No dedicated statute or single regulator for facial recognition and biometric surveillance
Police live facial recognition runs on common-law powers, UK GDPR and a Surveillance Camera Code unrevised since 2021, while deployment races ahead. Thirteen of 43 forces use it, forty new vans were announced in January 2026, and the first fixed cameras went live in Croydon in October 2025. The Home Office consultation on a new legal framework closed on 12 February 2026 with no bill yet introduced. The ICO covers data protection only, the part-time advisory commissioner post sat vacant from August 2024 to November 2025, and the Bridges case set the only real precedent in 2020. The Ryder Review found the oversight patchy and ineffectual in 2022. Private-sector deployments, Facewatch in Sainsbury's, Sports Direct and Spar among others, sit outside any bespoke regime, with misidentification lawsuits pending and the ICO having closed its Facewatch inspection without action.
Biometric mass-identification is deploying at national scale under a legal framework courts have already found deficient once. Misidentifications, demographic bias and private watchlist abuses accumulate faster than case-by-case litigation can correct them, and public trust erodes as they do.
A Biometrics Act: independent or judicial pre-authorisation for deployments, a statutory public register with published accuracy and demographic-differential statistics, due-process rules for watchlists including private operators, and a consolidated statutory regulator. The closed February 2026 consultation gives civil society a vehicle to hold to Ryder Review standards.
// State-led: Instrument: a Biometrics Act with statutory regulator and deployment register, turning the closed Feb 2026 consultation into primary legislation.
The consultation closed in February 2026 with no bill while thirteen forces, forty new vans and live Croydon cameras run ahead under a framework courts already found deficient.
One gap, several dossiers: entries folded into this one (1)
The research pass surfaced this gap independently in more than one domain. Those entries are merged here so the map counts it once: the same Biometrics Act converting the Home Office consultation into statutory authorisation, a deployment register and a single regulator.
№ 155 · No statutory framework (and fragile oversight) for police facial recognition (Policy (lens))
No dedicated legislation governs live facial recognition (LFR); police use rests on common law, PACE 1984, the Human Rights Act, Equality Act, UK GDPR/DPA 2018 and the Bridges case law. LFR is now used by 13 of 43 forces in England and Wales with a Home Office-backed national rollout planned; the Home Office consultation on a new legal framework closed 12 February 2026 with no bill yet announced. Oversight is fragile: the Biometrics and Surveillance Camera Commissioner role sat vacant or interim for over a year until William Webster's appointment (November 2025), after the abandoned DPDI Bill had proposed abolishing it. Ada Lovelace Institute, CETaS, POST and the ICO provide analysis and partial data-protection oversight, but none can supply the missing authorisation regime.
Its fill: A Biometrics and Public-Space Surveillance Act converting the December 2025 Home Office consultation into legislation: statutory authorisation rules for watchlists and deployments, mandatory accuracy/bias standards, independent pre-authorisation, and a consolidated oversight body on a durable statutory footing with reporting duties. Responsible department: Home Office; select committee interest: Home Affairs Committee, JCHR.