk-based regulation, promoting economic growth while protecting individual rights, the government has made building public trust and confidence in the police use of biometric technology a pan-UK issue.

To me, this is not a report on the police use of technology – it’s an audit of police governance. Balancing their growing operational importance with an urgent need for public assurance, AI-enabled biometrics must be governed by clear systems, consistent processes and coherent policies – not just in policing but in every organisation using the technology. What this will need most of all is accountability, which is the principal function of the board. That’s why AI-enabled biometrics should be a standing item for all police oversight bodies.

About the author

Professor Fraser Sampson is the former UK Biometrics and Surveillance Camera Commissioner, Professor of Governance and National Security at CENTRIC, non-executive director at Facewatch, strategic advisor to the Alan Turing Institute’s Centre for Emerging Technology and Security (CETaS), and a longtime Biometric Update columnist. He is also the author of the Springer Nature book How AI-Driven Surveillance is Changing our World: Do Robots Have the Right to Remain Silent?, which explores the legal, ethical and societal implications of AI-driven surveillance.

Article Topics

biometrics  |  facial recognition  |  Fraser Sampson  |  law enforcement  |  live facial recognition  |  regulation