Live facial recognition cameras: what the law actually says

Live facial recognition (LFR) systems, such as the “AFR Locate” deployment examined by the Court of Appeal, work by scanning faces from CCTV footage in real time and comparing them against a watchlist compiled for that deployment. The leading case describes it plainly: cameras capture images of members of the public, which are then processed and compared against a watchlist.

Everyone whose face passes the camera gets scanned — not just people the police are looking for. Most matches are deleted quickly if there is no hit against the watchlist, but the scanning itself is not targeted at you individually.

The Court of Appeal in R (Bridges) v Chief Constable of South Wales Police found that using cameras to capture and match faces against a watchlist falls within the existing common law powers of the police to obtain and store information for policing purposes — it did not need a brand-new law to exist at all.

What the court found unlawful was how South Wales Police had used it on the facts of that case: gaps in its data protection impact assessment and a failure to properly consider equality impacts, particularly the risk of racial and gender bias in the software. LFR itself was not banned — the deployment failed on process, not on the basic legality of the technology.

There is no general offence of walking past an LFR camera, being scanned by one, or being caught on one deliberately or otherwise. There is also no general power for an officer to stop you and demand you show your face to a camera, or to accuse you of an offence for looking away, wearing sunglasses, or otherwise not co-operating with a deployment you have not been individually stopped over.

That changes only if a specific, separate power is switched on.

There are two separate ways a s.60AA authorisation can be in force, and either is enough. One rides on the back of a s.60 CJPOA 1994 authorisation for suspicionless stop and search: while that is running for a place and period, the s.60AA face-covering power runs alongside it automatically. The other is standalone — an officer of at least the rank of inspector can give a s.60AA authorisation in its own right, with no s.60 authorisation needed, for up to twenty-four hours, where they reasonably believe both that activities likely to involve the commission of offences may take place in a locality in their police area and that an authorisation is expedient in order to prevent or control them. Either way, a uniformed constable can then require you to remove an item you are wearing wholly or mainly to conceal your identity. This is a face-covering power, not an LFR power specifically, but it is the provision most likely to be invoked around a facial recognition deployment.

Refusing to remove the item when validly required under either kind of authorisation is a criminal offence, carrying up to a month’s imprisonment or a fine. Outside a live authorisation, no such requirement exists — so it is worth asking, directly, which authorisation is in force. If a requirement is made under either route, failing to remove the item is an offence.