The Information Commissioner’s Office (ICO) has expressed its concern that the Home Office that its proposed new legal framework for the use of biometrics, facial recognition and similar technologies for law enforcement could fragment existing safeguards, warning that unclear statutory duties risk creating contradictory regulatory regimes.
In its detailed response to the Government’s consultation on a new legal framework for law enforcement’s use of facial recognition and similar technologies (https://www.gov.uk/government/consultations/legal-framework-for-using-facial-recognition-in-law-enforcement/consultation-on-a-new-legal-framework-for-law-enforcement-use-of-biometrics-facial-recognition-and-similar-technologies-accessible), which ran from 4 December 2025 to 12 February 2026, the ICO said it supports the responsible use of facial recognition and biometric tools, noting that such technologies “can play an important role in public safety, provided their deployment is lawful, proportionate, transparent, and supported by effective safeguards”.
However, the regulator stressed that data protection law must remain the foundation of any new system. The response emphasises that the UK GDPR and Part 3 of the Data Protection Act 2018 already impose strict requirements on necessity, proportionality, accuracy, transparency and security. The ICO cautioned that a parallel statutory regime could “overlap or duplicate responsibilities and requirements or result in different regulatory bodies taking different approaches to key principles”.
Call for clearer statutory duties and mandatory consultation
The Home Office is considering a new oversight body combining the functions of the Biometrics and Surveillance Camera Commissioner and the Forensic Science Regulator. While the ICO does not oppose this merger, it warned that the relationship between the new body and the ICO must be unambiguous, particularly if the new regulator gains powers to issue codes of practice or set technical standards.
The ICO argues that any statutory codes underpinning the framework must require consultation with the Commissioner and should ideally be approved by Parliament. This, it says, would ensure coherence with data protection law and avoid conflicting expectations for police forces.
The response highlighted the complexity of modern policing, where forces may develop and operate their own biometric systems, procure third party tools, use non police databases for retrospective searches and collaborate with local authorities or other public bodies. In this context, the ICO says the framework must clearly define when obligations apply and who is accountable for compliance.
The ICO said that its own research showed that public support for the use of facial recogntion is conditional on accuracy, transparency and strong governance. Any new rules must be tested against data protection principles, including whether less intrusive alternatives exist and whether technologies are effective for their intended purpose.
The ICO also warned that weakening oversight or reducing protections could jeopardise the UK’s EU data adequacy status, which would significantly hinder cross border policing and information sharing.
The consultation forms part of a wider Government effort to update the regulatory landscape for policing technologies. It follows increasing public and parliamentary scrutiny of live facial recognition and other AI‑driven tools, as well as calls from academics and civil society groups for a statutory footing that keeps pace with rapid technological change.
The Home Office is expected to publish its response to the consultation later this year before setting out its legislative proposals. The ICO said it stands ready to work with Government to ensure the final framework supports both effective law enforcement and the protection of individuals’ rights.
