Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what assessment he has made of the potential effect of deploying live facial recognition technology in public spaces on data protection and privacy.

The use of live facial recognition technology in public spaces by the police or non-law enforcement bodies must be lawful under the data protection legislation. The legislation recognises that biometric data such as facial images are sensitive in nature and are therefore subject to heightened safeguards. Processing by the police without the consent of individuals must be based on law and strictly necessary for a law enforcement purpose under Part 3 of the Data Protection Act 2018. Non-law enforcement bodies will generally need to show that processing without consent is necessary on grounds of substantial public interest under Article 9 of the UK GDPR, as supplemented by the conditions and safeguards in Schedule 1 to the Data Protection Act 2018.

The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and is responsible for providing advice and guidance on compliance with the UK’s data protection laws. The Commissioner published an Opinion on the police’s use of the technology on 31 October 2019. On 18 June 2020, the Information Commissioner published a second Opinion on the use of live facial recognition technology in public spaces. This can be found at: https://ico.org.uk/media/for-organisations/documents/2619985/ico-opinion-the-use-of-lfr-in-public-places-20210618.pdf. The Opinions explain the requirements of the legislation and stress that data protection and people’s privacy must be at the heart of any decisions to deploy live facial recognition technology in public spaces.