The UK Home Office has published a data protection impact assessment (DPIA) for live facial recognition (LFR) in Immigration Enforcement, setting out how cameras, software and watchlists will be handled as the program moves from a proof of concept into a formal delivery phase.
A DPIA is the risk assessment UK GDPR requires before high-risk processing of personal data begins. The 62-page document says processing has not yet started under the delivery phase and that the assessment was completed ahead of planned deployments. It splits the earlier single assessment in two: this one covers LFR hardware, software and operational processing, while a linked DPIA covers the Facial Recognition Watchlist Generator that builds deployment-specific watchlists.
LFR is meant to help officers identify people where human recognition alone may be insufficient, such as in crowded transport hubs. The system compares faces in real time against a watchlist and raises an alert when a similarity score passes a set threshold, and trained operators review every alert before any action is taken. Watchlists can include people who entered the UK in breach of a deportation order and people wanted for immigration-related criminal offences who could not be traced by other means. People under 18 will not be placed on watchlists.
Data on people who do not match is deleted immediately. Alerts, including false alerts, are deleted from the system within 24 hours of the end of each deployment day, and raw video is not retained. The watchlist is moved on encrypted media to a standalone LFR system at the deployment site and is not stored in cloud or supplier systems, and the supplier is not expected to have routine access to deployment data.
Some deployments may use Immigration Enforcement equipment, while joint deployments with police may use police-provided hardware, software, vehicles, cameras or operators under deployment-specific data sharing arrangements. Deployments will be overt, with signage, leaflets and uniformed officers on hand, and details of the purpose, location and timing will be published in advance where possible. Police forces are expanding their own use, with North Yorkshire Police scheduling its first deployment in September.
The system comes from an approved supplier verified by Home Office Biometrics and referenced in the National Physical Laboratory’s equitability study of facial recognition in law enforcement. When a false alert occurs, Immigration Enforcement will keep anonymized demographic data to investigate potential bias. The risk register lists unequal performance across demographic groups and unclear signage among the risks, with mitigations including monitoring demographic false alerts and refining thresholds.
The DPIA joins other Immigration Enforcement LFR documents on GOV.UK, including a facial recognition policy updated to version 2.3 on October 8 and an equality impact assessment updated October 5.
Sources: GOV.UK, Home Office DPIA
–
By the ID Tech Editorial Team
