TL;DR
The Information Commissioner’s Office has completed audits of five police forces using facial recognition, issuing 107 recommendations that were accepted in full or in part. Retrospective image searching scored worse on compliance than the live van deployments that attract most public attention. An audit of the Metropolitan Police follows later this year.
A mixed picture across five forces
The regulator began examining police use of the technology in 2025, when van-based deployment was spreading beyond the two forces that had pioneered it to forces with no prior experience of running it in public. Executive summaries for West Yorkshire and Greater Manchester were published this week, joining earlier ones covering Essex, Leicestershire, and South Wales and Gwent.
The ICO found forces generally had a documented lawful basis, avoided collecting more data than a deployment required, and had breach procedures in place. Against that, it flagged four areas needing urgent attention: senior accountability and staff training, record-keeping on where personal information comes from and who it goes to, the sourcing and retention of images used in retrospective searches, and testing systems for accuracy and bias.
The gap between the two techniques is the finding worth dwelling on. Live deployments — the vans, the signage, the local press coverage — scored better than retrospective facial recognition, where an officer runs an existing image against a database after the fact. That is the less visible half of the technology and the half attracting less scrutiny.
The algorithm nobody has replaced yet
Testing by the National Physical Laboratory in 2025 identified bias in the algorithm used for retrospective searches on the Police National Database, raising the odds of a false match for some demographic groups. The Home Office and the NPCC — the National Police Chiefs’ Council — put mitigations in place: equality impact assessments, reporting up the command chain, and training for the officers running searches. They also committed to swapping the algorithm out. That replacement has not happened. The ICO says it is tracking cases where someone suffered as a result of a wrong match, and has reserved the option of formal regulatory action.
Looking forward
The recommendations are addressed to every force using the technology, not only the five that agreed to be audited, and the ICO is working through the NPCC to spread them. The legal framework underneath remains unsettled: the government is still weighing new rules for law enforcement biometrics in England and Wales, Police Scotland is consulting on whether to adopt live deployment at all, and Northern Ireland’s Justice Bill is being drafted separately. Two days earlier, Sainsbury’s suspended its own facial recognition after a second misidentification — a reminder that the accuracy problem is not confined to policing, and that the private sector faces no equivalent audit programme.