An internal Merseyside Police data protection impact assessment says the force may hold custody images of about 300,000 people that are overdue for deletion, and warns that a mobile facial recognition tool could end up searching against unlawfully held images.
The assessment examined the viability of officer-initiated facial recognition (OIFR), which lets officers upload a photograph of a person during an in-person encounter and compare it against police databases in real time. It said the images would come from custody records stored on Niche, a police records system used by a number of forces in England and Wales.
“As an organisation we are aware that there are potentially 300,000 nominals who could have multiple images overdue for deletion,” the assessment said. It added: “There is a real risk the force could use and compare against an unlawful image whilst undertaking an OIFR.”
Merseyside Police said OIFR “is not currently in operational use” and called custody image retention “a longstanding national issue affecting police forces across England and Wales.” The force said the issue involves “complex legal, technical and operational considerations” and that policing decisions must balance privacy against the need to prevent and detect crime, protect vulnerable people and keep the public safe.
OIFR is separate from the live facial recognition cameras Merseyside Police adopted in late 2025, which compare faces in public places such as city centers and sports events against watchlists of people of interest.
Civil liberties group Big Brother Watch shared the assessment. “It is alarming to see Merseyside Police seemingly acknowledge it unlawfully holds more than 300,000 mugshots but take no action to delete them,” said Jake Hurfurt, the group’s head of research and investigation. “Instead of trialling tools that run biometric searches on hundreds of thousands of unlawfully retained images Merseyside Police needs to get their house in order and delete data they should not be holding.”
The High Court ruled in 2012 that keeping images of people who faced no action, or who were charged and acquitted, for more than six years was unlawful. Most forces in England and Wales continue to retain arrest photographs, and a 2017 Home Office review found police had access to nearly 20 million images enrolled in the facial recognition gallery on the Police National Database.
In Scotland, custody images are uploaded to the national database only when a person has been charged, and Police Scotland has been reported to review custody images and delete those not linked to a live prosecution or conviction. “Police Scotland have shown removing these images is possible,” Hurfurt said.
Sources: Liverpool Echo
–
By the ID Tech Editorial Team
