The use of live automated facial recognition technology (AFR) by South Wales Police Force (SWP) was an unlawful interference with the right to privacy under Article 8 of the ECHR.

R (Bridges) v. CC South Wales & Ors [2020] EWCA Civ 1058

Factual Background

This was an appeal from the Divisional Court in a claim for Judicial Review concerning the lawfulness of the use of AFR in a pilot project by SWP. 

Put simply, AFR is a way of assessing whether two facial images depict the same person. The specific AFR technology in question was known as "AFR Locate" and worked by extracting biometric data from a digital image taken of a person's face in real time. That biometric data would then be compared with biometric data extracted from images contained on a "watchlist" on a SWP database. The watchlist contained the details and facial images of individuals who were of interest to SWP for a variety of reasons ranging from persons wanted on warrants to vulnerable individuals. Where a biometric match was detected by the AFR software, a system operator (a police officer) would undertake a review to determine whether any intervention was required. If no match was detected the software would automatically delete the facial image obtained from the live feed. 

AFR Locate was deployed by SWP at public events on approximately 50 occasions between May 2017 and April 2019. The two public events at the centre of the appellant's claim took place in December 2017 and March 2018. 

The appellant (a civil liberties campaigner) brought judicial review proceedings challenging the lawfulness of the use of SWP's use of AFR. In particular that it was not compatible with: an individual's right to privacy under Article 8 of the ECHR; data protection legislation; and the Public Sector Equality Duty under s.149 of the Equality Act 2010.

The Divisional Court dismissed the entirety of the appellant's claim, a decision that was appealed on five grounds. This note focuses on four of those grounds as they relate to privacy and data protection. The relevant grounds of appeal were that the Divisional Court:

1. erred in concluding that the interference with the appellant's rights under Article 8(1) of the ECHR was in accordance with the law for the purposes of Article 8(2) (Ground 1)
2. made an error of law in assessing whether SWP's use of AFR constituted a proportionate interference with Article 8 rights within Article 8(2) of the ECHR (Ground 2)
3. was wrong to hold that SWP's Data Protection Impact Assessment (DPIA) complied with the requirements of section 64 of the Data Protection Act 2018 (DPA 2018) (Ground 3)
4. erred in declining to reach a conclusion as to wither SWP had in place an "appropriate policy document" within the meaning of section 42 of the DPA 2018 (taken with section 35(5) of the DPA 2018), which complied with the requirements of that section (Ground 4)

With regard to the grounds of appeal relating to Article 8 of the ECHR, the appellant succeeded on Ground 1 but failed on Ground 2. 

Despite the legal framework within which SWP operated AFR Locate, comprising primary legislation (DPA 2018), secondary legislation (The Surveillance Camera Code of Practice) and local SWP policies, the Court of Appeal considered there to be no clear guidance on where it could be used and who could be put on the watch list. The discretion afforded to the SWP in this regard was judged to be too broad to meet the standards required under Article 8(2). On that basis the Court of Appeal allowed the appeal on Ground 1.

In light of the Court of Appeal's decision on Ground 1, it was not strictly speaking necessary for the Court to consider Ground 2. However, having heard full arguments on Ground 2 the Court nevertheless went on to conclude that the Divisional Court had correctly weighed the actual and anticipated benefits of AFR Locate against the impact of its deployment on the appellant. The benefits of AFR Locate were potentially great, with a minimal impact on the appellant. The Court considered SWP's use of AFR Locate was a proportionate interference under Article 8(2) of the ECHR.

In relation to the data protection aspect of the appeal, the appellant succeeded on Ground 3 but failed on Ground 4.

On the facts of the case, the SWP had drafted its DPIA on the basis that the use of AFR Locate did not interfere with an individual's Article 8 right to privacy. It is perhaps unsurprising, in light of the Court of Appeal's decision on Ground 1 that the appellant also succeeded on Ground 3.

On Ground 4, it was noted that the specific events central to the appellant's claim (i.e. those in December 2017 and March 2018) pre-dated the implementation of the Data Protection Act 2018. On that basis, the Court of Appeal considered that the Divisional Court was right not to reach a conclusion on Ground 4 as the point did not fall to be decided on the facts of the appeal.

COMMENTARY

As interest in AFR technology continues to grow, the Court of Appeal's decision in R (Bridges) gives organisations developing and considering this technology real pause for thought. It is important to recognise that the decision does not question the legitimacy of AFR technology but rather highlights the importance of grappling with key (difficult) issues associated with using it. Organisations seeking to use AFR in the future should consider:

1. Reconciling the actual use (and benefit) of using AFR technology with its potential impact on individuals. Key to this will be ensuring a robust and thorough DPIA is carried out, and that organisations remain transparent and accountable in respect of their use of the technology. 
2. Ensuring that, alongside a DPIA, the use of AFR is governed by a detailed and prescriptive policy document determining how the technology will be used without affording individuals wide discretion to make operational decisions.
3. Recognising that biometric data is 'special category data' and therefore prohibited under the GDPR unless a separate condition of processing can be satisfied under Article 9(2) of the GDPR.

Whilst the SWP has indicated that it will not appeal the decision, debates around the legality of new technology are almost certainly here to stay.