The UK's data protection regulator has told police forces using live facial recognition technology to strengthen their data governance after audits revealed widespread compliance gaps. The Information Commissioner's Office (ICO) announced on August 18 that while some good practices exist, substantial improvements remain necessary as more forces deploy the technology despite lacking prior experience with public-space facial recognition. Deputy Commissioner Emily Keaney noted that some agencies are even testing operator-initiated facial recognition, where officers stop suspects on the street to check them against watchlists.
The ICO's audits of five police forces across England and Wales uncovered uneven data protection compliance, with performance stronger for live facial recognition than for retrospective facial recognition systems. The regulator identified four urgent improvement areas: establishing senior oversight, accountability and staff training for facial recognition technology; maintaining clear records documenting what personal data is used, its sources, its applications, and who receives it; confirming retrospective facial recognition images come from appropriate sources and aren't retained beyond necessity; and verifying system accuracy while taking steps to minimize unfairness or bias. The accuracy concern gained prominence after a December 2025 Home Office report exposed racial bias in police retrospective facial recognition systems, finding that under certain limited conditions the algorithm more frequently misidentifies some demographic groups in search results.
According to Keaney's statement, live facial recognition offers clear benefits for law enforcement in crime prevention and detection, but its deployment carries significant risks. "A false match can have serious consequences for people, including wrongful intervention, accusation or arrest," she said. The ICO recommends that all police forces in England and Wales apply its audit findings to enhance their data protection governance. When the Home Office bias report emerged, Keaney stated the watchdog needed urgent clarity to evaluate the situation and determine next steps.
The stakes are high because facial recognition's viability as a policing tool depends on strong data protection governance that builds public confidence, the ICO argues. The regulator reported that police forces show willingness to engage and implement changes based on audit recommendations, even as rights organizations periodically demand stronger legislative protections before widespread police use of the technology. The EU AI Act now largely bans live facial recognition use by police in public spaces, creating a divergent regulatory landscape. For UK forces expanding these capabilities amid scrutiny, meeting data protection standards isn't optional—it's the foundation for maintaining operational legitimacy and avoiding the compliance crackdowns and public backlash that inevitably follow when surveillance technology outpaces safeguards. Whether voluntary improvements will satisfy both regulators and civil liberties advocates remains the critical test ahead.