Police facial recognition audits expose compliance gaps

ICO audits of five police forces in England and Wales identified significant data protection weaknesses in live and retrospective facial recognition. Published in August 2026, the findings covered nine assessments: three received high assurance ratings, five reasonable assurance and one limited assurance. One force had paused live deployments over concerns about inaccuracy and bias. More than half of the ICO’s 107 recommendations were classified as urgent or high priority.

The recommendations address leadership accountability, staff training, lawful processing, impact assessments, data retention, security, accuracy, bias and individual rights. Forces are expected to maintain current processing records, assess risks before deployment and explain how personal information will be used. The ICO said its findings should guide all UK police forces using facial recognition and warned that future contraventions could trigger regulatory action. Despite longstanding concerns and successful legal challenges, the relevant regulators have not taken formal enforcement action against UK police over facial recognition use.

The Home Office is considering a framework within the forthcoming Police Reform Bill to govern law enforcement use of biometrics and related technologies, potentially overseen by a new regulator with stronger compliance powers. The Bill is understood to be delayed until at least January 2027, with Royal Assent potentially not achieved before early 2028. Handley Gill recommends that organisations deploying facial recognition conduct compliance audits and prepare remediation plans rather than wait for legislation.