Summary

• The Home Office plans legislation governing police biometrics, facial recognition, and related surveillance systems in England and Wales.
• A new independent oversight body would monitor compliance and could pursue enforcement action, including court injunctions in serious cases.
• More than 13,800 consultation responses informed the proposals, which also include separate safeguards for some private-sector facial recognition deployments.

Police forces in England and Wales would face new statutory controls over facial recognition and other biometric technologies under government proposals that include independent oversight, discrimination testing, and powers to restrict non-compliant deployments.

The Home Office outlined the framework on 4 November following a public consultation that attracted more than 13,800 responses. Ministers intend to include the measures in the Police Reform Bill, replacing the current collection of legal requirements with more specific provisions governing biometric and overt surveillance technologies.

A proposed independent regulator would monitor compliance, advise on standards, and scrutinise emerging technologies. In serious cases, enforcement proceedings could result in a court injunction preventing a police force from continuing to use a particular system.

The proposals extend beyond police operations. The government also intends to introduce complementary safeguards for businesses using facial recognition to prevent or detect crime, including retailers whose systems identify people suspected of previous offences.

Independent oversight gains enforcement powers

Facial recognition already operates within legal requirements covering personal data, human rights, policing powers, and surveillance. However, those responsibilities have developed through different laws and regulatory arrangements rather than a single framework designed specifically for biometric identification.

The government argues that the existing system creates uncertainty for police organisations introducing new technologies and for the people affected by their use. A dedicated statutory framework is intended to clarify when deployment is permitted and which safeguards must accompany it.

Under the proposals, the new oversight body would examine compliance and provide advice on technical standards, emerging capabilities, and operational risks. Its role would extend beyond reviewing individual technologies because systems can change substantially through software updates, new datasets, and different deployment arrangements.

Enforcement powers would give the regulator a means of addressing serious failures. The Home Office proposes that non-compliance could ultimately lead to an application for a court injunction restricting use of the relevant technology.

That would be a significant operational sanction, although the eventual effectiveness of oversight will depend on the regulator’s statutory powers, independence, resources, and ability to obtain information about deployments.

The legislation would also be supported by a statutory code of practice. Such guidance could establish common expectations around authorisation, record-keeping, watchlist management, human review, and the assessment of technical performance.

These requirements would have practical consequences for procurement. A police force selecting a facial recognition supplier would need to consider whether its software supports the documentation, testing, and operational controls demanded by the eventual framework.

Bias testing becomes part of deployment

The Home Office wants biometric technologies used by law enforcement to undergo rigorous independent testing for potential discrimination associated with characteristics including age, sex or gender, and race.

Facial recognition systems compare images against reference photographs or watchlists, returning possible matches according to the system’s configuration and operating thresholds. Their effectiveness depends on factors such as camera position, lighting, image quality, database composition, and the conditions under which identification takes place.

Different error rates between demographic groups can create unequal consequences, particularly where a potential match leads to an individual being stopped or questioned. Evaluating those differences requires appropriate datasets and testing conditions rather than relying solely on a supplier’s general accuracy claims.

The government says it has independently tested a new retrospective facial recognition algorithm intended to become available to forces in 2027. It has also tested the systems used in government-funded live facial recognition vehicles.

Those evaluations provide evidence about particular algorithms under specified conditions, but they cannot establish that every future deployment will operate without error or discrimination. Performance can change when different cameras, populations, watchlists, and operating procedures are involved.

Under the proposed framework, police deployment would also need to be intelligence-led and proportionate. Officers would be expected to have a reasonable basis for believing that wanted individuals could be present in the area where technology is used.

The distinction limits the circumstances in which surveillance could be justified, although the final legislation and code will determine how consistently that requirement is applied.

Private-sector systems face separate safeguards

Retailers and other commercial organisations are increasingly considering facial recognition for security purposes, particularly where businesses want to identify people associated with previous incidents.

These deployments differ from police operations because private companies do not possess the same statutory powers, even when their systems are intended to support crime prevention.

Commercial providers may also operate shared watchlists across several premises, creating questions about the accuracy of records, the grounds for including individuals, and how information is corrected or removed.

The government proposes separate legal provisions and a code for relevant private-sector uses, with safeguards aligned to police requirements where appropriate.

For businesses, implementation could involve clearer procedures for assessing necessity, managing biometric data, reviewing possible matches, and dealing with complaints. Suppliers may also face additional demands for evidence about accuracy and compliance.

However, the final scope of the private-sector measures remains dependent on legislation. The November announcement does not establish a blanket authorisation for commercial facial recognition or specify that every existing deployment would satisfy the future rules.

Public confidence depends on operational safeguards

The consultation received submissions from members of the public, academics, policing bodies, civil society organisations, regulators, and technology businesses. Respondents raised concerns about privacy, discrimination, transparency, accountability, and independent oversight, alongside the potential benefits of using biometric systems to identify wanted individuals.

The Home Office maintains that facial recognition has already supported arrests and investigations. Such operational results provide evidence of police use, but arrest numbers alone cannot determine whether every deployment was necessary, proportionate, or effective compared with other investigative methods.

The government has also commissioned public dialogue research examining how communities, including minority groups, assess the technology and the safeguards they consider necessary.

That evidence will be relevant to implementation because legal compliance does not necessarily resolve every concern about surveillance in public spaces. Public confidence may depend on whether people can understand how watchlists are compiled, how false matches are handled, and who can challenge improper use.

The Police Reform Bill is intended to establish the statutory foundation, with more detailed operational requirements to follow through codes and regulatory arrangements.

Until those measures are enacted, the proposed watchdog has no new enforcement powers under this framework. The next legislative stage will determine the regulator’s authority and the obligations placed on police forces, technology suppliers, and relevant private operators.