UK Immigration Enforcement will be able to deploy live facial recognition (LFR) technology outside of border zones to look for people who have never committed a criminal offence, prompting concern from digital rights groups about surveillance overreach.
The concerns were triggered after the Home Office published policy and impact assessment documents that say Immigration Enforcement’s use of LFR surveillance will extend beyond ports of entry to the UK, as well as stray into civil rather than criminal matters.
A new policy document published on 8 October 2026, for example, set out rules for how Immigration Enforcement should approach its LFR deployments – including watchlist creation, approved locations, human oversight measures and biometric matching thresholds – but also covers how to conduct facial recognition operations beyond ports of entry to the UK.
Under the guidance, this means Immigration Enforcement may deploy LFR at transport hubs, events that are “expected to increase footfall at a location” and along travel routes.
It also covers joint deployments with police forces, allowing Immigration Enforcement to supply watchlists for police facial recognition systems, or otherwise process police-supplied data through its own systems.
Accompanying the policy document is a data protection impact assessment (DPIA), published on 22 October 2026, which notes that LFR could be used to support “administrative or civil immigration activity” rather than being used solely for criminal matters, which operate under a different set of more stringent legal rules.
This means people could be included on LFR watchlists for overstaying a visa, working without permission, or entering without leave, all of which are considered civil rather than criminal matters.
The publication of LFR documents by the Home Office follows eight “trial” LFR deployments by Immigration Enforcement at Holyhead port in November 2025, which scanned 5,474 faces but led to only a single arrest. A second set of 10 “trial” deployments from February 2026 at the same location scanned 2,752 faces and resulted in two arrests.
Taken together, the documents suggest that Immigration Enforcement could routinely deploy LFR outside of border zones – particularly when attached to wider police LFR deployments that regularly take place on high streets or at events – to look for people who have not committed any criminal offences.
Computer Weekly has also heard concerns about data quality and integrity issues in the underlying database from which Immigration Enforcement will draw facial images for its LFR watchlists, as this is the same database that underpins the Home Office’s error-prone electronic visa (eVisa) system.
These issues include profile mismatches – where people are, for example, shown incorrect personal details or given wrong visa expiry dates – and immigration statuses becoming “entangled” with other people’s records.
In terms of LFR, this means an individual could be included in an Immigration Enforcement watchlist if the underlying system entangles their identity records with someone else’s.
Computer Weekly contacted the Home Office about every aspect of the story – including concerns shared by civil society about the expansion of LFR surveillance into non-criminal matters, and how the department is dealing with data integrity issues when creating watchlists – but received no response by the time of publication.
Civil society reactions
Responding to the publication of the documents, Jake Hurfurt, head of research and investigations at privacy group Big Brother Watch, noted the “broad” language used gives the UK government “worrying latitude to use this Orwellian technology” to target an ever-growing number of people.
“It is shocking to see the Home Office quietly set itself up for yet another massive expansion of facial recognition use in this country. It is a difference in kind to use it to identify people they suspect of administrative, rather than criminal, breaches of the law,” he said.
The hostile environment, once automated, becomes a template for governance across society. The very technologies and rationales deployed at the border quickly find their way into domestic policing and public spaces, transforming everyone into a potential suspect Open Rights Group
“Police use of this technology has seen repeated false alerts. What will happen when an algorithm malfunction or dodgy Home Office data leads to someone being wrongly accused of breaching immigration rules? The UK is not a ‘papers please’ society where we all carry ID, but this threatens to turn our streets not just into a police lineup, but a border control booth as well.”
According to a recent research report by the Open Rights Group (ORG) – which looked at the use of technologies with artificial intelligence (AI) throughout the UK’s border control ecosystem, including LFR – while it is promising that the government is actively publishing guidelines and policy documents, “no safeguard is good enough to avoid the normalisation of mass surveillance in democratic settings”.
It added that the only effective safeguard against abuse of AI and biometric surveillance is to reject the security framing around migration that paints people on the move as a threat, and to “ensure that AI and automation serve humanitarian, not carceral purposes”.
The ORG concluded that the increasing normalisation of surveillance is not just a problem for migrants: “The hostile environment, once automated, becomes a template for governance across society. The very technologies and rationales deployed at the border quickly find their way into domestic policing and public spaces, transforming everyone into a potential suspect.”
Watchlist creation concerns
While the Immigration Enforcement LFR DPIA notes that a separate impact assessment has been carried out to cover watchlist creation in more detail, the document has yet to appear online with the other published materials. The Home Office did not respond to questions on when it would be published.
Wider police LFR deployments carry a number of issues with watchlist creation, including that the main source of facial images for these systems – the Police National Database (PND) – still contains millions of unlawfully held custody images. While the High Court ordered the Home Office to destroy the unlawfully retained images in 2012, the department has yet to do so.
However, the existing DPIA does note that “for joint deployments, any sharing of watchlist data with police forces or other partners will be governed by a deployment-specific data sharing arrangement”, which will set out the purpose of the sharing, its legal basis, data controller or processor roles, watchlist criteria, security arrangements, data retention and deletion requirements, and audit responsibilities.
