Millions of unlawfully retained custody images could still be used for facial-recognition purposes by UK police, says biometric commissioner of England and Wales Tony Eastaugh in wider warning about the rapid expansion of surveillance tools.
In 2012, a High Court ruling found the retention of custody images in the Police National Database (PND) to be unlawful on the basis that information about unconvicted people was being treated in the same way as information about people who were ultimately convicted, and that the six-year retention period was disproportionate.
According to the latest annual report of the biometrics and surveillance camera commissioner – which covers the period from April 2023 to March 2024 – “forces continue to retain and use images of people who, while having been arrested, have never subsequently been charged or summonsed”.
It added that while work is already “underway” to ensure the retention of images is proportionate and lawful, “the use of these custody images of unconvicted individuals may include for facial-recognition purposes” .
The previous biometrics commissioner estimated in February 2023 that “there are probably several million” unlawfully held custody images in the PND.
The National Police Chief’s Council (NPCC) previously confirmed to Computer Weekly in November 2023 that a national programme between policing and the Home Office had been launched a month before to ensure consistency and co-ordination across how police retain, process and then use custody images, particularly for facial-recognition purposes.
“Custody images are one of the most valuable sources of intelligence for frontline officers and investigators, but policing needs to ensure transparency and legitimacy in the way we control the use of this important biometric information,” said a spokesperson at the time.
“Through the programme, we will agree and implement a robust management regime for custody images to ensure compliance to agreed policies and legislation. It is vital to public confidence that this programme is adopted nationally to make sure that we are holding data lawfully and ethically, both now and in the future.”
As biometrics commissioner, Eastaugh is responsible for oversight of how police collect, retain and use a range of biometric material (including digital facial images), while as surveillance camera commissioner he is tasked with encouraging police compliance with the surveillance camera code of practice.
The dual role was first held by Fraser Sampson, who was appointed in March 2021 after the Home Office announced in July 2020 that it would be amalgamating the roles to make the discrete statutory functions of each office the responsibility of a single individual.
Eastaugh was appointed to the role on a “time-limited” basis in December 2023 following Sampson’s departure to oversee the abolishment of the dual role as per the contents of the now-redundant Data Protection and Digital Information Bill, before resigning himself in August 2024. The same month, Eastaugh stepped in as interim CEO of the Police Digital Service.
The ongoing issue of custody image retention has been raised multiple times in recent years, including by Sampson and his predecessor, Paul Wiles, who called on Parliament in March 2021 to explicitly legislate on the use of biometric technologies so there is greater clarity on how police can use people’s sensitive information.
Sampson – in a February 2023 appearance before Parliament’s Joint Committee on Human Rights (JCHR) – noted that although the High Court ruled in 2012 that these images must be deleted, the Home Office (which owns most of the biometric databases used by UK police) says it can’t be done because the database they are held on has no bulk deletion capability.
Writing to other chief constables to outline some of the issues around custody image retention in February 2022, the NPCC lead for records management, Lee Freeman, also highlighted that the potentially unlawful retention of an estimated 19 million images “poses a significant risk in terms of potential litigation, police legitimacy and wider support and challenge in our use of these images for technologies such as facial recognition”.
Computer Weekly contacted the Home Office about the custody image issue and whether it is able to offer an update of the co-ordination programme with policing, but received no response by time of publication.
Aside from the unlawful retention of custody images, the annual report also highlighted accountability and trust issues around the increasing range of biometric and other surveillance tools available to UK police, particularly now that artificial intelligence (AI) can be applied to the “huge datasets” being generated by police.
“This growth in the range of biometrics, or the potential use of new biometrics, must become a focus for policy, and possibly legislative, solutions. Whilst fingerprints and DNA have the primary interest, the advances in voice patterns, odour and gait are becoming ever more sophisticated,” it said, adding that even more “conventional surveillance camera” tools like automatic number plate recognition (ANPR) are being used in ways not originally envisaged.
Sampson previously highlighted issues around mission creep in the use of ANPR in his first annual report covering the dual function, noting that it can capture a variety of non-vehicular data and monitor people’s behaviour, associations, networks and habits – not just in relation to the driver, but also of vehicle occupants too.
According to the latest annual report from Eastaugh: “These rapid technological changes in the arena of public space surveillance, biometrics and all the interconnected technologies, necessitates the need to have clearer processes and assurances that relate to the development and deployment of such technology, including clear, published and accessible policies that stakeholders, users and innovators can refer to.
“There is a need to ensure this sector has strong legal, ethical and societal frameworks in place that are robust and properly understood.”
He added that to improve trust and public confidence in how police are using these powerful surveillance technologies, “increased stakeholder engagement is vital”.
Computer Weekly contacted the Home Office about the work it is doing to ensure these frameworks are in place and that stakeholder engagement is increased, but received no response by time of publication.
There have been repeated calls from Parliament and civil society for new legal frameworks to govern law enforcement’s use of facial-recogntion technology. These include three separate inquiries by the Lords Justice and Home Affairs Committee (JHAC) into shoplifting, police algorithms and police facial recognition; an independent legal review by Matthew Ryder QC; the UK’s Equalities and Human Rights Commission; and the House of Commons Science and Technology Committee, which called for a moratorium on LFR as far back as July 2019.
However, the Home Office and policing bodies have repeatedly maintained there is already a “comprehensive legal framework” in place, which consists of the Police and Criminal Evidence Act (PACE) 1984; the Data Protection Act 2018; the Protection of Freedoms Act 2012; the Equality Act 2010; the Investigatory Powers Act 2000; the Human Rights Act 1998; and common law powers to prevent and detect crime.
