Law note · United Kingdom
R (Bridges) v Chief Constable of South Wales Police, Automated Facial Recognition by Police
The Court of Appeal held South Wales Police's automated facial recognition trials unlawful, for breach of Article 8 ECHR, the Data Protection Acts 1998 and 2018 (no adequate legal framework, no proper Data Protection Impact Assessment), and the public-sector equality duty.
This is a public-authority case: it establishes that biometric surveillance deployment needs a proper legal framework, not just a lawful basis, and it is recorded here with `applies_to` government even though the underlying UK General Data Protection Regulation (GDPR) and DPA 2018 biometric rules apply to both public and private actors.
What it asks of an app
- If you are a public authority deploying facial recognition or another biometric surveillance system in the United Kingdom, put an adequate legal framework and a proper Data Protection Impact Assessment in place before deployment, not after.
When LexLint raises it
Declared activities: processes_biometrics, high_risk_decisions
Primary source: Court of Appeal (Civil Division) judgment, published by the Judicial Office