Information Commissioner issues first ‘Opinion’ under Data Protection Act
The Information Commissioner, Elizabeth Denham, has issued her first Commissioner’s Opinion under the Data Protection Act 2018, setting out her advice and recommendations on the police’s use of ‘live facial recognition’ (LFR).
Writing on the watchdog’s blog, Denham said: “LFR is a step change in policing techniques; never before have we seen technologies with the potential for such widespread invasiveness.”
She said the results of the ICO’s investigation into the trials of LFR by the Metropolitan Police Service and South Wales Police had raised “serious concerns about the use of a technology that relies on huge amounts of sensitive personal information”.
Ms Denham said: “We found that the current combination of laws, codes and practices relating to LFR will not drive the ethical and legal approach that’s needed to truly manage the risk that this technology presents.
“The absence of a statutory code that speaks to the specific challenges posed by LFR will increase the likelihood of legal failures and undermine public confidence in its use. As a result, the key recommendation arising from the ICO’s investigation is to call for government to introduce a statutory and binding code of practice on the deployment of LFR.”
The Information Commissioner said this was necessary in order to give the police and the public enough knowledge as to when and how the police can use LFR systems in public spaces.
The watchdog is to liaise with the Home Office, the Investigatory Powers Commissioner, the Biometrics Commissioner, the Surveillance Camera Commissioner and policing bodies on how to progress its recommendation for a statutory code of practice.
The ICO has also recommended that more work should be done by a range of agencies and organisations including the police, government and developers of LFR technology to eliminate bias in the algorithms; particularly that associated with ethnicity.
“This will help and maintain public confidence and cross-community support,” Denham said.
The fact that these recommendations, taken together, had such far-reaching applications for law enforcement in the UK led Ms Denham to issue the first 'Commissioner’s Opinion' under the DPA 2018.
Ms Denham said: “That Opinion makes clear that there are well-defined data protection rules which police forces need to follow before and during deployment of LFR. The Opinion recognises the high statutory threshold that must be met to justify the use of LFR, and demonstrate accountability, under the UK’s data protection law. That threshold is appropriate considering the potential invasiveness of this technology.”
The Opinion also sets out the practical steps police forces must take to demonstrate legal compliance.
The Information Commissioner said the Opinion was significant because it brought together the findings from the ICO’s investigation, the current landscape in which the police operate, and the recent judgment from the High Court in R (Bridges) v The Chief Constable of South Wales, in which a member of the public had concerns that his image may have been captured on LFR from a police van while he was out shopping in Cardiff city centre. The High Court judged that in these instances, South Wales Police had used LFR lawfully.
“However the SWP case was a judgment on specific examples of LFR deployment,” Ms Denham noted, adding that it was her view that the High Court judgment should not be seen as a blanket authorisation for police forces to use LFR systems in all circumstances.
She said: “When LFR is used, my Opinion should be followed. My Opinion recognises there is a balance to be struck between the privacy that people rightly expect when going about their daily lives and the surveillance technology that the police need to effectively carry out their role.
“Therefore it makes clear that police forces must provide demonstrably sound evidence to show that LFR technology is strictly necessary, balanced and effective in each specific context in which it is deployed.”
The ICO is meanwhile investigating the private sector's operation of the technology in a quasi-law enforcement capacity, a practice that Ms Denham said had less public support. The watchdog will issue a report on its findings “in due course”.
The Information Commissioner said: “From a regulator’s perspective, I must ensure that everyone working in this developing area stops to take a breath and works to satisfy the full rigour of UK data protection law.
“Moving too quickly to deploy technologies that can be overly invasive in people’s lawful daily lives risks damaging trust not only in the technology, but in the fundamental model of policing by consent. We must all work together to protect and enhance that consensus.”
