knowledge 23 September 2020 |

Bridging the Gap: Automated Facial Recognition Technology in Police Surveillance

On 19 February 2020, the EU Commission released a White Paper outlining its strategy for the regulation of AI in the coming decade with the objective of creating an “ecosystem of trust”. A significant development in the face-off between FRT and individuals’ rights has been the UK case of R (Bridges) v Chief Constable of South Wales Police & Ors¹ which challenged the lawfulness of the use by South Wales Police (“SWP”) of a FRT system, AFR Locate, that SWP was using on a trial basis. In this briefing, we explore the recent decision of the Court of Appeal of England and Wales in the Bridges case.

What is AFR Locate?

AFR Locate was trialled by SWP at a range of large public events between May 2017 and April 2019 including at a Champions League Final. AFR Locate involved the deployment of CCTV cameras on police vehicles, or on poles or posts, to capture images of the face of anyone who passes within the cameras’ range. Digital images of faces of members of the public were taken from the CCTV feeds and processed in real time to extract facial biometric information. That information was then compared with facial biometric information of persons on watch lists compiled by SWP.

If, during a deployment of AFR Locate, the software identified a possible match between a face captured on the CCTV and an image on the watch list, the two images were reviewed by a police officer to establish whether a match had, in fact, been made. Upon review, if the police officer did not consider the CCTV capture to relate to an individual on SWP’s watch list, no further action was taken. However, if the CCTV capture was observed to relate to a person of interest, other officers stationed nearby could be notified to intervene, for example by asking to speak to the person concerned and, if appropriate, using statutory powers to stop and search or arrest that person.

A Snapshot of Bridges

Background

Civil liberties campaigner, Edward Bridges, with the support of Liberty (a civil liberties organisation) brought a case before the High Court of England and Wales against the Chief Constable of South Wales Police Force (the “SWP”) for the deployment of AFR Locate, which he was subjected to on two separate occasions in Cardiff in 2017 and 2018.

High Court Decision

The High Court, in its judgment dated 4 September 2019, found the operation of AFR Locate to be lawful and within the authority of SWP. Notably:

1. On the applicant’s right to privacy under Article 8 of the European Convention on Human Rights (the “ECHR”), the Court found that SWP’s use of AFR Locate did engage Mr Bridges right to respect for a private life under Article 8(1) but that such use fell into the qualification of “in accordance with the law” under Article 8(2).


2. On the applicant’s rights under the General Data Protection Regulation (“GDPR”) and the UK’s Data Protection Act 2018, the Court ruled that while the use of AFR Locate involves the processing of biometric data, on the facts of the case, the sensitive processing met the strict necessity requirement and was in compliance with applicable data protection laws.


3. The Court considered SWP’s data protection impact assessment (“DPIA”) for AFR Locate. It was satisfied that the DPIA met the applicable legal requirements, noting in particular that it included a clear narrative that explained the processing and referred to privacy intrusions. The DPIA also identified the legal risks arising from the processing, namely the potential for breaching Article 8 and identified the safeguards to be deployed.


4. On the application of anti-discrimination laws, the Court found that SWP had complied with its Public Sector Equality Duty (“PSED”) under the Equality Act 2010 in its trial of AFR Locate and there was no indication of indirect discrimination.

The Court concluded that the technology was deployed in an “open and transparent way, with significant public engagement… deployed for specific and limited purpose of seeking to identify particular individuals… whose presence was of justifiable interest to the police”. In dismissing the judicial review claim, the Court also concluded that the current legal regime is adequate to ensure the appropriate and non-arbitrary use of AFR Locate (albeit the Court did warn that this is subject to periodic review).

Court of Appeal Decision

In its decision of 11 August 2020, the Court of Appeal of England and Wales overturned the decision of the High Court and allowed Edward Bridges’ appeal on three grounds:

1. SWP’s interference with Mr Bridges privacy right under Article 8(1) of the ECHR was not “in accordance with the law” for the purposes of the qualification contained in Article 8(2) of the ECHR. The Court of Appeal acknowledged that the legal framework comprised of primary legislation (the Data Protection Act 2018), secondary legislation (The Surveillance Camera Code of Practice) and SWP’s local policies. However, it disagreed with the High Court that the interference with Mr Bridges Article 8(1) right was “in accordance with law”.  This was due to the overly wide discretion left to SWP police officers in circumstances where there is no guidance on who may be placed on the watch list nor is it clear that there are any criteria for determining where AFR Locate can be deployed.


2. As the Court of Appeal found SWP use of AFR Locate to have infringed Article 8 of the ECHR, the Court held that the DPIA was deficient as it proceeded on the basis that Article 8 was not infringed. The Court of Appeal stated “The inevitable consequence of those deficiencies is that, notwithstanding the attempt of the DPIA to grapple with the Article 8 issues, the DPIA failed properly to assess the risks to the rights and freedoms of data subjects and failed to address the measures envisaged to address the risks arising from the deficiencies we have found”.


3. Prior to or in the course of its trial of AFR Locate, SWP failed to take all reasonable measures to avoid indirect discrimination on racial or gender grounds and, therefore, failed to comply with the PSED under the Equality Act 2010.

The Court of Appeal also highlighted the fundamental deficiencies in the legal framework currently in place in protecting individuals’ rights against the intrusive nature of FRT use by the police.

Conclusion

The Court of Appeal of England and Wales’ decision in Bridges has highlighted the need for a clear legal framework that regulates the use of FRT and other technologies. Before deploying such technologies, organisations need to consider carefully whether the legal framework at that time permits them to justify their use. It is also interesting to see the European Data Protection Board (“EDPB”) grappling with issues raised by specific FRT systems and issuing communications. In this regard, the EDPB issued a communication on 10 June 2020 regarding the unsuitability of EU law enforcement agencies using Clearview AI’s facial recognition app as a policing tool.

Also contributed by Catherine Walsh.