ICO Emphasises Strong Data Protection Governance for Facial Recognition in Policing

The Information Commissioner's Office (ICO) on 18 August 2026 published a blog post detailing its 2025 examination of police use of facial recognition technology (FRT) in England and Wales. This examination revealed inconsistencies in data protection compliance across five audited police forces, despite general adherence to lawful basis identification and breach reporting for live facial recognition (LFR) deployments.

The ICO's 2025 examination of police use of facial recognition technology (FRT) in England and Wales found significant changes in deployment, including rapid expansion of live facial recognition (LFR) to forces without prior experience. Research published last year showed public support for FRT is conditional on accuracy, lack of bias, respect for privacy, and clear societal benefit. These findings reinforce the necessity of robust governance, which the ICO states is not optional.

Over the past year, the ICO proactively audited five police forces, with the Metropolitan Police Service audit scheduled for later this year. The audits revealed inconsistencies in data protection compliance, though forces generally had a lawful basis identified and documented for LFR deployments and had breach reporting procedures in place. Compliance rates were generally higher for LFR compared to retrospective facial recognition (RFR). Areas requiring urgent attention include ensuring clear senior oversight, accountability, and training for staff, maintaining clear records of personal information use, ensuring appropriate sources and retention limits for RFR images, and checking system accuracy to reduce bias risks. The audited forces engaged constructively and committed to addressing identified issues, submitting action plans. The ICO is working with the National Police Chiefs’ Council (NPCC) to drive consistent improvement across all forces and will share findings with Police Scotland and the Police Service of Northern Ireland (PSNI).

In 2025, bias in the algorithm used by UK police forces for facial recognition searches within the Police National Database was reported, following testing by the National Physics Lab. The ICO raised concerns with the Home Office and NPCC, who have put mitigations in place including staff training, oversight reporting, and equality impact assessments, alongside plans to replace the algorithm. The ICO continues to monitor cases of detriment and engage with relevant bodies, reserving the right to take further regulatory action if warranted.