Aside from potential data from the PND, the documents published so far confirm that Immigration Enforcement will use a number of other databases as sources of facial images.
“All data held is derived from Home Office systems, such as the Person Centric Data Platform (PCDP), Atlas [a case working system], Immigration and Biometrics System (IABS), Central Reference System (CRS) and Initial Status Assessment (ISA), and reflects data held in those live systems, being updated via a regular data feed,” said the DPIA.
The PCDP in particular brings a number of concerns. This database acts as a centralised service that bridges different datasets to consolidate identity records and migration statuses for the UK Visas and Immigration (UKVI) View and Prove online service, which underpins the Home Office’s eVisa system.
Given the data quality and integrity issues present with the eVisa system, there is concern about how this translates to its use in LFR if people’s identity records become entangled by the system and are then included in the watchlists.
Speaking with Computer Weekly, migrant support group the3million said it is worried about the Home Office expanding digital border enforcement when its own systems have been shown to hold incorrect data that it struggles to find and fix.
“In June, the Home Office confirmed that a group of EU Settlement Scheme status holders had eVisas that did not show their correct status,” said Kaelynn Narita, research and policy manager at the3million. “If the Home Office builds watchlists from these same databases, errors could lead to people being wrongly flagged, stopped or questioned, or struggling to prove their rights when they return to the UK.
“Before using this data to target people, the Home Office must be open about how it identifies and corrects errors in its caseworking systems.”
Another aspect of police LFR that has come under criticism is the gap between rhetoric and practice, as while the Home Office and individual police forces claim the technology is reserved for only serious criminality, watchlists have previously included people for shoplifting, drug, or traffic offences that do not meet the legal threshold of serious crime.
Writing in a September 2025 research paper about the “wild west” of police facial recognition testing, academics Karen Yeung and Wenlong Li noted that while the Metropolitan Police’s watchlists were populated by individuals wanted on outstanding arrest warrants, they also included “images of a much broader, amorphous category of persons” who did not meet the definition of serious offenders.
Computer Weekly contacted the Home Office about what processes are in place to identify and correct errors in its caseworking systems and databases, but again received no response.
A new legal framework?
As it stands, police use of facial recognition is regulated through a “patchwork” legal framework, although the King’s Speech in May 2026 confirmed new legal rules would be contained within the upcoming Police Reform Bill.
When launching its consultation on a new framework for the tech in December 2025, the Home Office said the current rules governing police LFR use are “complicated and difficult to understand”, and that an ordinary member of the public would be required to read four pieces of legislation, police national guidance documents and a range of detailed legal or data protection documents from individual forces to fully understand the basis for LFR use on their high streets.
Computer Weekly contacted the biometric and surveillance camera commissioner for England and Wales, William Webster, about the expansion of LFR into the immigration enforcement sphere.
He confirmed that while he was aware of the pilots, his remit primarily covers police forces and local authorities, and does not extend to immigration services.
“I have argued, in my response to the Home Office consultation on LFR and other biometric surveillance use, that the new proposed legislative framework should apply to all public services, including the NHS, public transport, immigration and prisons, etc. I have also argued that the government should give serious consideration to extending the legislative framework to the commercial sector, such as retailers,” he said.
“We won’t know the scope of coverage until the Police Reform Bill is laid before Parliament, but I am hopeful that in the future a new regulatory body, which will replace my office and which will have stronger compliance powers, will regulate the use of biometric surveillance technologies by immigration services.”
Webster added that the trials of LFR by Immigration Enforcement highlight “the urgent need for a legislative framework which sets out tests and rules for necessity and proportionality in primary legislation”.
In a recent interview with former prime minister Tony Blair, home secretary Shabana Mahmood described her ambition to use technologies such as AI and LFR to achieve Jeremy Bentham’s vision of a “panopticon”, referring to his proposed prison design that would allow a single, unseen guard to silently observe every prisoner at once.
Typically used today as a metaphor for authoritarian control, the underpinning idea of the panopticon is that by instilling a perpetual sense of being watched among the inmates, they would behave as authorities wanted.
“When I was in justice, my ultimate vision for that part of the criminal justice system was to achieve, by means of AI and technology, what Jeremy Bentham tried to do with his panopticon,” Mahmood told Blair. “That is that the eyes of the state can be on you at all times.”
Table of Contents Know your business assets Make your business visibly secure Make the least privilege principle non-negotiable Test your incident response plans Outsource responsibility,…
Ericsson and the Saudi Railway Company (SAR) have signed a memorandum of understanding (MoU) to deploy 5G-enabled technologies across the national rail network. The partnership…
Denmark-based SaaS backup provider Keepit is adding to functionality in June and July that includes support for Atlassian dev workflow tools Jira and Confluence, as…
Since the launch of ChatGPT by Open AI in November 2022, interest in generative artificial intelligence (GenAI) tools has increased dramatically. Its ability to generate…
Table of Contents Counter measures Black box Agent energy “The challenge is monumental. Even under the best circumstances, the transition to this new AI era…
Outsourcer Capita has told some pension provider clients that data it processed on their behalf was compromised in the March 2023 Black Basta ransomware attack…
