Use of Facial Recognition Technologies

Response

In addition to the responses provided below, you may find the following information published by the Home Office to be of use:

 

Police use of facial recognition: a guide (accessible version) – GOV.UK

 

For each live facial recognition (LFR) deployment during the above period, please provide the deployment date and location together with any recorded confirmation, certification, checklist entry, audit entry or equivalent record confirming that the required post-deployment deletion of LFR data was completed.

Avon and Somerset Police has not deployed Live Facial Recognition (LFR) between 1 July 2024 and the date this request was processed.

As no LFR deployments have taken place, no information is held in relation to deployment dates, deployment locations, deletion confirmations, certifications, checklist entries, audit entries or equivalent records relating to post-deployment deletion of LFR data.

 

Please also provide the number of occasions during this period on which any of the following were retained beyond the ordinary retention period specified by force policy or applicable governance documentation:

1. biometric templates relating to individuals who did not generate an alert;
   b. probe images or biometric templates associated with an alert;
   c. candidate/watchlist images or associated biometric templates uploaded to an LFR system;
   d. data remaining on media used to import a watchlist; and
   e. CCTV footage created as part of an LFR deployment.

As no LFR deployments have taken place during the period specified, the Constabulary holds no information within the scope of this question.

 

2. Audit and assurance 

Please provide copies of any final internal audit, compliance review, assurance review or equivalent report produced since 1 July 2024 which examined compliance with facial-recognition data-retention or deletion requirements.

Avon and Somerset Police has not deployed Live Facial Recognition during the period specified.

The Constabulary is currently undertaking work to develop governance arrangements for future Live Facial Recognition capability. No final audit, compliance review, assurance review or equivalent report concerning operational compliance with facial-recognition data-retention or deletion requirements has been identified.

 

Please additionally provide:

1. the dates of any periodic audits of facial-recognition deletion/retention;
   b. the recorded outcome or conclusion of each such audit;
   c. details of any recommendations or corrective actions arising from those audits; and
   d. whether each recommendation has been recorded as completed, outstanding or otherwise closed.

No information is held.

 

Where the facial-recognition application used by the force has audit-trail functionality, please confirm what types of deletion-related audit event the system records, whether automatic deletion of non-matching biometric templates generates or can be evidenced by an audit record, and the retention period applying to those audit records.

No information is held. Avon and Somerset Police has not deployed a Live Facial Recognition capability and has not procured an operational LFR system.

 

3. Verification that deleted data cannot subsequently be recovered 

Please provide any recorded test, technical assurance, acceptance test, audit report or supplier assurance held by the force which verifies that deleted facial-recognition probe images and biometric templates are non-retrievable.

No information is held.

The Constabulary has not deployed Live Facial Recognition and has not identified any recorded test, technical assurance, acceptance test, audit report or supplier assurance falling within the scope of this request.

 

For each such assurance exercise, please provide the date, whether it was conducted internally or by an external organisation, and its recorded conclusion.

Not applicable.

 

If no independent or technical verification of non-retrievability has been undertaken or is held, please state this explicitly.

No information is held.

 

Please also state whether facial-recognition probe images or biometric templates may, before deletion, be copied or replicated into any temporary file, cache, backup, removable storage, diagnostic record or other persistent storage outside the principal facial-recognition application. If so, please provide the retention/deletion rule applicable to that copy.

No information is held.

 

4. Data-protection and information-security incidents 

Please provide the number of recorded incidents since 1 July 2024 involving:

1. failure or delay in deleting facial-recognition data;
   b. unauthorised retention of facial-recognition data;
   c. unauthorised access to facial-recognition data; or
   d. facial-recognition data remaining on equipment or storage media beyond its authorised retention period.

No incidents have been identified falling within the scope of this request.

 

For each category, please state how many incidents were assessed as personal-data breaches and how many, if any, were reported to the Information Commissioner’s Office.

None.

 

5. Retrospective and Operator Initiated Facial Recognition 

Please confirm whether the force has used either Retrospective Facial Recognition (RFR) or Operator Initiated Facial Recognition (OIFR) at any time since 1 July 2024.

The Constabulary does not use Operator Initiated Facial Recognition (OIFR).

Retrospective Facial Recognition (RFR) is available through the Police National Database (PND).

 

For each technology that has been used, please provide the current:

1. policy or operating procedure;
   b. Data Protection Impact Assessment;
   c. Appropriate Policy Document, where one exists;
   d. retention/deletion schedule applicable to probe images, biometric templates and candidate results; and
   e. any audit or assurance document addressing compliance with those deletion requirements.

Avon and Somerset Police holds the following documents within the scope of this part of your request:

• Data Protection Impact Assessment (DPIA): Assessment for the use of Retrospective Facial Recognition for the purpose of identifying individuals linked to crime and disorder;

• Data Protection Impact Assessment (DPIA): Assessment for the use of Retrospective Facial Recognition for the purpose of identifying suspects in criminal investigations.

