Bridges, R (On the Application Of) v South Wales Police

Live automated facial recognition engages article 8 where it captures and automatically processes facial biometrics in public. A lawful framework must provide accessible and foreseeable safeguards against arbitrary use. In particular, it must sufficiently constrain the discretion to select persons for a watchlist and to select deployment locations.

A data protection impact assessment must properly assess the resulting risks and the measures addressing them under Data Protection Act 2018. The public sector equality duty is a continuing and rigorous duty of inquiry. A public authority using facial-recognition software must take reasonable steps to investigate possible racial or sex bias; it cannot rely on human review or on the absence of proof of bias.

Edward Bridges challenged South Wales Police’s overt use of AFR Locate at two Cardiff deployments and on an ongoing basis. The system captured facial images of members of the public, extracted biometric templates, and compared them with a police watchlist. Non-matched biometric data was automatically deleted almost immediately.

The Divisional Court dismissed the judicial-review claim: [2019] EWHC 2341 (Admin). The claimant appealed on article 8 legality and proportionality, the adequacy of the data protection impact assessment and appropriate policy document, and compliance with the public sector equality duty. The central issues were whether the safeguards governing watchlists and deployment locations had the required quality of law, and whether the police had properly assessed data-protection and equality risks.

1. Appeal allowed in part. The use of AFR Locate engaged article 8(1) of the European Convention on Human Rights. It was not in accordance with the law under article 8(2), because the applicable framework gave police officers excessively broad discretion over both who could be placed on a watchlist and where the system could be deployed.

2. The statutory data-protection regime, surveillance-camera code and local policies were important safeguards, and local policies could in principle form part of the relevant law. They did not, however, provide sufficiently clear criteria for the two critical discretionary choices. The policies permitted inclusion of persons where intelligence was required, a category capable of covering anyone of interest to police, and contained no normative restriction on deployment locations. Automatic, near-instantaneous deletion of non-matched data was an important safeguard which an adequate framework should require, rather than merely describe.

3. The court dismissed the proportionality ground. It was unnecessary once article 8 legality had failed, but the Divisional Court had not erred in assessing the two specific deployments. The negligible interference with each person whose data was immediately deleted did not acquire greater weight by simple multiplication.

4. The appeal succeeded under section 64(3)(b) and (c) of the Data Protection Act 2018. Because the DPIA proceeded on the basis that the article 8 requirements were satisfied, it failed properly to assess the risks arising from the unconstrained watchlist and location discretion and the measures needed to address them. The court dismissed the separate section 42 ground: the historic deployments pre-dated the 2018 Act, and it was appropriate not to make a final ruling on an evolving policy document that had since been revised following guidance.

5. The appeal also succeeded under section 149 of the Equality Act 2010. The public sector equality duty is continuing, non-delegable, substantive in its exercise and requires reasonable inquiry where relevant information is unavailable. South Wales Police had not done all that it reasonably could to investigate whether the software had racial or sex bias. Human review of alerts and statistics limited to alerted persons did not discharge that duty.

Declaratory relief was granted. Grounds 1, 3 and 5 succeeded; Grounds 2 and 4 were dismissed. There was no order as to costs.

• Court of Appeal (Civil Division). Allowed the appeal on Grounds 1, 3 and 5, dismissed Grounds 2 and 4, and granted declarations: [2020] EWCA Civ 1058.
• High Court, Queen’s Bench Division, Administrative Court (Divisional Court). Dismissed the claimant’s judicial-review challenge to the use of AFR Locate: [2019] EWHC 2341 (Admin).