No dedicated statute or single regulator for facial recognition and biometric surveillance
Police LFR runs on common-law powers, UK GDPR/DPA 2018 and a Surveillance Camera Code unrevised since 2021, while deployment races ahead: 13 of 43 forces use LFR, 40 new vans were announced in January 2026 and the first fixed cameras went live in Croydon in October 2025. The Home Office consultation on a new legal framework closed 12 February 2026 with no bill yet introduced. Partial coverage: the ICO (data protection only), the BSCC (part-time, advisory, post vacant Aug 2024–Nov 2025), and case law (Bridges 2020). The Ryder Review (2022) found this oversight 'patchy and ineffectual'. Private-sector LFR (Facewatch in Sainsbury's, Sports Direct, Spar and others, with misidentification lawsuits pending) sits outside any bespoke regime after the ICO closed its Facewatch inspection without action.
The UK is deploying biometric mass-identification at national scale under a legal framework courts already found deficient once. Without statutory authorisation rules, misidentifications, demographic bias and private watchlist abuses accumulate faster than case-by-case litigation can correct, and public trust erodes.
A Biometrics Act: independent or judicial pre-authorisation for LFR deployments, a statutory public deployment register with published accuracy and demographic-differential statistics, due-process rules for watchlists including private operators, and a consolidated statutory regulator (an empowered BSCC or new Biometrics Commission), turning the closed Feb 2026 consultation into legislation civil society can hold to Ryder Review standards.
// State-led: Instrument: a Biometrics Act with statutory regulator and deployment register, turning the closed Feb 2026 consultation into primary legislation.
The Feb 2026 Home Office consultation closed with no bill while thirteen forces, forty new vans and live Croydon cameras race ahead under a framework courts already found deficient.
One gap, several dossiers: entries folded into this one (1)
The research pass surfaced this gap independently in more than one domain. Those entries are merged here so the map counts it once: the same Biometrics Act converting the Home Office consultation into statutory authorisation, a deployment register and a single regulator.
№ 155 · No statutory framework (and fragile oversight) for police facial recognition (Policy (lens))
No dedicated legislation governs live facial recognition (LFR); police use rests on common law, PACE 1984, the Human Rights Act, Equality Act, UK GDPR/DPA 2018 and the Bridges case law. LFR is now used by 13 of 43 forces in England and Wales with a Home Office-backed national rollout planned; the Home Office consultation on a new legal framework closed 12 February 2026 with no bill yet announced. Oversight is fragile: the Biometrics and Surveillance Camera Commissioner role sat vacant or interim for over a year until William Webster's appointment (November 2025), after the abandoned DPDI Bill had proposed abolishing it. Ada Lovelace Institute, CETaS, POST and the ICO provide analysis and partial data-protection oversight, but none can supply the missing authorisation regime.
Its fill: A Biometrics and Public-Space Surveillance Act converting the December 2025 Home Office consultation into legislation: statutory authorisation rules for watchlists and deployments, mandatory accuracy/bias standards, independent pre-authorisation, and a consolidated oversight body on a durable statutory footing with reporting duties. Responsible department: Home Office; select committee interest: Home Affairs Committee, JCHR.