Home Office pushes for more police facial-recognition deployments

Proposed data reforms reduce oversight

The overall report, however, largely focuses on the UK government’s proposed Data Protection and Digital Information Bill (DPDI), arguing that it will weaken oversight of the police’s intrusive surveillance capabilities if enacted as is.

“The possibilities for integrated surveillance technology, driven by AI and supported by the internet, create genuine public anxieties over civic freedoms…In current form, the bill will delete several surveillance oversight activities and mechanisms that are set out in legislation and arise from the fulfilment of statutory duties placed on commissioners,” it said.

“Prominent among these is the tabled abolition of Protection of Freedoms Act 2012 (POFA) legislative requirements to (a) appoint a surveillance camera commissioner and (b) to publish a Surveillance Camera Code of Practice, which offers governance coverage far beyond data-related issues. The code is realised through the national Surveillance Camera Strategy, which would also disappear.”

The report also criticises the Home Office’s decision to amalgamate the discrete statutory functions of the biometrics and surveillance camera commissioner roles under the purview of a single office, which was announced in July 2020.

In September 2021, the Home Office further proposed placing amalgamated role under the remit of the Information Commissioner’s Office (ICO), which Sampson himself described at the time as “ill-conceived”.

Noting that surveillance oversight has historically been “overburdened and under-resourced,” the report added: “The bill contains no provision for continuing the work of driving up standards for the development, procurement, adoption and use of surveillance cameras, a programme of work widely applauded across police, practitioner and industry communities.”

According to one of the report’s interviewees, the bill also makes no provision for the absorption of Sampson’s roles by the ICO, and “just deals with extinction”.

On top of facial recognition being relegated to a solely data protection issues, the report also highlighted issues with fingerprints and DNA being handed over to the Investigatory Powers Commissioner (IPCO).

“Considering surveillance impacts and harms purely in terms of data protection is widely recognised as a highly restrictive and selective framing. It is also widely acknowledged that rights concerns arising from surveillance are not reducible to issues of privacy alone,” it said, adding the expansion of the IPCO’s remit also “risks a de facto segregation in the oversight of different biometrics techniques, where the governance of all other forms rests elsewhere.

“It removes any statutory duties from the interface of biometrics and surveillance, the policy basis on which ministers recently combined the POFA commissioner functions. Moreover, one could argue that given the potential for collateral intrusion, remote biometric surveillance resonates more closely with IPCO’s remit than fingerprints and DNA.”

However, the report added that most gaps opened up by the bill could be addressed if responsibility for the Surveillance Camera Code were moved to the IPOC, which it claimed “would harmonise all functions for oversight of traditional and remote biometrics in policing under one established and internationally regarded judicial oversight body”.

It concluded while one of the bill’s stated aims is simplification of surveillance oversight, the proposed ways of achieving greater simplicity could come at the expense of effective oversight, especially given “the significant uncertainties brought by emerging technologies”, and “may actually complicate the oversight landscape” in practice.

The report has been be submitted by Sampson as part of his evidence to the DPDI Bill Committee, which is scrutinising the proposed legislation ahead of its third reading in Parliament.

“The gap analysis remains incomplete, but the interim findings suggest that there may be significant gaps were the bill to proceed in its current form,” he wrote in an email to the committee, adding its authors are “well-placed to provide an objective, evidence-based commentary for the benefit of those tasked with policymaking and the individuals who come after me once my office has gone”.

In Europe, on the other hand, MEPs recently expanded the list of prohibited AI systems – in a raft of proposed amendments to the European Union’s (EU) AI Act – to include the use of LFR in publicly accessible spaces and the indiscriminate scraping of biometric data from social media or CCTV footage to create facial-recognition databases.

While retrospective remote biometric identification systems are now prohibited, MEPs kept exceptions for law enforcement but said it would only be for the prosecution of serious crimes and only after official judicial authorisation.