 

Please find copies of these documents attached.

 

The following embedded comments have been removed from the first document and provided below with names redacted:

 

• Page 4 – ‘Are legal able to provide any additional information in respect of the PSED and how this processing complies with this?’

• Page 26 – ‘For [name redacted S40(2)] to provide a response please.’

• Page 27 – [name Redacted S40(2)]

 

Names and signatures within both documents have also been redacted.

 

The redacted information has been withheld under the following exemption:

 

• Section 40(2) – Personal Information

 

Section 40 is a class based, absolute exemption and there is no requirement to consider the public interest in this case. The information has been withheld as it constitutes third party personal data. Disclosure would breach the first data protection principle (lawfulness, fairness and transparency) under the Data Protection Act 2018 and UK GDPR.

 

 

Please also identify, at a high level, the reference database or databases against which such searches are conducted.

Retrospective Facial Recognition searches are conducted using images held within the Police National Database.

 

6. Appropriate Policy Documents, suppliers and third-party processing 

Please provide the current Appropriate Policy Document or equivalent governance document applying to the force’s use of LFR, RFR and/or OIFR, where held and not already provided above.

 

Avon and Somerset Police holds the following document within the scope of this question:

 

• Avon and Somerset Constabulary Appropriate Policy Document – Live Facial Recognition – Law Enforcement Processing (May 2026).

 

This information is exempt from disclosure under Section 22(1) of the Freedom of Information Act 2000. This exemption applies where information is held with a view to its future publication.

 

The document has been identified for publication and is intended to be made publicly available through Avon and Somerset Police’s publication arrangements. As such, consideration has been given to whether disclosure ahead of that planned publication date would be in the public interest.

 

Public Interest Test

Factors favouring disclosure

 

Disclosure would promote openness and transparency regarding Avon and Somerset Police’s governance arrangements for the use of Live Facial Recognition technology.

There is a recognised public interest in understanding the policies and safeguards that apply to the use of biometric technologies and law enforcement processing of personal data.

Providing the information now would allow earlier access to information which will assist public understanding of the Constabulary’s planned use of Live Facial Recognition technology.

 

Factors against disclosure

 

The document is already intended for publication and the information will therefore enter the public domain through the established publication process.

 

Prior to publication, the document remains subject to final review and approval processes and may be amended before publication. Disclosure before those processes are complete could result in inconsistencies between the version released under the Freedom of Information Act and the final published version, leading to confusion regarding the Constabulary’s current policy position.

 

At the time of this request, Avon and Somerset Police has not yet commenced operational use of Live Facial Recognition technology. As the capability is not currently live and no operational deployments have taken place, the immediate public interest in disclosure of the policy document is reduced. The policy has not yet been applied in an operational environment and therefore disclosure at this stage would provide limited additional transparency regarding actual policing activity. The public interest in understanding the governance arrangements will be met through the planned publication of the document prior to, or in conjunction with, the implementation of the capability.

 

Disclosure at this stage would also circumvent the planned publication process, which has been established to ensure that information is published accurately, consistently and with appropriate context.

Balance

 

Having considered the above factors, Avon and Somerset Police has concluded that the public interest favours maintaining the exemption.

 

Whilst there is a clear public interest in transparency concerning the governance of Live Facial Recognition technology, the capability is not yet operational within Avon and Somerset Police and no Live Facial Recognition deployments have taken place. The public interest in understanding the governance framework will be met through the planned publication of the document.

 

Given the intention to publish, the need to complete final review and approval processes, and the fact that the policy relates to a capability which is not yet in operational use, the balance of the public interest favours withholding the information under Section 22(1) at this time.

The document will be published on a dedicated page of our website that will be created to provide information relating to the use of Facial Recognition technology.

 

Please also identify the supplier(s) of the facial-recognition systems used by the force for LFR, RFR and OIFR and state, for data-protection purposes, whether each organisation acts as a processor, sub-processor, separate controller, joint controller, or has no access to police biometric data.

Avon and Somerset Police has not procured a Live Facial Recognition system.

The Constabulary has engaged with various facial-recognition suppliers to receive demonstrations of available technologies. However, no formal procurement process has been completed and no Live Facial Recognition supplier has been contracted.

The Constabulary has acquired a vehicle intended for future Live Facial Recognition capability and anticipates initially utilising South Wales Police’s Live Facial Recognition capability.

 

Please provide the portions of any contract schedule, data-processing agreement or information-sharing agreement governing supplier access to, retention of or deletion of facial-recognition data.

No information is held.

 

As Avon and Somerset Police has not procured a Live Facial Recognition system, no contract schedule, data-processing agreement or information-sharing agreement relating to a contracted Live Facial Recognition supplier is held.