Lawfulness of the use of live Automated Facial Recognition technology (AFR)
In this particular case, the appellant sought to challenge the use of AFR Locate by way of judicial review
R (on the Application of Edward Bridges) v the Chief Constable of South Wales Police (1), the Secretary of State for the Home Department (2) (interested party) the Information Commissioner (3), the Surveillance Camera Commissioner (4) and the Police and Crime Commissioner for South Wales (5) (interveners)
Court of Appeal (Civil Division).
Sir Terence Etherton MR, Dame Victoria Sharpe PQBD, and Lord Justice Singh
The court determined that the use of AFR was not in accordance with the law and therefore amounted to an infringement of an individual’s Article 8 European Convention of Human Rights (‘ECHR’) rights which could not be justified; the Data Protection Impact Assessment was inadequate and not compliant with the Data Protection Act 2018 (‘DPA’), Part 3, Section 64 (3); and the respondent had not taken reasonable steps to investigate whether the technology had a racial or gender bias, as required by the Public Sector Equality Duty (‘PSED’).
The appeal concerned the lawfulness of AFR Locate by South Wales Police in an ongoing pilot.
AFR Locate involves the deployment of surveillance cameras to capture digital images of members of the public, which are then processed and compared with digital images of persons on a watch list. If there is a match, the two images are then reviewed by an AFR operator, who is a police officer, to establish whether he or she believes that a match has in fact been made. If, upon reviewing the images, the AFR operator does not consider that they are a subject of interest, no further action is taken. If it is believed that there is a match, other officers stationed nearby may be notified and they will intervene if necessary. If there is no match, the images are immediately and automatically deleted without being viewed by a human. Prior to any deployment, the respondent (South Wales Police) takes steps to inform members of the public about AFR via its website, social media, signs at the scene and by handing out notices to those in the vicinity.
The appellant, a civil liberties campaigner, sought to challenge the use of AFR Locate by way of judicial review in relation to two incidents. The first was on 21 December 2017 where a marked AFR equipped van was deployed at Queen Street in Cardiff City Centre. The appellant was within the range of the cameras on that date and claimed that he did not see signage and was given no other warning indicating that AFR was in use prior to him being in close proximity. The second incident was on 27 March 2018 at the Motorpoint Arena in Cardiff. The appellant had attended a protest outside of the arena on that date. He alleged that prior to seeing the van he was not aware that AFR was in use and he did not observe South Wales Police officers providing any information about the use of AFR.
Judgment was given in the respondent’s favour by the Divisional Court on 4 September 2019. The Divisional Court found that Article 8 was engaged but that any interference was justified pursuant to Article 8 (2). It concluded that whilst the data obtained was personal and sensitive data it was processed lawfully and fairly and that the impact assessment prepared by the respondent did meet the requirements of Section 64 DPA 2018. It rejected the appellant’s claim that the respondent had failed to comply with its obligation under Section 149 of the Equality Act 2010.
The appellant sought to appeal that decision on the grounds that the Divisional Court had erred in concluding that the use of AFR Locate was in accordance with the law and proportionate for the purposes of Article 8 (2); that the Data Protection Impact Assessment complied with the requirements of Section 64 DPA 2018 and that the respondent complied with its PSED. It was further appealed on the basis that the court was wrong to decline to reach a conclusion as to whether the respondent had in place an appropriate policy document within the meaning of Section 42 DPA 2018.
The Court of Appeal allowed the appeal in respect of three grounds:
- AFR Locate failed to satisfy the requirements of Article 8 (2) and in particular whether it was in accordance with the law. The question before the court was whether there was a sufficient framework for the use of AFR Locate. The legal framework consists of primary legislation (DPA 2018), secondary legislation (The Surveillance Camera Code of Practice) and the respondent’s policies provided they were published. The respondent’s policies were, however, deficient in that they did not clearly define who could be placed on a watch list or the criteria for when AFR could be deployed. As a result, the court concluded that the policies did not sufficiently set out the terms of discretionary powers exercised by the police and for that reason the use of AFR was not in accordance with the law.
- The court found that the Data Protection Impact Assessment was deficient in that it proceeded on the basis that Article 8 was not engaged or did not lead to an infringement, and therefore failed to properly assess the risks to the rights and freedoms of data subjects and failed to address the measures envisaged to address the risks as required by Section 64 DPA.
- The Divisional Court had been wrong to find that the force had done all that they reasonably could to fulfil the duty. The respondent had never investigated whether AFR had an unacceptable bias on grounds of race or gender and the purpose of the positive duty under Section 149 Equality Act 2010 was to ensure that a public authority does not inadvertently overlook information which it should take into account. As a result, the respondent, as a public authority, failed to discharge its own non-delegable duty under Section 149.
In respect of the remaining grounds, the Court of Appeal concluded:
- Had the interference with the Article 8 Rights been in accordance with the law for the purposes of Article 8 (2), it would have been a proportionate interference.
- As the two specific deployments which related to the appellant took place prior to the DPA 2018 coming into force and there was no alleged failure to comply with the DPA 1998, the Divisional Court had been correct to find that whether there was an appropriate policy document in place did not need to be determined.
This is an interesting case which provides a useful analysis of the legal requirements of Article 8 ECHR and the DPA 2018 for the purposes of collection and retention of data. It is a reminder to ensure that all policies and processes fully adhere to the Article 8 requirements and the public sector equality duty under Section 149 Equality Act 2010.