Facial Recognition technology in the UK: GDPR, privacy risks and compliance requirements
Table of Contents
What is Facial Recognition Technology (FRT)?
Facial recognition technology (FRT) is a type of biometric technology that uses unique facial characteristics to identify or verify an individual. It works by analysing features of a person’s face, such as the distance between the eyes, the shape of the nose and the contours of the jawline, and converting them into a digital template that can be compared against other images held within a database.
While it can improve security and efficiency, its use also raises important questions around privacy, data protection, accuracy and human rights. As the use of facial recognition technology continues to grow across both the public and private sectors, organisations must carefully consider the legal, ethical and practical implications of its deployment.
In this blog, we explain how facial recognition technology works, why it is subject to strict data protection requirements under the UK GDPR, and the key privacy, security and discrimination risks associated with its use. We also examine recent guidance and activity from the Information Commissioner’s Office (ICO) and outline the steps organisations should take to use facial recognition technology lawfully and responsibly.
The use of Facial Recognition Technology in the UK
Facial Recognition Technology (“FRT”) is now being used in a variety of settings and for multiple purposes, including security and access control for buildings, unlocking mobile devices, law enforcement and detecting emotions, to name but a few. Supporters of this technology highlight how helpful it can be in cases such as where it can prevent unauthorised access to private premises, ensure devices are not misused, locate criminals and stop lorry drivers falling asleep at the wheel.
However, whilst it is widely accepted how beneficial FRT can be for individuals and for society as a whole, it does not come without its challenges. For example, we’ve seen headline-grabbing stories in the press that tell of incidents whereby individuals have been wrongly identified as wanted criminals because FRT generated a false positive.
Such grave mistakes by FRT can, potentially, have catastrophic consequences for the affected individuals. Indeed, in the given example, they could be falsely arrested and imprisoned if the mistake is not promptly rectified by human intervention.
As such, the risks to privacy and human rights must be addressed thoroughly before deploying FRT.
How does FRT work?
To fully understand the data protection implications of FRT, we first need to understand how it works. FRT operates by:
- Capturing an image of someone’s face;
- Using artificial intelligence (“AI”) to convert the image into a digital map of that person’s face (by analysing and recording measurements of the face);
- Comparing the digital map to images within a database; and
- Identifying a match between the digital map and an image in the database.
Is FRT personal data?
The above process involves processing “biometric data for the purposes of uniquely identifying a natural person”, which means that, for data protection purposes and the UK GDPR, the data is classed as special category personal data. For information on using biometric data in the workplace, see our blog Biometric Data In The Workplace. As a result, extra rules need to be followed in order to comply with the law. In particular:
- A lawful basis under Article 6 of the UK GDPR needs to be identified;
- A condition under Article 9 of the UK GDPR needs to be satisfied; and
- In some circumstances, a condition under the Data Protection Act 2018 (“DPA 2018”) also needs to be satisfied.
In view of the above and other issues, using FRT can be a complex task.
What are the privacy risks with Facial Recognition Technology?
Surveillance and loss of privacy
FRT is often used in public places, such as by the police at public events or by organisers of music festivals. As a result, FRT collects large amounts of data about individuals without their consent. The data may also be collected without their knowledge if the controllers deploying it have not informed the people concerned individually, or erected signage notifying them that FRT is in use.
Arguably, this is akin to mass surveillance, with huge numbers of individuals losing their right to privacy and having no choice or control over the data that is collected about them. The images can also infer other characteristics such as age, gender and ethnicity.
Impact on civil liberties
Civil rights activists also argue that the use of FRT has a “chilling effect”, meaning that it can deter people from exercising their rights and freedoms. For example, people may refrain from expressing themselves, such as participating in public protests and moving around freely in public places.
Accuracy, bias and discrimination risks
It is vital that the FRT produces accurate results, but how accurately someone is identified can depend on multiple factors, including:
- The quality of the images used
- The lighting of the images
- Pixelation of the images
- Whether parts of the person’s face are obstructed, such as with sunglasses or a scarf
- How strict the FRT’s matching process is
Therefore, if the quality, lighting or pixelation of the image is poor or if the individual has part of their face obstructed or the FRT’s matching process is not sufficiently strict, the FRT could produce multiple false positives or false negatives, such that it may not be fit for purpose.
Training data bias
In addition to the above basic considerations, the accuracy of the FRT would depend on how it has been trained. For example, if it has been trained using the images of white males primarily, it may be successful in accurately identifying people in this sector. However, it may be poor at identifying women and black people, and, as a result, the problem with false positives and false negatives will arise. Consequently, any bias in the training data can lead to discrimination when the FRT is deployed.
ICO guidance on AI bias
The issue of discrimination and bias arising in AI systems is generally explained within the ICO’s Toolkit on Artificial Intelligence. The ICO explain that this can arise as a result of several reasons, including that the training data was insufficiently diverse and that this can result in individuals being adversely affected as a result. Discrimination and Bias | ICO
Security risks – deepfakes, identity theft and fraud
Because the data collected using FRT is very sensitive, this can give rise to high risks in the event of a breach of security, such that the data falls into the wrong hands. For example, stolen biometric data can be misused by criminals who may create deep fakes and use them for identity theft and/or fraud.
The difficulty is that this data cannot be changed like a password, passport number or driving licence number and, as such, the security measures used to protect it need to be robust.
