Bridges, R (On the Application Of) v South Wales Police

Police use of live automated facial recognition requires an accessible and foreseeable legal framework which sufficiently constrains discretion over watchlist membership and deployment locations. General data protection safeguards and requirements of necessity and proportionality do not alone supply those constraints. The trial of new technology remains subject to the same legal requirements.

A data protection impact assessment must assess the risks arising from deficiencies in that framework and identify measures to address them. The public sector equality duty requires rigorous, continuing and non-delegable consideration of potential discriminatory effects. Authorities must take reasonable steps to investigate possible racial or sex bias in facial recognition software. Proof of actual discrimination is unnecessary. Human checking of matches and a supplier’s commercial confidentiality do not discharge that duty.

Edward Bridges, a Cardiff resident and civil liberties campaigner, challenged the Chief Constable of South Wales Police’s use of live automated facial recognition, known as AFR Locate. Cameras captured facial images in public places and compared extracted biometric data with police watchlists. Unmatched biometric data was automatically deleted almost instantaneously. The police accepted that Bridges’s image had been captured during deployments at a shopping street and outside a defence exhibition.

The Divisional Court dismissed his judicial review claim: [2019] EWHC 2341 (Admin). Bridges appealed on five grounds concerning the sufficiency of the legal framework under Article 8, proportionality, the data protection impact assessment, the appropriate policy document for sensitive processing, and compliance with the public sector equality duty. The central issues were whether police discretion was sufficiently constrained and whether the required data protection and equality assessments had been lawfully undertaken.

Appeal allowed on Grounds 1, 3 and 5; Grounds 2 and 4 dismissed.

1. The legal framework governing AFR Locate failed the Article 8(2) requirement of accordance with the law. Published local policies could contribute to that framework, and exhaustive statutory codification was unnecessary. Nevertheless, the framework had to indicate sufficiently clearly the scope and exercise of police discretion. Existing provisions left excessive discretion over who could enter a watchlist and where deployment could occur. A category covering persons of intelligence interest could encompass anyone of interest to the police. Deployment policies described practice without imposing sufficient normative limits ([55]–[58], [90]–[94], [121]–[130]).

2. The required precision depended on the interference’s character. AFR involved novel, automated processing of sensitive biometric data from large numbers of people, most of whom were of no police interest. It differed from ordinary photography and CCTV. The court examined the actual local, overt deployments rather than hypothetical national surveillance. Existing data protection safeguards enabled proportionality to be examined, but did not cure the excessive discretion. The court also indicated that automatic, almost instantaneous deletion of unmatched data should be expressed as a requirement of an adequate framework ([60]–[70], [83]–[96]).

3. The data protection impact assessment recognised privacy concerns and the processing of members of the public. Its material defect was its assumption that the deployments satisfied Article 8. Consequently, it failed properly to assess risks arising from the deficient framework and measures to address them, contrary to section 64(3)(b) and (c) of the Data Protection Act 2018 ([151]–[154]).

4. The Divisional Court appropriately left unresolved whether the November 2018 appropriate policy document satisfied section 42. The specific deployments preceded the Act, the document required continuing review, and the Information Commissioner considered it sufficient, although barely. Subsequent guidance had prompted revision. The court made no final determination of the earlier document’s compliance ([159]–[162]).

5. The public sector equality duty was a duty of process requiring substantive, rigorous and continuing consideration. Applying the principles in R (Bracking) v Secretary of State for Work and Pensions [2013] EWCA Civ 1345, the police had failed to take all reasonable steps to investigate possible racial or sex bias. Actual bias was not established and need not be proved. Human checking, incomplete deployment statistics and supplier confidentiality did not discharge the non-delegable duty. A trial attracted the same duty ([174]–[201]).

6. Obiter: the proportionality challenge disclosed no error. The claim concerned particular deployments affecting the claimant. Proportionality required judgement rather than multiplying negligible individual interference by the number affected; challenges to general measures might require broader assessment ([131]–[144]).

Declarations were granted reflecting the Article 8, impact assessment and equality duty breaches. The Surveillance Camera Commissioner’s application to adduce immaterial fresh evidence was refused. There was no order as to costs ([208]–[210]; order).

• Court of Appeal (Civil Division): [2020] EWCA Civ 1058 . Allowed the appeal on the legal framework, data protection impact assessment and public sector equality duty grounds. Dismissed the proportionality and appropriate policy document grounds. Granted declarations and made no order as to costs.
• High Court, Queen’s Bench Division (Administrative Court), Divisional Court: [2019] EWHC 2341 (Admin) . Haddon-Cave LJ and Swift J dismissed the judicial review claim by order dated 4 September 2019.