
How to Legally Challenge Facial Recognition Use in the UK (Step-by-Step Guide)
Facial recognition is increasingly used by police and private organisations in the UK, but its use is not beyond challenge.
If you believe your data has been misused, or that facial recognition has been applied unlawfully or unfairly, there is a structured legal process you can follow.
This guide explains the legal routes available, the grounds for challenge, and how to escalate a complaint effectively.
1. Understand the Legal Basis for Challenge
Facial recognition in the UK must comply with several legal frameworks:
• UK GDPR & Data Protection Act 2018
• Human Rights Act 1998 (Article 8 – right to privacy)
• Common law principles of fairness and proportionality
Biometric data (including facial images used for identification) is considered special category data, meaning it requires stricter handling and justification.
Oversight is primarily handled by the Information Commissioner's Office.
2. Grounds for Challenging Facial Recognition Use
You may have grounds to challenge facial recognition if:
A. Lack of Lawful Basis
The organisation cannot demonstrate a valid legal reason for processing biometric data.
B. Disproportionate Use
The deployment is not necessary or is excessive relative to its stated purpose.
C. Inadequate Safeguards
For example:
No clear policies governing use
Insufficient human oversight
Poor transparency
D. Data Protection Violations
Including:
Improper data storage
Retention beyond necessary periods
Failure to inform individuals
E. Misidentification or Harm
If you have been wrongly identified or negatively impacted.
3. Step-by-Step Legal Challenge Process
Step 1: Identify the Organisation Responsible
Determine who used the technology:
A police force (e.g. Metropolitan Police Service)
A private company or venue
A public authority
Step 2: Submit a Subject Access Request (SAR)
Under UK GDPR, you can request:
• Whether your data has been processed
• Copies of any biometric data held
• The purpose of processing
• Data sources and recipients
This is often the first formal step in gathering evidence.
Step 3: Raise a Complaint with the Organisation
Before escalating externally, submit a formal complaint to the organisation:
Explain your concerns clearly
Reference specific incidents if possible
Request explanations and corrective action
Many organisations have internal complaints procedures.
Step 4: Escalate to the ICO
If you are unsatisfied with the response, you can complain to the Information Commissioner's Office.
The ICO can:
Investigate the organisation
Assess compliance with data protection law
Issue enforcement notices or fines
They will typically ask whether you’ve already raised the issue with the organisation.
Step 5: Consider Judicial Review (for Public Authorities)
If the facial recognition use involves a public body (e.g. police), you may be able to challenge it through judicial review in the courts.
This is where a court examines whether the decision or action was:
• Lawful
• Rational
• Proportionate
• Taken with proper procedure
A key precedent in this area is the Bridges v South Wales Police case, where the court scrutinised the legality and safeguards of police facial recognition deployment.
Step 6: Seek Legal Advice
Given the complexity of biometric and public law, it is often advisable to consult:
A solicitor specialising in data protection or human rights law
Civil liberties organisations such as Privacy International
They can help assess the strength of your case and guide litigation strategy.
4. Evidence You Should Gather
To strengthen your challenge, collect:
• Dates, times, and locations of incidents
• Photographic or video evidence (if available)
• Correspondence with the organisation
• Copies of privacy notices or signage
• Any records obtained via SAR
5. Possible Outcomes of a Challenge
Depending on the route and outcome, you may achieve:
• Correction or deletion of personal data
• Changes to how facial recognition is deployed
• Formal findings of non-compliance
• Compensation (in some legal cases involving harm)
• Policy or procedural reforms
6. Time Limits and Practical Considerations
Complaints to the ICO should be made within a reasonable time after the issue arises.
Judicial review claims are typically subject to strict time limits (often within 3 months).
Legal processes can be complex and may require evidence and legal representation.
Key Takeaways
Facial recognition use in the UK is legally challengeable under data protection and human rights law.
The process usually begins with a subject access request and internal complaint.
The Information Commissioner's Office is the primary regulator for privacy concerns.
Courts can review public authority use through judicial review, with cases like Bridges v South Wales Police shaping current standards.
Advocacy groups such as Privacy International play a role in supporting broader challenges.
Comments
Post a Comment