“3. Compliance with Data Protection Principles a) 'lawfulness and fairness' The lawfulness of South Wales Police processing is derived from its official functions as a UK police service, which includes the investigation and detection of crime and the apprehension of offenders, including acting in obedience to court warrants that require the arrest of defendants who have failed to attend court. b) 'data minimisation' South Wales police only processes sensitive personal data when permitted to do so by law. Such personal data is collected for explicit and legitimate purposes such as biometric data during the deployment of Automatic Facial Recognition technology. c) 'accuracy' During AFR Locate deployments South Wales Police collects the information necessary to determine whether the individual is on a watchlist. If an intervention is made the process will not prompt data subjects to answer questions and provide information that is not required. Where processing is for research and analysis purposes, wherever possible this is done using anonymised or deidentified data sets. d) 'storage limitation' Providing complete and accurate information is required when constructing a watchlist. During AFR Locate deployments watchlists will be constructed on the day of deployment and where the deployments extend beyond 24 hours these will be amended daily. Where permitted by law and when it is reasonable and proportionate to do so, South Wales Police may check this information with other organisations – for example other police and law enforcement services. If a change is reported by a data subject to one service or a part of South Wales Police, whenever possible this is also used to update the AFR application, both to improve accuracy and avoid the data subject having to report the same information multiple times. e) 'integrity and confidentiality' South Wales Police has a comprehensive set of retention policies in place which are published online, further information specific to AFR can be found on SWP AFR webpage. All staff handling South Wales Police information are security cleared and required to complete annual training on the importance of security, and how to handle information appropriately. In addition to having security guidance and policies embedded throughout SWP business, SWP also has specialist security, cyber and resilience staff to help ensure that information is protected from risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.”
SWP Standard Operating Procedures (“SOP”)
SWP has Automatic Facial Recognition SOP which apply to their use of AFR. They were published in November 2018 (i.e. after the dates of the 2 events in question), when a separate facial recognition section was added to SWP's website, and the SOPs were published on that webpage. The SOP's primary features include (see especially pages 6 and 14):
A stipulation that watchlists should be “proportionate and necessary” for each deployment and primary factors for the inclusion on watchlists include will be “watchlist size, image quality, image provenance and rationale for inclusion”.
The numbers of images included within a watchlist cannot exceed 2,000 due to contract restrictions “but in any event1 in 1000 false positive alert rate should not be exceeded”.
Children under the age of 18 will not normally feature in a watchlist due to “the reduced accuracy of the system when considering immature faces”.
The decision for an AFR deployment wherever possible will ultimately be made by the Silver Commander.
The rationale for the deployment of AFR is to be recorded in a pre-deployment report.
Signs advertising the use of the technology are to be deployed to ensure that where possible an individual is aware of the deployment before their image is captured.
Interventions are not to be made on the basis of a similarity score alone and when an intervention is made intervention officer will establish the identity of the individual by traditional policing methods.
Details of the retention of different types of information gathered during an AFR deployment.
SWP Operational Advice
SWP have also issued guidance in the form of “Operational Advice for Police Trials of Live Facial Recognition” for use by officers conducting the trials which has been submitted to the National Police Chiefs Council.
ORDER
BEFORE: THE MASTER OF THE ROLLS, THE PRESIDENT OF THE QUEEN’S BENCH DIVISION, AND LORD JUSTICE SINGH
UPON hearing (by way of video link) Dan Squires QC and Aidan Wills of Counsel for the Appellant, Jason Beer QC and Francesca Whitelaw of Counsel for the Respondent, Gerry Facenna QC and Eric Metcalfe of Counsel for the Information Commissioner, Richard O’Brien of Counsel and Thomas Yarrow of Counsel for the Secretary State for the Home Department, and Andrew Sharland QC and Stephen Kosmin of Counsel for the Surveillance Camera Commissioner
AND UPON receiving written submissions from Fiona Barton QC for the Police and Crime Commissioner for South Wales
AND UPON the parties having agreed that each shall bear their own costs
AND UPON the handing down of a judgment on 11 August 2020
IT IS ORDERED THAT:
The appeal is allowed on Grounds 1, 3 and 5.
Grounds 2 and 4 of the appeal are dismissed.
There shall be no order as to costs.
AND IT IS DECLARED THAT:
The Respondent’s use of Live Automated Facial Recognition technology on 21 December 2017 and 27 March 2018 and on an ongoing basis, which engaged Article 8(1) of the European Convention on Human Rights, was not in accordance with the law for the purposes of Article 8(2).
As a consequence of the declaration set out in paragraph 4 above, in respect of the Respondent’s ongoing use of Live Automated Facial Recognition technology, its Data Protection Impact Assessment did not comply with section 64(3) (b) and (c) of the Data Protection Act 2018 .