Police use of facial recognition technology infringes European Convention on Human Rights
R (on the application of Edward Bridges) v The Chief Constable of South Wales [2020] EWCA Civ 1058
Summary
The Court of Appeal of England and Wales has held that the use of automated facial recognition technology (AFR) by the South Wales Police Force (SWP) unlawfully interfered with Edward Bridges' right to respect for and non-interference by public authorities in his private and family life, which is protected by Article 8 of the European Convention on Human Rights (ECHR). The Court found that:
the current legal framework for the use of AFR afforded police officers too broad a discretion;
the SWP's Data Protection Impact Assessment (DPIA) was deficient; and
the SWP had not taken reasonable steps to comply with the Public Sector Equality Duty (PSED) in regards to the characteristics of race and sex.
The decision will impact the development and testing of AFR and marks a step towards ensuring stronger legal frameworks for the use of AFR are instituted in the UK and beyond.
Facts
AFR operates by extracting biometric data from digital images of members of the public taken by CCTV, and comparing it with biometric data from digital images of persons who are on a watchlist compiled by the SWP.
The case concerned one of the uses of the technology, "AFR Locate". When AFR Locate is used, CCTV capture images of anyone who comes within range of the camera, and the images are processed in real time. When the system identifies a likely match between the two images an AFR operator, who is a police officer, reviews the images to confirm whether the match is correct. Where a match is not correct, AFR Locate deletes the facial biometrics and images of persons scanned and the data will no longer be available to police.
The Appellant, Edward Bridges, challenged the decision of the Divisional Court of the Queen's Bench Division (Divisional Court) in R (on the application of Edward Bridges) v The Chief Constable of South Wales [2019] EWHC 2341, that the general use of AFR Locate by the SWP, and its use on two particular occasions, was lawful. The Court considered five grounds of appeal:
Whether the interference with the Appellant's rights under Article 8 was "in accordance with the law" as required by Article 8(2) of the ECHR;
Whether the Divisional Court made an error in law in assessing that SWP's use of AFR was a "proportionate interference" with the Appellant's Article 8 rights;
Whether the Divisional Court was wrong to hold that SWP had provided an adequate DPIA as required by the Data Protection Act 2018 (DPA);
Whether the Divisional Court erred in declining to reach a conclusion as to whether SWP had in place an “appropriate policy document” which complied with the requirements of the DPA; and
Whether the Divisional Court was wrong to hold that SWP complied with the PSED.
Article 8 of the ECHR states:
Everyone has the right to respect for his private and family life, his home and his correspondence.
There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
Decision
Ground 1: Sufficient Legal Framework
The Court allowed Ground 1, holding that the legal framework regarding AFR was insufficient for the purposes of Article 8(2).
The fundamental deficiency identified by the Court was that the discretion police officers were afforded when using AFR Locate was too broad. The legal framework did not clearly explain who could be placed on the watchlist, nor the criteria for determining the locations in which AFR Locate could be deployed. In addition, although SWP had carried out reasonable steps to notify the public of the time and place AFR Locate would be deployed, it was reasonable to suppose that a number of persons whose biometric data was captured were not aware of the technology's use.
However, in allowing Ground 1 the Court did acknowledge that SWP did have the power to deploy AFR Locate, and the findings in this case would not affect the future prospects of AFR being used on a national scale. The Court also indicated that if SWP implemented a Code of Practice which deals with the deficiencies, and made clear that personal data is automatically and instantly deleted without any human observation, unless it matches a person on the watchlist, this would likely be an adequate legal framework for the purpose of Article 8(2).
Ground 2: Proportional interference
The Court rejected Ground 2, noting that "the balancing exercise which the principle of proportionality is not a mathematical one; it is an exercise which calls for judgment". The Court accepted SWP's argument that, since the plaintiff's challenge was to a specific deployment of AFR Locate against him on two particular occasions, the Divisional Court correctly assessed the impact of the use of AFR Locate by SWP only against the plaintiff, not anyone else. Since the impact was negligible, the Court held that it was not an error to deem the use of AFR Locate a "proportionate interference".
Ground 3: Adequate Data Protection Impact Assessment
The Court allowed Ground 3, holding that, since the Court had already found that AFR Locate failed to satisfy the requirements of Article 8(2), the fact that the DPIA was drafted on the basis that Article 8 was not infringed meant it inevitably failed to properly assess the impact of AFR Locate on the right to privacy under the ECHR, as required by the Data Protection Act 2018.
In particular, the DPIA failed to properly assess the risks to the rights and freedoms of persons captured using AFR, and failed to address measures which would have dealt with the risks arising from the deficiencies with AFR Locate.
Ground 4: Compliance with section 42 of the Data Protection Act 2018
The Court rejected Ground 4, holding that because the evidence was inconclusive as to whether the DPIA was an "appropriate policy document", it was entirely appropriate for the Divisional Court to make no final judgment on the matter. The Court instead agreed to leave the SWP to make suitable revisions to their policy document in accordance with future guidance from the Information Commissioner.
Ground 5: Public Sector Equality Duty
The Court allowed Ground 5 and held that the SWP had not done all that they reasonably could to fulfil the PSED. The Court found that the SWP had never sought to satisfy themselves that AFR Locate did not have an unacceptable bias on grounds of race or sex, and by failing to do so had failed to discharge its duty under the PSED to have due regard to the need to eliminate discrimination in the exercise of its functions.
Commentary
The SWP has indicated that it will not appeal the Court's judgment, and acknowledged that the consideration of AFR by the Court is an important step in the development of the software.
This case is one of the first to consider in detail the human rights implications of facial recognition technology, which has so far been trialled in Perth, Queensland, New South Wales and Victoria. The Australian Human Rights Commissioner, Edward Santow, has previously called for Australian governments to cease the use of AFR until a legal framework which safeguards human rights can be established. In addition, the Parliamentary Joint Committee on Intelligence and Security has recommended that the proposed Identity-Matching Services Bill 2019 (Cth) and the Australian Passports Amendment (Identity-matching Services) Bill 2019 (Cth) be redrafted to take into account relevant principles and subjected to further review.
Unlike the UK, there is no enforceable human right to privacy under Australian law, although some states (such as Victoria and Queensland) do require that laws are compatible with the right to not have one's privacy unlawfully or arbitrarily interfered with. This means that Australians are likely to have fewer opportunities to challenge the introduction or implementation of AFR on human rights grounds, and increases the need to establish a clear and enforceable legal framework for its use.
The full text of the decision can be found here.
Iman Barr is a Law Graduate at Ashurst.