The Use of Facial Recognition Technology in London

(Judicial review - police use of facial recognition technology in London – Shaun Thompson and another -v- The Metropolitan Police Commissioner (2026) EWHC 915 (Admin))

THE RECOGNITION SOFTWARE

First adopted in September 2024, the Metropolitan Police Service (‘MPS”) has a Policy of using live facial recognition technology (“LFR”) in London to prevent and detect crime, to find missing persons and to protect the public. Relevant faces of interest to the police are kept on LFR “watchlists”.

Cameras used are generally moveable rather than fixed. The software attempts to match captured facial images with those known to the police. They are expressed in unique biometric or numerical values. If there is no match, then the captured data is automatically and immediately deleted.

CONTENTION

The claimants contended that the Policy violated Art. 8 ECHR because it interfered with the right to respect for private and family life (Ground 1) and that it also violated Arts.10 and 11 because the policy was not prescribed or in accordance with the law and interfered with both freedom of expression and freedom of assembly and association. (Ground 2).

In the first claimant’s case LFR mistakenly matched his face to that of his brother who was on a watchlist. Although officers doubted whether the claimant was in fact the same person, he was questioned and asked to provide his fingerprints.  When he refused, he was threatened with arrest.

The second claimant was a director of Big Brother Watch. In that and her own personal capacity she both monitored the use of LFR in London and also protested about its deployment and increasing use.

THE CENTRAL ISSUE

The Court determined that the central issue in the case was its lawfulness and whether its existence, meaning and consequences were foreseeable to the person concerned.  

A measure will not be in accordance with the law within the meaning of Art.8(2) unless it has both a basis in domestic law and is of sufficient quality as to render it accessible to the person concerned who must be able to foresee its consequences for him and be compatible with the rule of law.

As Lord Sumption said in In Re Gallagher (2019) UKSC 3, namely,

“The measure must not confer a discretion so broad that its scope is in practice dependent on the will of those who apply it, rather than on the law itself.”

The Policy must have sufficient clarity and foreseeability so as not to allow arbitrariness; that is decision-making by a public authority on the basis of whim, caprice, malice or predilection.

Neither the Claim nor the court was concerned with the merits or demerits of the Policy itself.

THE ECHR

The court addressed the law as it applies to the relevant Articles (see paragraphs 34-39).

POLICE DUTIES

The police owe to the public a common law duty to prevent and detect crime. That function can include the use, retention and disclosure of images of individuals. In Bridges the Divisional Court (upheld by the Court of Appeal see (2020) 1 WLR 5037) held that the police may make reasonable use of a person’s photograph for policing purposes. Hence the use of CCTV, ANPR and body worn video footage. However, specific statutory authority is required for “intrusive measures” for example to take fingerprints, to enter a property to search and to take a DNA sample.

AGREED FACT -v- ISSUE IN THE CASE

The compilation of a watchlist falls within the statutory powers of the police in relation to arrested persons and by common law in relation to other persons of “possible interest” being steps necessary for keeping the peace, preventing crime or protecting property.

None of this was in issue; the issue was whether the MPS Policy met the necessary tests.

THE TESTS

This called for a reminder of what Lord Bingham pithily explained in Gillan v United Kingdom (2010) 50 EHRR:

“The lawfulness requirement in the Convention addresses supremely important features of the rule of law. The exercise of power by public officials, as it affects members of the public, must be governed by clear and publicly accessible rules of law. The public must not be vulnerable to interference by public officials acting on any personal whim, caprice, malice, predilection or purpose other than that for which the power was conferred. That is what, in this context, is meant by arbitrariness, which is the antithesis of legality.”

This is the requirement that the measure be both compatible with the rule of law and foreseeable in terms of its existence, meaning and consequences.

The key question is whether the exercise of the power is subject to principles, whether set out in law, policy or a combination of the two, which suffice to prevent decisions being dependent on the will of the decision-maker or arbitrary.

THE LFR CONSTRAINTS AND SAFEGUARDS

Despite the broad purpose of the Policy the court recognised that it contained significant constraints because LFR technology may only be used in three specific sets of circumstances. For the analysis of the prescribed circumstances see 94-116 of the judgment.

In short it can be used (i) to police either a crime or missing person “hotspot", (ii) to protect “protective security operations” and (iii) to locate people based on specific intelligence.

The Policy had a number of built-in safeguards.

It is mandatory for those who authorise LFR deployment to consider whether any particular deployment would be “a proportionate means of achieving the MPS’ policing objectives (see para 6.1 of the Policy which itself draws attention to the relevant Convention rights).

The Policy sets out stress tests for considering in three separate stages whether deployment of LFR would be proportionate in the particular circumstances.

It identifies the specific roles and duties of the officers who carry out LFR deployment. It includes rolls to be performed by Gold, Silver and Bronze Commanders.

It also contains significant safeguards against the arbitrary deployment of LFR including the provision on application for its use of (i) a Community Impact Assessment (ii) an Equality Assessment and (iii) a Data Protection Impact Assessment. Other documents also complemented the Policy.

CONCLUSIONS

The court concluded that:- (i) the more intrusive the act complained of the more precise and specific must be the law said to justify it (ii) the Policy contained sufficient safeguards against arbitrary use (iii) the advance of technology, in particular Artificial Intelligence, did not engage the terms of the Policy under challenge nor its current lawfulness (iv) there was no evidence that the Policy failed on the grounds of discrimination (v) the Policy did not require the police to spell out in its published material every instance and every circumstance in which it will exercise a discretion or power (vi) the Policy was proportionate and provided the claimants with an adequate indication of the circumstances in which LFR will be used and will enable them to foresee, to a degree that is reasonable in the circumstances, the consequences of travelling in an area of London where LFR is in use.

Accordingly, the Policy was prescribed, was in accordance with the law, and its existence, meaning and consequences were both accessible and foreseeable.

Both grounds for challenge failed.

NB. 1. The court only addressed current technology and did not second-guess how matters might be considered if more advanced technology was deployed at some future date. Clearly an issue could arise as to whether any more sophisticated means of intrusion were in all the circumstances disproportionate to the  policing objectives.

2. The court considered witness statements filed on behalf of the claim and having done so emphasised that evidence given in support of a claim for judicial review must be relevant to determine the question of public law raised in the pleaded case. A duty to the court was imposed on a party’s lawyer to consider with care and objectivity whether the evidence put before the court - from a client or otherwise - is relevant and, if not, then to advise that it is inadmissible and a client should heed such advice. If this is not done, then costs implications may follow.