Summary

• The Home Office published a revised 62-page live facial recognition DPIA on 22 October, following its earlier proof of concept.
• The provisional 1 November start, two or three weekly deployments, and watchlists of 6,000–15,000 are documented in the DPIA at pages 7 and 32 and remain projections.
• Published policy confirms human verification and deletion controls; the new DPIA’s incomplete third-party fields and absence of numerical accuracy data are documented in the extracted DPIA passages.

The Home Office has published a revised data protection assessment for Immigration Enforcement’s live facial recognition programme, setting out plans for more frequent operations while identifying safeguards and outstanding work on some third-party processing arrangements.

The Home Office released the 62-page assessment on 22 October. The document concerns the cameras, software and associated processing used to compare faces captured within a defined area against an authorised watchlist of people sought for immigration enforcement purposes.

The new assessment describes a formal delivery phase following the earlier proof of concept. Page 7 of the published assessment gives a provisional processing start date of 1 November 2026, a projected deployment frequency of two or three occasions per week, and prospective watchlists containing 6,000–15,000 entries. These are planning assumptions rather than records of confirmed operations.

The department’s publication identifies the new document as a redraft of its earlier assessment. The relevant passages on page 7 also state that programme-phase processing had not yet commenced. No completed deployment on 1 November has been announced.

Watchlists must serve defined enforcement purposes

Live facial recognition identifies faces within a camera’s field of view and generates mathematical representations for comparison with images on a predetermined watchlist. The software can produce an alert when the similarity between a captured face and a watchlist image crosses the configured threshold, but the alert does not determine identity or immigration status.

Immigration Enforcement’s official policy restricts the inclusion of people on watchlists to defined categories associated with a lawful operational purpose. These include individuals subject to an extant deportation order and people wanted on a warrant issued by a UK court in relation to an immigration offence.

Intelligence may influence where and when officers use the technology, but it cannot, on its own, establish eligibility for a watchlist outside those defined categories. The policy requires the reason for each proposed deployment and the watchlist used to be assessed for legality, necessity and proportionality.

Different locations require different levels of scrutiny. The Home Office policy allows planned, port-related and event deployments, with additional oversight for higher-risk operations involving busy public areas, extended operating periods or complex work alongside police forces.

Children under 18 cannot be included on Immigration Enforcement watchlists. Their faces may nevertheless be captured momentarily if they pass through a monitored area, because the technology processes images of people who are not suspected of any offence as well as those on the list.

Officer review remains essential

Under the published operating arrangements, a trained officer or operator reviews alerts before deciding whether the possible match warrants further action. Officers must establish identity through additional checks, while any decision to engage, detain or arrest someone requires an independent lawful basis.

Facial recognition systems can produce incorrect alerts because performance depends on image quality, camera placement, the watchlist and the threshold used to assess similarity. Different settings may alter the balance between missed matches and incorrect alerts, making operational testing and the judgement of trained staff important safeguards.

The official equality assessment published earlier in October discusses a facial matching threshold of 0.64 and cites National Physical Laboratory testing. The separate standard operating procedures also refer to a threshold above 0.64. Those are statements in other Home Office documents, not numerical accuracy measurements verified in the newly published 62-page DPIA.

The identified risk discussion on page 46 describes misidentification concerns without publishing numerical accuracy rates. This should not be confused with the matching thresholds or testing evidence contained in separate official documents.

Even where laboratory testing supports a configuration, results from a particular operational environment may differ according to lighting, movement, image quality and the composition of the watchlist. Publishing deployment outcomes would help establish how the technology performs in practice and whether error patterns require further attention.

Deletion rules have different limits

Immigration Enforcement’s official operating procedures require information about faces that do not generate alerts to be removed automatically. The policy also provides for deletion of watchlist information from the live system and associated transfer media shortly after deployment.

The standard operating procedures require data on an encrypted USB device used to import a watchlist to be deleted as soon as practicable, and within 24 hours after the deployment. They also set a 24-hour limit for deletion of personal data following an alert, while allowing anonymised demographic data relating to false alerts to be retained for analysis.

Pages 18 and 21 of the new assessment specify immediate deletion of non-alert images and deletion of watchlist and non-required alert information within 24 hours after the deployment day. Those limits should not be conflated with the separate legal rules governing subsequent casework records.

A person identified and approached following an alert may become the subject of lawful case records handled by other procedures. It would therefore be misleading to suggest that every record generated anywhere in an operation disappears within 24 hours regardless of what subsequently occurred.

The department intends overt deployments, using signage, leaflets and identifiable officers. Public notice may be provided in advance when doing so does not undermine the particular operation, although a person passing through a recognition area may have little practical opportunity to avoid temporary processing of their image.

Joint work raises responsibility questions

Immigration Enforcement may work with police forces able to provide facial recognition equipment, software or trained personnel. Joint operations can involve sharing watchlist information and other data, creating the need to determine which organisation controls particular records and responds to requests or complaints.

Pages 36–37 of the new assessment leave third-party processing contacts to be confirmed and identify unfinished sections. Page 40 requires third-party processing arrangements to be established before processing. Those omissions do not establish that an unlawful deployment has occurred.

Authorities would need to settle responsibility for access, retention and incident handling before a joint operation proceeds, along with the specific operational authorisation. The Home Office’s published policy describes the framework for such decisions; the new DPIA is a risk assessment rather than a source of additional immigration enforcement powers.

Questions about biometric privacy extend beyond incorrect matches. Public monitoring can process the faces of large numbers of people unrelated to an investigation, so necessity and proportionality depend on the specific purpose, circumstances and alternatives to recognition technology.

Operational evidence remains the test

The Home Office has published records concerning previous live facial recognition deployments, while its assessment describes a proposed increase in activity. It has not provided, in the material directly verified here, a comprehensive numerical accuracy evaluation for the planned delivery phase.

The earlier proof of concept is distinct from the planned programme phase. No numerical trial scanning estimate is included here because its precise source denominator has not been reconciled.

The October publication makes the intended safeguards and scope more visible without proving that the proposed delivery phase has begun. Confirmation of outstanding third-party arrangements and publication of deployment results will be needed to establish the programme’s actual scale and performance.