The UK Information Commissioner’s Office has submitted a response to the Home Office’s consultation on a proposed new legal framework for law enforcement use of facial recognition and related biometric technologies, arguing that future legislation must build on existing data protection law rather than create a separate, standalone regime.
The Home Office consultation, launched in December 2025, proposed a dedicated framework focused specifically on police use of facial recognition and similar technologies. The ICO’s position is that the proportionality and necessity tests already embedded in the UK General Data Protection Regulation and the Data Protection Act 2018 provide essential safeguards that should not be displaced. The Commissioner has consistently held that any lawful biometric surveillance requires a clear legal basis, a data protection impact assessment, and appropriate technical and organizational measures to protect individual rights.
The ICO has been conducting a rolling series of audits of police forces deploying live facial recognition, with an Outcomes Report covering findings from across forces due in spring 2026. The regulator has previously flagged deficiencies in how forces document their legal basis for processing biometric data and how they assess necessity and proportionality on specific deployments.
The ICO’s response positions data protection not as an obstacle to effective policing, but as the appropriate governance architecture for technology with significant implications for public rights. The submission comes as UK police use of live facial recognition has expanded significantly in recent years.
The ICO has been active in this space for several years. It launched its first audit of police facial recognition with South Wales and Gwent forces, and has since extended its review program. In parallel, the Metropolitan Police has been expanding live facial recognition deployments across London, while Greater Manchester Police deployed live facial recognition vans amid ongoing data handling concerns that the ICO’s Outcomes Report is expected to address. The Commissioner’s consultation response makes clear that any new statutory framework will need to demonstrate it preserves, rather than weakens, the data protection floor those audits are measuring against.
Sources: ICO, UK Government
–
By Ji-seo Kim
