These templates are intended for individuals who want to formally exercise their data protection rights, or to raise a complaint about the use of facial recognition technology in the UK.
Simply cut and paste the text as needed.
Introduction
1. Subject Access Request (SAR) Template — Who should use it
Use the SAR template (below) if you want to find out what personal data an organisation holds about you.
Typical users include:
Individuals who believe they may have been captured by facial recognition systems
People who want to confirm whether their biometric data has been processed
Anyone seeking transparency from organisations (public or private) about their data
For example, you might send this to:
A police force such as the Metropolitan Police Service
A private company or venue using surveillance systems
Any organisation that may have recorded or processed your image
Goal: Obtain records, processing details, and any biometric data tied to you.
2. Formal Complaint Template — Who should use it
Use the complaint template (below) if you believe facial recognition was used improperly, unfairly, or without proper transparency.
Typical users include:
Individuals who noticed or suspect facial recognition was used in a specific place or incident
People who were incorrectly identified or adversely affected
Anyone concerned about lack of signage, consent, or justification
Individuals questioning proportionality or legality of deployment
Goal: Challenge the organisation’s practices and request justification, review, or corrective action.
3. When to use each (simple distinction)
Use the SAR template first if you want facts and evidence about what data is held about you
Use the complaint template if you want to challenge how or why facial recognition was used
In many cases, people use both:
SAR → gather information
Complaint → raise concerns using that information
4. Who typically uses these in practice
Private individuals concerned about privacy
Activists and civil liberties advocates (e.g. groups like Privacy International)
Legal professionals gathering evidence for a case
People affected by police or public surveillance deployments
5. Where these requests can lead
If issues aren’t resolved through the organisation, individuals often escalate to the Information Commissioner's Office, which oversees compliance with UK data protection law.
Template for Access Request
Subject: Access Request (UK GDPR)
Dear [Organisation Name / Data Protection Officer],
I am writing to make a Subject Access Request under Article 15 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please provide the following information:
• Confirmation as to whether you are processing personal data relating to me
• A copy of all personal data you hold about me
• The purposes of processing
• The categories of personal data concerned
• The recipients or categories of recipients to whom the data has been disclosed
• The source of the data, where it was not collected directly from me
• The envisaged retention period for the data, or the criteria used to determine that period
• Details of any automated decision-making or profiling applied to my data, including meaningful information about the logic involved
If facial recognition or biometric processing has been used in relation to my data, please include:
• Any biometric templates or related identifiers associated with me
• The basis on which this data was processed
• The source of any images used
• Details of any matches, flags, or alerts generated
Please provide the information in electronic form where possible.
For identification purposes, I am happy to provide additional information if required to confirm my identity.
Please acknowledge receipt of this request and respond within the statutory one-month timeframe.
Yours faithfully,
[Your Full Name]
[Your Address]
[Your Email Address]
[Optional: Phone Number]
Template for formal complaint regarding facial recognition use
Subject: Formal Complaint Regarding Facial Recognition Use
Dear [Organisation Name / Complaints Department],
I am writing to submit a formal complaint regarding the use of facial recognition technology by your organisation.
On [date], at approximately [time], at [location], I believe facial recognition technology was used in a manner that raises concerns regarding legality, transparency, and fairness.
My concerns are as follows:
Lack of clear and adequate notice regarding the use of facial recognition
Uncertainty about the lawful basis for processing biometric data
Concerns about proportionality and necessity of the deployment
Potential inaccuracies or risks associated with identification
Insufficient safeguards to protect individual privacy rights
I request the following:
A full explanation of the legal basis for the use of facial recognition in this instance
Details of how personal and biometric data is collected, processed, stored, and shared
Information about the policies and safeguards in place governing its use
Confirmation of whether my data has been processed, and if so, details of that processing
Details of how your organisation ensures compliance with data protection and human rights obligations
Please treat this as a formal complaint and provide a written response outlining the outcome of your investigation and any corrective actions taken.
If I am not satisfied with your response, I may consider escalating this matter to the appropriate regulatory authority.
I look forward to your response.
Yours faithfully,
[Your Full Name]
[Your Address]
[Your Email Address]
[Optional: Phone Number]

Comments
Post a Comment