Automatic facial recognition (AFR) is once again gaining space in our national press at a time when only Brexit related issues seem to get column inches. This time it has been prompted by my fellow regulator’s, the Information Commissioner, report into the police use of AFR and accompanying opinion.
These are helpful additions in relation to the data protection implications of AFR but there are a number of other statutory considerations that the police must consider if they are deploying this technology.
Legal framework
That statutory code already is a key part of the legal framework and I firmly believe that it can be updated in a way to provide robust advice to the police (and others) about use of AFR.
The recent judgement handed down in Cardiff (in relation to South Wales police use of AFR) clearly set out the Surveillance Camera Code of Practice (SC Code) and section 33 of the Protection of Freedoms Act 2012 as key elements of the legal framework for the use of AFR. Further, the court acknowledged that the guidance which I have produced to assist Chief Officers in working within the principles of the SC Code is also a key element of the framework and that I am the statutory regulator of surveillance cameras.
So, I welcome the Information Commissioner’s views in this area and know her team have done a detailed ‘deep-dive’ in to the police use of AFR in South Wales and London. It’s the culmination of over 12 months investigation.
Should we reinvent the wheel?
I read with interest the calls for a new code to help regulate the use of AFR by the police. Regular readers of my blog will know that the Home Secretary’s Surveillance Camera Code of Practice is currently being updated by the Home Office. That statutory code already is a key part of the legal framework and I firmly believe that it can be updated in a way to provide robust advice to the police (and others) about use of AFR. So, the SC Code can be that new statutory code the Commissioner calls for – it already covers AFR, other modalities and camera types and is already on the statute books. We don’t need to reinvent the wheel.
But guidance is crucial, and I intend to update the guidance I issued to police forces – the guidance referred to by the courts.
Like the Information Commissioner I would urge a degree of caution on the part of the police to regard the recent judgement as being a green light for the generic deployment of AFR.
I will do this through consultation with my fellow regulators. As the opinion from the ICO stated – “it is likely to be less challenging to justify sensitive processing as part of an LFR deployment that is…targeted, intelligence led, time limited and narrow in scope”.
This leads me to ponder that we may be entering the realm of directed surveillance which will no doubt be of interest to the new Investigatory Powers Commissioner – Sir Brian Leveson.
Like the Information Commissioner I would urge a degree of caution on the part of the police to regard the recent judgement as being a green light for the generic deployment of AFR. It was specific to the South Wales pilots. AFR is an intrusive tool with human rights and public confidence implications which have to be considered. There is however a heightened sense of confidence that in appropriate circumstances such use will be lawful but must be demonstrably conducted within the legal framework and demonstrate good governance and legitimacy of endeavour.
Joined up working
It’s a complex area with significant media and political interest here and across the globe. The use of this technology is not just a data protection issue, it’s not just a surveillance issue, it’s not just a biometrics issue and it’s not just about technical, operational and ethical standards. It is all of those and more.
We need to work together to ensure that we serve the public interest to the standards they expect, helping those who want to deploy AFR do so within a strong framework of law and guidance.
There are a number of regulators overseeing the use of AFR and we need to work together to ensure that we serve the public interest to the standards they expect, helping those who want to deploy AFR do so within a strong framework of law and guidance.
This is something that we are all committed to and I will continue to work with the police, regulators, government and others to ensure that the guidance for the public, and indeed the police, is both up to date and relevant.
This blog is republished with kind permission. The original can be viewed here
We clearly need some light to be shed on what purposes and to what extent FR is lawful. As a lay observer, it is clear that a general FR camera positioned “just to see who is around” is not an acceptable use of the technology, even though I don’t understand why this is fundamentally different from an ANPR camera monitoring “just who’s driving past”. The ANPR will review images against multiple databases, as will the FR technologies for any match found.
The police need clear guidance as to what purposes and techniques are appropriate in different use scenarios. Missing child? Prisoner on the run? Suspected burglar in the area? Potential named terrorist?
Like any tool, if used properly it can be a boon but I fear that arguments in court loom debating not whether the accused did the thing, but whether the way in which they were located is lawful. This would be the worst outcome of all.
The College of Policing provides guidance on a wide range of tools and techniques and I think this is now urgently required.
I agree with your comment and sentiment attached. I am working with Government to strengthen the Surveillance Camera Code of practice. That ought to specify the circumstances of lawful use of facial recognition ( AFR) to which you refer .
Interesting argument around the difference between AFR and ANPR. My blog references that we do not need discrete codes for each modality of surveillance. The police would struggle to comply with a growing portfolio of regulatory requirements. However, whilst processing number plates may amount to personal information, it is clear that processing biometric information will always amount to processing such information.
One last point ANPR enjoys a comprehensive suite of standards and guidance produced and overseen by NPCC and Home Office. This is exactly the position I expect to see govern AFR if its use is to be acceptable to the public.
Thanks for the comment
Use of AFR may initially benefit from the processes and procedures already in place for ANPR. But IMHO, for the next few steps, biometric data will be important. As the effectiveness of AFR increases, looking at how standards and controls were developed re Fingerprints and more recently for DNA will be beneficial and I have no doubt this work is already taking place. Ultimately however any guidance must also address the amalgamation of all forms of identity data. Not just biometric, but financial, movement, communication, medical …….. Powerful stuff !