On 20 August 2025, the UK Information Commissioner’s Office (ICO) published an audit report on the use of facial recognition technology by South Wales Police and Gwent Police. Covering both live facial recognition and retrospective matching, it is the ICO’s latest move in sustained pressure on biometric scenarios.
Why police facial recognition is a regulatory focus
Facial recognition involves biometric data, which under UK law is special category personal data subject to a higher processing threshold. When the controller is a law enforcement body, the legality review is further compounded by the exercise of public power.
Live facial recognition is especially sensitive: it continuously scans unspecified crowds in public places, directly touching the boundaries of privacy and the right to assembly.
Audit rather than penalty as an enforcement tool
It is worth noting that this was an audit, not a penalty. The ICO’s approach to public bodies is usually to identify problems and require improvement through audit rather than impose fines directly.
The effect of that approach depends on follow-up: whether the remediation requirements in the audit report are implemented and whether review milestones are set. See the UK Upper Tribunal’s Clearview AI ruling.
The Clearview case dealt with extraterritorial jurisdiction and a commercial actor, while this audit deals with domestic public bodies. Together they sketch the full outline of UK facial recognition regulation.
Implications for companies and public bodies
First, processing biometric data requires an independent legal basis; general consent or a vague public interest is not enough.
Second, live and retrospective matching carry different risk levels and should be assessed separately with different safeguards.
Third, retain impact assessments and decision records, which are the basic materials for responding to audits and enquiries. See the obligations of major personal information processors.
The Chinese parallel
China has also taken a dedicated regulatory path for facial recognition. The Measures for the Security Management of the Application of Facial Recognition Technology centre on “application” and impose filing, notice and consent requirements. See the facial recognition filing guide.
Both paths share a common judgment: facial recognition should not rely on general personal information protection rules as a fallback and needs the higher threshold of dedicated rules. See the global statement on AI-generated images and privacy.
This article is based on public information on the facial recognition audit report published by the UK Information Commissioner’s Office and is for reference only; it does not constitute legal advice.