13 August 2020

Biometrics and automated facial recognition

The media summary for R (Bridges) v CC South Wales [2020] EWCA Civ 1058 states

This appeal concerns the lawfulness of the use of automated facial recognition technology (“AFR”) in a pilot project by the South Wales Police Force (“SWP”). AFR is a new technology used to assess whether two facial images depict the same person. The specific type of AFR at issue, known as AFR Locate, works by extracting faces captured in a live feed from a camera and automatically comparing them to faces on a watchlist. If no match is detected, the software will automatically delete the facial image captured from the live feed. If a match is detected, the technology produces an alert and the person responsible for the technology, usually a police officer, will review the images to determine whether to make an intervention. 

SWP deployed AFR Locate on about 50 occasions between May 2017 and April 2019 at a variety of public events. These deployments were overt, rather than secret. The watchlists used in deployments included persons wanted on warrants, persons who had escaped from custody, persons suspected of having committed crimes, persons who may be in need of protection, vulnerable persons, persons of possible interest to SWP for intelligence purposes, and persons whose presence at a particular event causes particular concern. To date SWP watchlists have comprised between 400-800 people, and the maximum capacity for a watchlist is 2,000 images. AFR Locate is capable of scanning 50 faces per second. Over the 50 deployments undertaken in 2017 and 2018, it is estimated that around 500,000 faces may have been scanned. The overwhelming majority of faces scanned will be of persons not on a watchlist, and therefore will be automatically deleted. 

The Appellant, Edward Bridges, is a civil liberties campaigner who lives in Cardiff. He has been supported by Liberty, the civil liberties membership organisation. Mr Bridges was in the vicinity of two deployments of AFR Locate by SWP in Cardiff, first on 21 December 2017 on Queen Street in Cardiff city centre and second on 27 March 2018 at the Defence Procurement, Research, Technology and Exportability Exhibition held at the Motorpoint Arena in Cardiff. 

Mr Bridges was not included on an SWP watchlist in its deployments of AFR, but contends that given his proximity to the cameras, his image was recorded by the AFR system, even if deleted almost immediately after. SWP did not contest this. Mr Bridges brought a claim for judicial review on the basis that AFR was not compatible with the right to respect for private life under Article 8 of the European Convention on Human Rights, data protection legislation, and the Public Sector Equality Duty (“PSED”) under section 149 of the Equality Act 2010

On 4 September 2019 the Divisional Court (“DC”) dismissed Mr Bridges’s claim for judicial review on all grounds. They found that although the right to privacy under Article 8 of the Convention was engaged, the interference with rights was in accordance with law and proportionate. The DC dismissed both data protection claims, brought under the Data Protection Act 1998 and Data Protection Act 2018 (“DPA 2018”). Finally, Mr Bridges argued that SWP breached the PSED by not considering the possibility that AFR Locate might produce results that were indirectly discriminatory on the grounds of sex and/or race because it produces a higher rate of positive matches for female faces and/or for black and minority ethnic faces. The DC held that the PSED was not breached because there was no suggestion in April 2017 when the AFR Locate trial commenced that the software might operate in a way that was indirectly discriminatory. 

Mr Bridges appealed on five grounds. The decision of the Court of Appeal was unanimous. 

The appeal succeeded on Ground 1, that the DC erred in concluding that SWP’s interference with Mr Bridges’s Article 8(1) rights was “in accordance with the law” for the purposes of Article 8(2). The Court held that although the legal framework comprised primary legislation (DPA 2018), secondary legislation (The Surveillance Camera Code of Practice), and local policies promulgated by SWP, there was no clear guidance on where AFR Locate could be used and who could be put on a watchlist. The Court held that this was too broad a discretion to afford to the police officers to meet the standard required by Article 8(2). 

The appeal failed on Ground 2, that the DC erred in determining that SWP’s use of AFR was a proportionate interference with Article 8 rights under Article 8(2). The Court held that the DC had correctly conducted a weighing exercise with one side being the actual and anticipated benefits of AFR Locate and the other side being the impact of AFR deployment on Mr Bridges. The benefits were potentially great, and the impact on Mr Bridges was minor, and so the use of AFR was proportionate under Article 8(2). 

The appeal succeeded on Ground 3, that the DC was wrong to hold that SWP provided an adequate “data protection impact assessment” (“DPIA”) as required by section 64 of the DPA 2018. The Court found that, as the DPIA was written on the basis that Article 8 was not infringed, the DPIA was deficient. 

The appeal failed on Ground 4, that the DC was wrong to not reach a conclusion as to whether SWP had in place an “appropriate policy document” within the meaning of section 42 DPA 2018. The Court held that the DC was right to not reach a conclusion on this point because it did not need to be decided. The two specific deployments of AFR Locate which were the basis of Mr Bridges’s claim occurred before the DPA 2018 came into force. 

The appeal succeeded on Ground 5, that the DC was wrong to hold that SWP complied with the PSED. The Court held that the purpose of the PSED was to ensure that public authorities give thought to whether a policy will have a discriminatory potential impact. SWP erred by not taking reasonable steps to make enquiries about whether the AFR Locate software had bias on racial or sex grounds. The Court did note, however, that there was no clear evidence that AFR Locate software was in fact biased on the grounds of race and/or sex. 

The Court has granted a declaration to reflect the points on which the appeal succeeded. 

SWP have confirmed that they do not seek to appeal against this judgment.