Court says use of facial recognition by South Wales Police lawful

Share This Post

A case brought by an individual, who argued his human right to privacy had been breached along with data protection law, by South Wales Police use of automated facial recognition, has been thrown out by the High Court stating that the Police had followed the rules and their use of facial recognition technology was lawful.

From a data protection perspective, whilst it was agreed that personal data was being processed, the police had acted in a lawful manner and as set out in the legislation. Essentially the GDPR angle is whether it is lawful for the police to use the technology and process it against a database of “known” individuals to spot potential “suspects”, where the images and the video footage would be personal data. Plus, as the cameras create a biometric profile of “faces in the crowd” for comparison with other information, the police will be processing special category data.

When processing biometric (for identification purposes) and other special category data the GDPR requires:

  • A lawful basis for processing applies, plus
  • A lawful condition for processing special category data

The case against South Wales Police were arguing that as well as the intrusive nature of the surveillance the subsequent processing of personal data was being done so without knowledge or consent by the individuals. However, the police do have powers in data protection law to process data in the public interest plus the Data Protection Act 2018 allows them to do so when it involves “The prevention, investigation detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”.

The ICO, who are currently investigating the use of the technology by police forces, issued a statement:

“We will be reviewing the judgment carefully. We welcome the court’s finding that the police use of Live Facial Recognition (LFR) systems involves the processing of sensitive personal data of members of the public, requiring compliance with the Data Protection Act 2018. This new and intrusive technology has the potential, if used without the right privacy safeguards, to undermine rather than enhance confidence in the police.

“Our investigation into the first police pilots of this technology has recently finished. We will now consider the court’s findings in finalising our recommendations and guidance to police forces about how to plan, authorise and deploy any future LFR systems.

“In the meantime, any police forces or private organisations using these systems should be aware that existing data protection law and guidance still apply.”

So, we can expect more to come on this issue, not least of all if Mr Bridges (who brought the case with Liberty) appeals.

More To Explore


The key message from the ICO regarding the use of AI is not to forget if AI is processing personal data, then you need to

Read More »

Eat. Sleep. GDPR. Repeat.

We live and breathe GDPR and ePrivacy compliance, so you don’t have too. Our GDPR UNLIMITED helpline is all about offering you help and support, whenever you need it most. As well as the unlimited helpline, you get up to 4 hours “hands-on” help each month, which we can configure to help you in anyway you need such as a GDPR review, or acting as your DPO.

As well as the unlimited helpline and hands-on help you get GDPR and privacy updates, access to our GDPR knowledge centre and webinars.

Unlimited email & phone support

Unlimited email and phone support. Email or organise a voice call as often as you need each month.​

Up to 4 hours "hands-on" help per month

We use these "hands-on" hours to do the GDPR work for you, such as reviews, acting as your DPO, checking DPIA, dealing with breaches, training your staff, etc. (Additional hours: £100+VAT per hour)

Online resources

Our Knowledge Centre gives you access to information, guidance, topic related guides and other tools to support your GDPR and PECR compliance

Updates, alerts & briefings

We provide updates and alerts and a monthly compliance briefing. You can either sign into the Knowledge Centre or sign up via email to receive an email every time we add a new update or alert

DPO services

Whether mandated or not we can act as your Data Protection Officer (DPO) and manage your day to day compliance

Webinars, workshops & training

Whether updates on the latest issue, workshops or team training, it's all included in your monthly retainer.

LIKE WHAT YOU'RE READING? join our email list

Sign up for monthly briefings and the occasional emails about our webinars and services

Want to know more about how we use your data? Check out our privacy policy