Since, it was submitted, there was a breach of section 35(2) , there could not be “accordance with the law” for the purpose of Article 8(2). Detailed submissions were made as to the requirements of strict necessity, citing authority from both the Court of Justice of the European Union and the Supreme Court of the UK.
At the hearing before us we made it clear that we did not regard these submissions as properly falling within the scope of the present appeal. The submissions were made by an intervener in the context of Ground 1 in the appeal. Ground 1 was formulated as follows on behalf of the Appellant:
“The Divisional Court erred in concluding that the interference with the Appellant’s rights under Article 8(1) … occasioned by the Respondent’s use of live automated facial recognition technology … on 21 December 2017 and 27 March 2018 and on an ongoing basis was/is in accordance with the law for the purposes of Article 8(2) ECHR.”
It is clear therefore that the submissions advanced on behalf of the Information Commissioner, at least in writing, went beyond the scope of Ground 1 since they focused on the requirements of domestic legislation, namely section 35 of the DPA 2018.
The Surveillance Camera Code of Practice
Section 29 of the PFA 2012 imposes a duty on the Secretary of State to prepare a Code of Practice containing guidance about surveillance camera systems. The section goes on to prescribe what the Code must contain and what it may include provision about. The term “surveillance camera systems” is defined in subsection (6) to mean:
“(a) closed circuit television or automatic number plate recognition systems, (b) any other systems for recording or viewing visual images for surveillance purposes, (c) any systems for storing, receiving, transmitting, processing or checking images or information obtained by systems falling within paragraph (a) or (b), or (d) any other systems associated with, or otherwise connected with, systems falling within paragraph (a) (b) or (c).”
It was common ground that AFR falls within that definition.
Under section 30 of the PFA 2012 the Secretary of State must lay a draft of an order providing for the Code to come into force, and the Code itself, before Parliament. She must then make the order and issue the Code if the draft is approved by resolution of each House of Parliament. Such an order is to be in the form of a statutory instrument.
The effect of the Code is governed by section 33 of the PFA 2012 . A relevant authority must have regard to the Code when exercising any functions to which the Code relates: see subsection (1). A relevant authority includes for this purpose any chief officer of a police force in England and Wales: see subsection (5)(j). A failure on the part of any person to act in accordance with any provision of the Code does not
of itself make that person liable to criminal or civil proceedings: see subsection (2). The Code is admissible in evidence in any such proceedings: see subsection (3). In particular, a court or tribunal may take into account a failure by a relevant authority to have regard to the Code: see sub section (4 ).
Under section 34 of the PFA 2012 the Secretary of State must appoint a person as the Surveillance Camera Commissioner. The Commissioner has the following functions: (a) encouraging compliance with the Code, (b) reviewing the operation of the Code, and (c) providing advice about the Code (including changes to it or breaches of it). It is common ground that the Commissioner does not have powers of enforcement, although the Information Commissioner does.
The Surveillance Camera Code of Practice was issued by the Secretary of State for the Home Department in June 2013, under section 30 of the PFA 2012 . It provides guidance on the appropriate and effective use of surveillance camera systems by relevant authorities, including for this purpose the police. It is general in its scope and is not specifically concerned with facial recognition technology, although that topic is referred to in the Code. The Code sets out 12 guiding principles at para. 2.6. By way of example the first guiding principle is that:
“Use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.”
Para. 3.2.3 specifically addresses the subject of facial recognition in the following way:
“Any use of facial recognition or other biometric characteristic recognition systems needs to be clearly justified and proportionate in meeting the stated purpose, and be suitably validated. It should always involve human intervention before decisions are taken that affect an individual adversely.”
Para. 4.12.1 states:
“Any use of technologies such as ANPR or facial recognition systems which may rely on the accuracy of information generated elsewhere such as databases provided by others should not be introduced without regular assessment to ensure the underlying data is fit for purpose.”
Para. 4.12.2 states:
“A system operator should have a clear policy to determine the inclusion of a vehicle registration number or a known individual’s details on the reference database associated with such technology. A system operator should ensure that reference data is not retained for longer than necessary to fulfil the purpose for which it was originally added to a database.” 118.In the light of the fact that the Code does deal specifically with such matters, it seems to us that it could in principle also deal specifically with what the requirements are for inclusion on a police force’s watchlist. It could also deal with what policies should contain in relation to the location of the deployment of AFR Locate. As we have said earlier, the question whether such policies must be set out in a national document such as this Code or whether they should be set out in local policies determined by each police force is not a matter for this Court. It may be prudent, however, for there to be at least consistency in the content of local policies and that might be the appropriate subject of an amendment to the Code by the Secretary of State.
Our attention was also drawn to the guidance which has been published by the
Surveillance Camera Commissioner (March 2019) on ‘The Police Use of Automated Facial Recognition Technology with Surveillance Camera Systems’.
The guidance does address the question of images of persons on a watchlist at paras. 14.1-14.3. We note, however, that the guidance does not contain any requirements as to the content of local police policies as to who can be put on a watchlist. Nor does it contain any guidance as to what local policies should contain as to where AFR can be deployed. Those, as we have said, are the two critical defects in the current legal framework.
SWP’s local policies
As we have said, in principle a police force’s local policies can constitute relevant “law” in the present context, provided they are published. The critical question, in our view, is how much discretion the policies in this case leave to the police, particularly in relation to the question who can be put on a watchlist and the question of the location where AFR Locate can be deployed.
When asked about these questions at the hearing Mr Beer helpfully drew our attention to a number of documents.