South Wales and Gwent Police's use of facial recognition complies with data protection

The Information Commissioner's Office (ICO) has published its first data protection audit report of police use of facial recognition technology (FRT), examining the practices of South Wales Police and Gwent Police. As part of its AI and biometrics strategy, the ICO is auditing forces that have been early adopters of the technology to ensure its use complies with data protection laws.

The audit assessed how the two forces govern live facial recognition (LFR) and retrospective facial recognition (RFR) deployments, focusing on safeguards like staff training, data retention, and impact assessments. Operator Initiated Facial Recognition Technology (OIFR) was also observed during the audit, but the ICO's findings were only advisory due to the age of the pilot. 

Overall, the ICO was encouraged by its findings, which provided a "high level of assurance" that the forces' processes and procedures align with data protection law. The audit found that both forces ensured human oversight from trained staff to mitigate the risk of discrimination, and required a formal application process to assess the necessity and proportionality of each LFR deployment.

The ICO noted that while this audit offers a positive snapshot, it does not give a general "green light" for the use of FRT by all police forces. The summary is intended to serve as a guide, highlighting both areas of assurance and opportunities for improvement for other forces considering deploying the technology.