Bridges, R (On Application of) v The Chief Constable of South Wales Police

The police may use automated facial recognition under their existing common-law powers to prevent and detect crime. Its use engages Article 8 because facial biometric data is unique personal information, even where it is captured and processed only momentarily in a public place. The requirement that an interference be in accordance with the law may be satisfied by a combination of general legislation, statutory codes and local operational policies. The use must nevertheless be necessary, proportionate and protected against arbitrary exercise. Under the Data Protection Act 2018, processing facial biometrics through AFR is sensitive processing, including in respect of members of the public who are not on a watchlist. The statutory requirements of strict necessity, a Schedule 8 condition and an appropriate policy document apply. The particular deployments were proportionate, and the judicial review claim was dismissed.

The claimant challenged South Wales Police’s use of Automated Facial Recognition Locate technology during two public deployments in Cardiff. He alleged breaches of Article 8 ECHR, the Data Protection Act 1998, the Data Protection Act 2018 and the public-sector equality duty under section 149 of the Equality Act 2010.

The central questions were whether AFR Locate interfered with Article 8 rights, whether its use was sufficiently based in law and proportionate, whether it complied with data-protection requirements, and whether the police had properly considered possible discriminatory effects.

1. Outcome. The claim for judicial review was dismissed on all grounds.
2. Article 8 engagement. AFR Locate involved capturing facial images, extracting biometric data and comparing that data with watchlist information. Facial biometrics are unique identifiers. Their capture, storage and processing engage Article 8 even where the data is discarded almost immediately and is never viewed by a human operator. Being in a public place does not prevent Article 8 from applying.
3. Legal basis. The police’s common-law duty and power to prevent and detect crime authorised reasonable use of AFR Locate. The technology did not involve physical intrusion, entry onto private property or interference with bodily integrity. The legal framework consisted cumulatively of the common law, the Data Protection Act 2018, the Surveillance Camera Code of Practice and South Wales Police policies. That framework supplied sufficient accessibility, foreseeability and safeguards against arbitrariness.
4. Proportionality. Applying the four-stage test in Bank Mellat v Her Majesty's Treasury (No 2) [2014] AC 700, the legitimate aim and rational connection were common ground. The deployments were limited in time and area, overt, targeted at persons of legitimate police interest and subject to human verification before intervention. They struck a fair balance. Future deployments remained fact-sensitive and would require justification on their individual facts.
5. Data protection. Facial biometric data captured from members of the public was personal data because AFR individuated each person. AFR involved sensitive processing under section 35(8)(b) of the Data Protection Act 2018. The strict-necessity requirement and the Schedule 8 condition based on a function conferred by law and substantial public interest were satisfied. The court considered the police policy document’s adequacy under section 42(2) open to question, but left that matter for reconsideration in light of further guidance. The impact assessment complied with section 64.
6. Equality duty. The April 2017 equality assessment demonstrated due regard to the statutory criteria. At that time there was no sufficient evidential basis requiring the police to assume that the software produced discriminatory results. The duty remained relevant to the continuing trial and future review.