How to Legally Challenge Facial Recognition

How to Legally Challenge Facial Recognition Use in the UK (Step-by-Step Guide)

Facial recognition is increasingly used by police and private organisations in the UK, but its use is not beyond challenge. 

If you believe your data has been misused, or that facial recognition has been applied unlawfully or unfairly, there is a structured legal process you can follow.

This guide explains the legal routes available, the grounds for challenge, and how to escalate a complaint effectively.

1. Understand the Legal Basis for Challenge

Facial recognition in the UK must comply with several legal frameworks:

• UK GDPR & Data Protection Act 2018

• Human Rights Act 1998 (Article 8 – right to privacy)

• Common law principles of fairness and proportionality

Biometric data (including facial images used for identification) is considered special category data, meaning it requires stricter handling and justification.

Oversight is primarily handled by the Information Commissioner's Office.

2. Grounds for Challenging Facial Recognition Use

You may have grounds to challenge facial recognition if:

A. Lack of Lawful Basis

The organisation cannot demonstrate a valid legal reason for processing biometric data.

B. Disproportionate Use

The deployment is not necessary or is excessive relative to its stated purpose.

C. Inadequate Safeguards

For example:

No clear policies governing use

Insufficient human oversight

Poor transparency

D. Data Protection Violations

Including:

Improper data storage

Retention beyond necessary periods

Failure to inform individuals

E. Misidentification or Harm

If you have been wrongly identified or negatively impacted.

3. Step-by-Step Legal Challenge Process

Step 1: Identify the Organisation Responsible

Determine who used the technology:

A police force (e.g. Metropolitan Police Service)

A private company or venue

A public authority

Step 2: Submit a Subject Access Request (SAR)

Under UK GDPR, you can request:

• Whether your data has been processed

• Copies of any biometric data held

• The purpose of processing

• Data sources and recipients

This is often the first formal step in gathering evidence.

Step 3: Raise a Complaint with the Organisation

Before escalating externally, submit a formal complaint to the organisation:

Explain your concerns clearly

Reference specific incidents if possible

Request explanations and corrective action

Many organisations have internal complaints procedures.

Step 4: Escalate to the ICO

If you are unsatisfied with the response, you can complain to the Information Commissioner's Office.

The ICO can:

Investigate the organisation

Assess compliance with data protection law

Issue enforcement notices or fines

They will typically ask whether you’ve already raised the issue with the organisation.

Step 5: Consider Judicial Review (for Public Authorities)

If the facial recognition use involves a public body (e.g. police), you may be able to challenge it through judicial review in the courts.

This is where a court examines whether the decision or action was:

• Lawful

• Rational

• Proportionate

• Taken with proper procedure

A key precedent in this area is the Bridges v South Wales Police case, where the court scrutinised the legality and safeguards of police facial recognition deployment.

Step 6: Seek Legal Advice

Given the complexity of biometric and public law, it is often advisable to consult:

A solicitor specialising in data protection or human rights law

Civil liberties organisations such as Privacy International

They can help assess the strength of your case and guide litigation strategy.

4. Evidence You Should Gather

To strengthen your challenge, collect:

• Dates, times, and locations of incidents

• Photographic or video evidence (if available)

• Correspondence with the organisation

• Copies of privacy notices or signage

• Any records obtained via SAR

5. Possible Outcomes of a Challenge

Depending on the route and outcome, you may achieve:

• Correction or deletion of personal data

• Changes to how facial recognition is deployed

• Formal findings of non-compliance

• Compensation (in some legal cases involving harm)

• Policy or procedural reforms

6. Time Limits and Practical Considerations

Complaints to the ICO should be made within a reasonable time after the issue arises.

Judicial review claims are typically subject to strict time limits (often within 3 months).

Legal processes can be complex and may require evidence and legal representation.

Key Takeaways

Facial recognition use in the UK is legally challengeable under data protection and human rights law.

The process usually begins with a subject access request and internal complaint.

The Information Commissioner's Office is the primary regulator for privacy concerns.

Courts can review public authority use through judicial review, with cases like Bridges v South Wales Police shaping current standards.

Advocacy groups such as Privacy International play a role in supporting broader challenges.