“There are clear arguments that live facial recognition can assist law enforcement agencies in preventing and detecting crime,” Emily Keaney, deputy commissioner for regulatory policy at the Information Commissioner’s Office (ICO), wrote on August 18 — and then she immediately framed the other side of the ledger: the technology’s risks and the governance gaps that could turn a policing tool into a privacy and rights problem.
ICO audit findings across five police forces
The ICO has audited several police forces’ use of facial recognition technology and reported that compliance with data protection law is inconsistent. The watchdog said compliance rates were higher for live facial recognition (LFR) than for retrospective facial recognition (RFR), but that “significant improvements are still needed.” The audits covered five forces; while the ICO found some examples of good practice, it concluded that the forces should use the audit findings to improve their data protection governance.
Governance shortfalls the ICO flagged
The ICO highlighted a set of concrete, recurring weaknesses. These included gaps in senior oversight, accountability and training for staff operating facial recognition systems; weak record keeping about what personal information is used, where it came from, how it is processed and with whom it is shared; failures to ensure RFR images are obtained from “appropriate sources” and not retained longer than necessary; and inadequate checks on system accuracy and steps to reduce unfairness or bias.
The watchdog further warned that a false match can have serious consequences for people, “including wrongful intervention, accusation or arrest,” language it used to underline the human stakes behind what otherwise might read as technical compliance items.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHome Office December 2025 report on RFR racial bias
The ICO’s concern about bias is grounded in an earlier Home Office report published in December 2025 which found that, “in a limited set of circumstances the algorithm is more likely to incorrectly include some demographic groups in its search results.” Keaney said at the time that the ICO required “urgent clarity on this matter so we can assess the situation and consider our next steps.” The audit findings reinforce that accuracy and bias mitigation are not abstract requirements but urgent compliance priorities.
Police engagement, public trust and rights groups’ demands
The ICO said on August 18 that police forces are “willing to engage and make changes” in response to the audits. For the ICO, strong data protection governance is essential to fostering the public trust needed for facial recognition technology to be used as a policing tool.
At the same time, rights groups have periodically called for stronger legislative safeguards before widespready use of the technology by police — a demand the ICO’s governance-focused recommendations implicitly supports. The article also notes that LFR use by police in public spaces is largely prohibited by the EU AI Act, a regulatory constraint that frames the broader legal environment in which the ICO’s recommendations sit.
What this means for police forces, rights groups, and the public
- Police forces across England and Wales: The ICO recommends they draw directly on the audit findings to strengthen governance — establishing senior oversight, improving record keeping, validating sources for RFR images, instituting retention limits and testing systems for accuracy and bias.
- Rights groups calling for safeguards: The ICO’s audits and reminders about algorithmic bias give these groups documented leverage to press for stronger legislative protections and greater transparency about how watchlists and matching processes are built and used.
- The general public and individuals stopped or identified: The ICO’s warnings about false matches and the Home Office finding of demographic disparities point to the concrete risk that some people could face wrongful intervention, accusation or arrest unless systems and procedures change.
The ICO’s message is straightforward: LFR may help prevent and detect crime, but it cannot be deployed at scale without the governance that ensures lawfulness, proportionality and fairness. The watchdog has delivered audit findings and urged police to act; the remaining question, spelled out in the audits themselves, is how rapidly and rigorously forces will translate those recommendations into senior oversight, tighter records, source controls, retention policies and demonstrable bias mitigation.
