Britain's Facial Recognition Boom Runs on Police Policy, Not Statute

James Ball is a fellow at Tech Policy Press.

One Friday in February 2024, Shaun Thompson was walking out of London Bridge station having completed a shift with Street Fathers—a charity group working to discourage teens from falling into knife crime—in the south London town of Croydon when he was pulled aside by police, apparently with no warning. He was told that he was a “wanted man.”

"When I asked what I was wanted for, they said, 'that's what we're here to find out',” he later recalled in a BBC interview. Thompson had walked past a trial of facial recognition technology, deployed by the Metropolitan Police, and his face had come up as a match for a man wanted for grievous bodily harm, a serious assault charge. However, the system had identified the wrong man.

Thompson was eventually released after 30 minutes, during which police tried to fingerprint him. He found photos of his passport on his phone and satisfied the officers present they had detained the wrong person. Ironically, the automated system had confused Thompson for his own brother—and Thompson was, in fact, the victim of the crime for which his brother was wanted.

Though the stop passed without serious incident, Thompson used it as the basis of a legal challenge against the police’s deployment of facial recognition technology, which is used in the United Kingdom without any specific legislation or safeguards passed by parliament. “This is not the way forward. This is like living in Minority Report,” he told the BBC, referring to the result as “stop and search on steroids.”

Thompson and the advocacy organization Big Brother Watch tried to challenge the adequacy of the legal framework governing facial recognition technology, which is being used with increasing frequency by UK police forces. In April, the campaigners learned that their challenge had failed—-removing one of the most obvious legal obstacles to a far wider rollout of facial recognition across the UK, which is regularly named as one of the most-surveilled countries in the world outside of China.

Police forces across the UK have been experimenting with facial recognition technology for at least a decade, initially using it in temporary deployments—often where big crowds were expected—to assess faces against a pre-defined watchlist selected by the force.

Police relied upon internal policies to provide the legal basis for this surveillance, and introduced safeguards to try to ensure its use would be consistent with the Data Protection Act and the Human Rights Act. These included posting warnings about where facial recognition systems might be used, and ensuring that any faces which didn’t trigger a match in the software would not be stored.

However, civil liberties activists and organizations challenged the introduction of facial recognition without specific parliamentary approval. The landmark case—until the recent Met ruling—was Bridges v. South Wales Police. Ed Bridges, a civil liberties campaigner, believed his face had been captured by police facial recognition technology at least twice, including once at a protest against the arms trade, and used this standing to bring a judicial review of the force’s use of facial recognition.

Bridges lost at the first instance, but won on three different grounds at the Court of Appeal in 2020. One of these was the court’s finding that facial recognition technology did have the potential to interfere with privacy rights under Article 8 of the European Convention on Human Rights—and that this interference was not in accordance with the law—alongside a finding that police didn’t have enough safeguards against potential racial or gender bias to be in compliance with public sector equality duties.

The Court of Appeal also found that while police force policies could in theory provide sufficient legal basis to deploy facial recognition—disappointing campaigners who wanted it to be governed by new legislation—those policies did not provide enough safeguards. Specifically, the court found the criteria for who was put onto watchlists was too vague, and that it was not sufficiently foreseeable when someone might be subject to facial recognition.

Post-Bridges, forces were not banned from using and testing facial recognition technology, but would at least need to tighten up their policies and consider data protection law when deploying it—but there had been virtually no test of what that meant in practice, until now.

The Court of Appeal had considered the broader legal context of facial recognition policies widely—considering questions such as the potential for racial bias, or the consequences if forces decided to retain data of innocent people captured in the system.

The 2026 High Court ruling in Thompson v. Met Police, though, determinedly and repeatedly refused to consider hypotheticals—confining itself precisely to the specifics of the Met Police’s general policy on live facial recognition (LFR) rather than the facts of Thompson’s case on the ground, or how other forces might use the technology.

“The role of the court is concerned with resolving questions of law,” the ruling says. “It is not responsible for making political, social or economic choices, or in this case policy decisions, on how the police carry out their functions.”

By defining its scope of inquiry so narrowly, the court was all but guaranteed to rule as it did in favor of the Metropolitan Police, according to Dr. Bernard Keenan, a lecturer at University College London specializing in technology and human rights law.

“They continually refer to the jurisdiction of judicial review—so the question is whether the Met Police policy is ‘in accordance with the law’ and not whether that policy opens the door to more expansive deployment of LFR in future,” he explained.

Keenan noted the court “refused any suggestion” that LFR qualified as a more “intrusive” police power under its current configuration—as opposed to how it was used when the policy was written—and said it constricted itself on other fronts.

“The potential use of LFR in more intrusive ways is simply out of bounds for the court,” he continued. “They are also quite critical of the submissions from both the parties and their representatives for trying to bring in structural injustices around race and over-policing, and the potential development of mass surveillance, and the existing evidence of chilling effects already at protests.”

Keenan conceded that “from a strict public law perspective, this is defensible”, but said the result is a “frustrating” one and that the Court of Appeal may once again find itself taking “another go at it.”

“Perhaps the broader point is that this leaves campaigners, and civil liberties more generally, in a precarious place,” he concluded. The court is effectively saying regardless of the merits of your concerns, this is not the forum to air them—but then we have to ask: where is?”

Should the Thompson ruling stand, it leaves campaigners worried about widespread deployment of facial recognition caught in an awkward catch-22, in which courts say that the broader questions of its use are a matter for parliament, while parliament itself does not feel mandated to ask—and police continue to deploy the technology while the two are stuck in that stand-off.

Just weeks after the judgment in its favor in Thompson, the Metropolitan Police revealed the results of a six-month static deployment of facial recognition technology in the south London town of Croydon, revealing it had led to 173 arrests, including of a woman who had been at large for more than 20 years.

The force also deployed live facial recognition while policing the far-right “Unite the Kingdom” rally, led by convicted criminal Tommy Robinson, in central London in mid-May—exactly the kind of controversial deployment at a political rally that had previously concerned activists.

The UK is traditionally relaxed about surveillance powers, especially if they seem to lead to arrests and criminal convictions, though a recent attempt to introduce digital ID provoked a huge public backlash, with a petition against the move amassing more than two million signatures within days.

Part of this is because for all that London in particular—but to only a slightly lesser extent, the UK in general—has been covered in CCTV cameras for decades, it has been apparent that no one is watching them closely.

It is a common complaint among London cyclists that police refuse to even watch surveillance footage to identify bike thieves (forces refuse to watch footage longer than two hours, and will not use techniques like binary search to cut down viewing time). British media is routinely filled with stories of out-of-control petty crime and shoplifting in London, even if murder and serious crimes are at historic lows.

The expansion of live facial recognition from mobile deployments to static cameras, as was trialed in Croydon, fundamentally changes that deal. The act of constant observation, even if only by an automated system, surely changes those being watched.

This, though, is exactly the kind of question the High Court has refused to consider, and which the British parliament also chooses to ignore. It’s not clear if there’s any other authority left for campaigners to ask.