Guidance from the Information Commissioner’s Office (“ICO”)
In order to assist organisations wishing to deploy FRT in public spaces, the ICO issued an official opinion on the subject matter back in 2021, followed, more recently, by guidance and a checklist on Facial Recognition Technology (FRT) and surveillance | ICO. Whilst this guidance is presently under review and may be amended to take account of the provisions within the Data (Use and Access) Act it is, nevertheless, still a useful resource which organisations may wish to refer to with a view to satisfying the regulator’s expectations when deploying FRT.
ICO AI and biometrics strategy
Bearing in mind that FRT is a form of AI which processes biometric data, the ICO’s AI and biometrics strategy is also relevant here. Preventing harm, promoting trust: our AI and biometrics strategy | ICO In this strategy, the ICO highlights that, according to research:
- “54% of adults have some concerns that facial recognition technology would impact civil liberties and infringe on people’s right to privacy.
- In recruitment, 64% believe employers will rely too heavily on AI, and 61% are concerned it will perform worse than human decision-makers when assessing individual circumstances.
- In public services, concern about the use of AI to determine welfare eligibility has risen from 44% in 2022/23 to 59% in 2024/25.”
The above indicates that a significant percentage of the individuals surveyed have concerns about the use of FRT and AI and how it may impact them in relation to important matters such as civil liberties, the right to privacy, recruitment and welfare eligibility.
In view of this, the ICO states that it plans to empower organisations to use these tools in accordance with data protection law by:
- Publishing an AI statutory code of practice
- Ensuring the public has confidence in generative AI foundation models
- Ensuring that automated decision-making systems are used and governed fairly
- Ensuring fair and proportionate use of FRT
Consequently, the actions listed, once completed, may help alleviate the above-mentioned concerns.
ICO’s actions – recent ICO audits of UK police forces
As part of its strategy, the ICO is in the process of conducting a series of audits on the use of FRT by police forces across England and Wales. In August 2025, the ICO completed this task in relation to South Wales and Gwent Police and stated that it is “encouraged by the findings”, as they indicate that these two forces “provide a high level of assurance” that their “processes and procedures are compliant with data protection law.”
The ICO have also conducted audits on two further police forces, namely Essex Police and Leicestershire Police and in both cases, the ICO indicated that they found areas of good practice and areas for improvement.
The report for Essex Police was published in November 2025, but, interestingly, Essex police decided to pause their use of live FRT before the ICO’s audit, having identified risks of inaccuracy and bias, and the ICO indicated that they are continuing to work with the force to address these issues.
The report for Leicestershire Police was published in March 2026. However, this report relates to their use of retrospective facial recognition (where images are compared to an existing database), rather than live FRT. Nevertheless, whether the FRT is live or retrospective, the risks need to be assessed and addressed to ensure data protection compliance.
The ICO will also be assessing the use of FRT by the Metropolitan Police, and we will await the outcome.
Therefore, for those concerned about the use of FRT by the police, the ICO’s audits may, perhaps, offer some reassurance. In terms of audits relating to the use of FRT in public places by other controllers such as local councils, retailers and private organisations, we will wait to hear if the ICO intends to extend its audit process to incorporate these sectors as well.
Is Facial Recognition Technology legal in the UK?
FRT is not prohibited in the UK and can be used, provided appropriate safeguards are implemented and the UK GDPR is adhered to, ensuring that the use of the tool is lawful.
In particular, a detailed Data Protection Impact Assessment would need to be carried out, which would ensure that the risks are clearly identified and appropriately addressed before the system goes live.
As part of this exercise, it would need to be explained which lawful basis is applicable, as well as which additional conditions are to be relied upon under the Data Protection Act and Article 9 of the UK GDPR. Bearing in mind that the processing activity carried out by FRT amounts to the processing of special category personal data.
Also, of particular importance is that it would need to be carefully explained in the DPIA how the use of FRT is necessary and proportionate in the given use case so that its implementation can be justified, taking into account all the relevant circumstances. See our checklist below for a high-level step-by-step guide for the implementation of FRT in the UK.
Facial Recognition compliance checklist for organisations
If you are proposing to use FRT in the UK, the following steps must be observed to ensure compliance:
Conduct a Data Protection Impact Assessment (DPIA)
This will ensure that the risks are identified, assessed and addressed and take advice from your data protection officer.
Demonstrate how you will ensure that:
- Privacy notices are provided to individuals
- The FRT will only be used for the purpose specified
- The data collected and processed is limited to that which is necessary for the purpose
- The database will contain clear, high-quality images
- The cameras will have an appropriate resolution to collect clear, high-quality images
- The lighting in the areas where FRT will be used will be appropriate to ensure clear, high-quality images are collected
- The FRT will have a high level of accuracy i.e ensure that the volume and variety of data that the FRT has been trained on is sufficient, it has been tested and the results are satisfactory
- The data will not be kept for longer than is necessary for the purpose
- Appropriate technical and organisational measures are implemented to protect the data
- Ensure that the database/watchlist is compiled in a manner that is compliant with data protection law and does not perpetuate bias and discrimination
Review suppliers carefully
It’s important to ensure due diligence on the supplier of the FRT.
Identify and document
Make sure to identify and document the lawful basis that you will rely on under Article 6 of the UK GDPR and the condition under Article 9 of the UK GDPR (and the condition under the DPA 2018, where necessary).
Implement appropriate policies and procedures
This is to support this new processing activity.
How Evalian can help
If you are thinking about deploying FRT in the UK and need assistance with ensuring that the project is completed in compliance with the data protection legislation, we would be happy to help.
