It is often said that ‘a week is a long time in politics’ and hardly a week goes by without a media report on facial recognition technology.
Over the summer, there have been numerous publications covering different aspects of facial recognition technology, its use, concerns about its use, and its regulation. Cumulatively, this reporting, whilst focusing on the hot topic of the day, raises important considerations about broader governance issues associated with biometric surveillance, especially in relation to law enforcement and public safety.
Such issues include public awareness and understanding of the current regulatory environment, the intrusive nature of biometric surveillance technologies, and how biometric technologies are likely to be used and governed in the future. Here, I‘d like to take the opportunity to revisit and reflect on a few of these recent publications.
There is an ongoing discussion about the fine line between overt and covert surveillance and the degree to which facial recognition technologies are explicitly overt.
Whilst on the one hand, they are typically police operations conducted in plain sight, on the other, it is less clear how individuals appear on a watch list or how the algorithms work. The key here is how the system is deployed and whether people are aware of how it is used and when.
Principle 3 of the Surveillance Camera Code of Practice states ‘there must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints’ and for the vast majority of surveillance systems, this is achieved through appropriate signage, public engagement and with details of the system published on the Internet.
With this in mind, I was intrigued by Sir Mark Rowley’s announcements over the summer about the Metropolitan Police’s intention to embrace new technology, and to extend Live Facial Recognition (LFR) into the static camera network, to further extend the Drones as First Responder initiative and to roll out Operator Initiated Facial Recognition.
All of these initiatives demonstrate the potential value of biometric surveillance for policing, however, they also raise interesting questions about how the public will know when and where this surveillance is taking place and what is publicised about such surveillance practices.
For example, how will members of the public know when a static surveillance camera is being used for facial recognition or not, and how will the use of drones be accompanied by appropriate signage and warnings? Whilst the Metropolitan Police have been very open with me and my office about these initiatives, a rudimentary search of their website has very little on any of these schemes, which means they run the risk of tipping into covert surveillance and consequently being subject to different legislation and regulation.
At this stage, the initiatives mentioned are in pilot phases and their utility is to be determined. I would advocate, prior to such schemes becoming operational, and to comply with existing legislation, that public engagement exercises are conducted and that far more information is published online. The materials currently published in relation to LFR are exemplary in this respect.
Beyond law enforcement, LFR has been diffusing rapidly into the retail sector, primarily to help tackle shoplifting. Media reports have focussed on new deployments, the successes of this technology and instances of misidentification.
We can anticipate that in the near future more retailers will deploy this technology and that this will normalise its existence and use in society. Interestingly, whilst these deployments are for ‘crime related’ purposes, my regulatory remit does not extend to the retail sector.
The situation is further muddied by media reports pointing to one retail system sharing LFR footage directly with the local police force. The use of this data in this way suggests that whilst the infrastructure and data is not owned and generated by the police it is clearly being used for policing purposes.
The risk here is that there is a two-tier system of standards and regulation, one that applies to law enforcement and one that applies to other sectors, and that this will be difficult to explain and comprehend.
The upcoming Police Reform Bill is likely to propose a new legislative framework for LFR and other biometric technologies and the issue of scope is an area to be addressed. I have argued, in my response to the Home Office’s consultation that public services operating advanced biometric surveillance systems in public places should be subject to the new rules, and that this scope should extend beyond policing.
I have also argued that any system used for law enforcement, public safety or safeguarding purposes, regardless of ownership, should be subject to the proposed new legislative framework. This will provide clarity for the public as well as those using and regulating the technology.
Recently, the Information Commissioner’s Office (ICO) has published an ‘outcomes report’ on its audits of LFR use by police in the UK. These reports provide a mixed picture, with some areas of assurance, such as the lawful basis for use being clearly identified and documented, and other areas where urgent attention is required, for example keeping clear records of the use of personal information.
The report is interesting for a number of reasons. Firstly, it is not often that the ICO takes direct action in the world of video surveillance cameras and the insights around data processing practices embedded in LFR will be very helpful for my office when we conduct our Protection of Freedoms Act Compliance visits with police forces. Secondly, there are a number of observations in the report, for example around governance, internal oversight, accountability and training, which are strictly speaking not data processes and are the remit of other regulators. Thirdly, and rather alarmingly from my perspective, is that the report contains a fundamental misrepresentation of the regulatory environment surrounding the use of LFR in policing.
The legal role and functions of the Biometrics and Surveillance Camera Commissioner are completely omitted, meaning that oversight beyond data processing is not considered appropriately. I am not going to speculate on the reasons for this omission, but it does suggest to me that the upcoming Police Reform Bill, when creating a legal framework for the use of biometric surveillance, which would include LFR, must clarify and simplify the regulatory landscape, and that this would benefit the public, operators and regulators.
Whilst a week might be a long time in politics, another adage suggests that legislation and regulation will always be ‘playing catch up’ with new technology.
Emerging biometric surveillance technologies will have an important role to play in policing and law enforcement, and the police should be expected to use emerging technologies when exercising their duties, so long as they are used responsibly, ethically and proportionately.
Interestingly, the rush to LFR is happening at the same time as governance evolves, including potentially new primary legislation and the formation of a new regulator, which makes me wonder what existing practices will ultimately be deemed as satisfactory or not.
From my perspective, there is a clear need for this new legislative and regulatory framework, and given the speed of technological change, this is needed sooner rather than later.
