UK ICO Guidance on Video Surveillance including CCTV (2022) T.4(a): T.4(a) Facial recognition: a DPIA for every deployment, a documented justification, an Article 6 basis and Article 9 condition, and meaningful human review

Facial recognition that uniquely identifies people processes special category biometric data, prohibited unless an Article 6 basis and an Article 9 condition (with section 10 and Schedule 1 where needed) are met. The organisation should treat the DPIA as a living document reviewed before every deployment, fully document its justification and be able to explain the lawful basis, why FRT is necessary, why less intrusive options were ruled out, the likelihood of meeting its objectives and how effectiveness is measured; necessity must be shown case by case (processing many faces to find a few is hard to justify), with an appropriate policy document where required, compliant watchlists, consideration of an Equality Impact Assessment and active, meaningful human review of matches.