Bridges, R (On Application of) v The Chief Constable of South Wales Police

Factual and Procedural Background

This case concerns the lawfulness of the use of Automated Facial Recognition technology ("AFR") by a police force referred to as the Defendant. The dispute arises from the Defendant's trial deployment of AFR technology, known as "AFR Locate," at public events in a major city, including two specific occasions where the Plaintiff was present. The Plaintiff challenges the Defendant’s use of AFR on grounds relating to privacy, data protection, and equality duties. The Defendant is responsible for policing and has been conducting AFR trials since mid-2017 with funding and oversight from national authorities. The Plaintiff is supported by an independent civil liberties organisation.

The Defendant deployed AFR Locate on 21 December 2017 at a busy shopping area and on 27 March 2018 at a large exhibition venue. On both occasions, the Plaintiff alleges his facial image was captured and processed without prior warning or signage. The Defendant concedes the Plaintiff's standing and does not dispute that his image was likely captured.

The Plaintiff brings judicial review proceedings challenging the lawfulness of these deployments and the general use of AFR Locate, asserting breaches of Convention rights, data protection legislation, and the public-sector equality duty. The trial of AFR Locate is ongoing, and the court was asked to provide early legal guidance on the adequacy of the existing legal framework governing AFR.

Legal Issues Presented

1. Whether the Defendant’s use of AFR Locate constitutes an interference with the Plaintiff’s rights under Article 8 of the European Convention on Human Rights (ECHR), concerning respect for private and family life.
2. Whether the Defendant’s use of AFR Locate is "in accordance with the law" for the purposes of Article 8(2) ECHR, considering the adequacy and foreseeability of the legal framework regulating AFR.
3. Whether the Defendant’s use of AFR Locate satisfies the proportionality and necessity requirements under the four-stage test established in Bank Mellat v Her Majesty’s Treasury (No 2).
4. Whether the Defendant’s processing of biometric data through AFR Locate complies with the data protection principles under the Data Protection Act 1998 and the Data Protection Act 2018, including the obligations concerning sensitive processing and data protection impact assessments.
5. Whether the Defendant complied with the public-sector equality duty under section 149(1) of the Equality Act 2010 in relation to potential indirect discrimination arising from AFR Locate’s operation.

Arguments of the Parties

Plaintiff's Arguments

• The use of AFR Locate interferes with the Plaintiff’s Article 8 rights by capturing and processing his facial biometric data without consent or sufficient legal basis.
• The current legal framework is inadequate, lacking clear statutory authority and specific safeguards required to regulate AFR use in policing.
• The Defendant failed to comply with the public-sector equality duty by not properly considering potential indirect discrimination effects of AFR technology on women and minority ethnic groups.
• The Defendant breached data protection legislation by failing to conduct a proper data protection impact assessment and by processing sensitive biometric data without meeting all statutory conditions.

Defendant's Arguments

• The Defendant’s use of AFR Locate is lawful under common law policing powers and existing statutory frameworks governing data protection and surveillance.
• Any interference with Article 8 rights is limited, not disproportionate, and justified by the legitimate aims of crime prevention and public safety.
• The Defendant has implemented a sufficient legal framework comprising primary legislation, codes of practice, and internal policies providing clear standards and safeguards.
• The Defendant contends that biometric data of members of the public whose images are captured but who are not on watchlists do not constitute personal data under the Data Protection Act 1998.
• The Defendant asserts compliance with data protection principles and that data protection impact assessments have been conducted appropriately.
• The Defendant maintains it complied with the public-sector equality duty, having undertaken an initial equality impact assessment and continued to monitor for bias or discrimination.

Interested Parties and Interveners

• The Information Commissioner emphasised the need for clear legal bases and independent authorisation for AFR use, and expressed concerns about governance and privacy risks.
• The Surveillance Camera Commissioner highlighted the intrusive nature of AFR and the importance of compliance with the Surveillance Camera Code of Practice, considering AFR as having potential privacy impacts comparable to covert surveillance.

Table of Precedents Cited

Court's Reasoning and Analysis

The court began by recognizing that AFR technology represents a significant advancement in forensic policing with potential benefits for crime prevention and detection, but also raises serious privacy and data protection concerns. It acknowledged the broad scope of Article 8 ECHR rights, extending to physical and psychological integrity, personal identity, and biometric data.

The court found that the Defendant’s use of AFR Locate constitutes an interference with the Plaintiff’s Article 8 rights because it involves the capture, processing, and temporary storage of unique biometric facial data, which individuates individuals and is intrinsically private. The court rejected the Defendant’s argument that no interference occurred due to the public nature of the locations or the lack of long-term data retention.

On the question of whether the interference is "in accordance with the law," the court concluded that the Defendant’s use of AFR Locate is supported by the common law policing powers and a layered legal framework comprising primary legislation (notably the Data Protection Act 2018), secondary legislation (the Surveillance Camera Code of Practice), and the Defendant’s own policies and procedures. This framework provides sufficient foreseeability, accessibility, and safeguards to meet the Article 8(2) standard and prevent arbitrariness.

The court applied the Bank Mellat proportionality test and found that the Defendant’s use of AFR Locate was for a legitimate aim, rationally connected to that aim, and that no less intrusive alternative was available without compromising the objective. The deployments were limited in time and scope, transparent, and included human oversight to prevent wrongful interventions. The court found that a fair balance was struck between individual rights and public interest.

Regarding data protection claims, the court held that the biometric data processed by AFR Locate constitutes personal data under both the Data Protection Act 1998 and 2018, based on the concept of individuation rather than mere identification by name. The processing involves sensitive personal data requiring strict conditions to be met under section 35 of the DPA 2018.

The court found that the Defendant’s processing met the requirements of lawfulness, fairness, necessity, and substantial public interest under the data protection principles. It noted some shortcomings in the Defendant’s "Policy on Sensitive Processing," particularly in detail and coverage of public data subjects, but declined to intervene pending further guidance from the Information Commissioner.

The court also held that the Defendant complied with the data protection impact assessment obligation under section 64 of the DPA 2018, finding that the assessment was conscientious, addressed relevant risks including privacy and Article 8 concerns, and identified appropriate safeguards.

On the public-sector equality duty claim, the court found no failure by the Defendant to have due regard to potential indirect discrimination. The initial equality impact assessment was appropriate at the time of the trial’s commencement, and ongoing monitoring and review have continued. There was no evidence of systemic bias in the AFR software used by the Defendant, and the presence of human operator review provides an additional safeguard.

Holding and Implications

The court DISMISSED the Plaintiff’s claim for judicial review on all grounds.

The holding confirms that the current legal regime, incorporating common law powers, data protection legislation, surveillance codes, and internal policies, is adequate to regulate the use of AFR technology by police forces in a manner consistent with the Human Rights Act and data protection laws. The Defendant’s use of AFR Locate to date has been lawful, proportionate, and compliant with statutory duties, including the public-sector equality duty.

While the court recognized the need for ongoing review and possible future legislative refinement as AFR technology and its deployment evolve, no new precedent was established beyond confirming the sufficiency of the existing legal framework and the lawfulness of the Defendant’s current AFR Locate practices. The decision affirms the balance between technological innovation in policing and the protection of individual rights under UK law.