Question to the Department for Science, Innovation & Technology:

To ask His Majesty's Government, further to the Written Answer by Baroness Lloyd of Effra on 20 March (HL15283), what plans they have to further develop a legislative framework for the use of facial recognition software by private companies in the light of the increasing use of AI.

The Government has no current plans to introduce a standalone legislative framework governing the use of facial recognition technology (FRT) by private companies. However, a recent consultation by the Home Office on a new legal framework for law enforcement use of biometrics and facial recognition will consider the relevance of any new developments in that area to wider public and private sector use of FRT. The consultation closed on 12 February, and responses are being analysed.

As noted in our previous correspondence, the use of FRT is already governed by a robust legal framework, including the UK GDPR and the Data Protection Act 2018. Under this framework, organisations must process data lawfully, fairly and transparently, and ensure its use is necessary and proportionate. Where used for identification, FRT involves biometric data, which is classified as special category personal data and is subject to stricter legal safeguards. Organisations must also carry out data protection impact assessments where use of such technologies is likely to pose high risks to individuals’ rights and freedoms.

The Government recognises that the use of artificial intelligence, including in FRT, continues to evolve. It therefore keeps the existing legislative framework under review, working closely with the Information Commissioner’s Office.