In December 2025, the Home Office opened a consultation on potential avenues for a new legal framework for law enforcement use of biometrics, facial recognition, and similar technologies.

The Home Office narrowly framed this consultation, proposing that the forthcoming legal reforms focus exclusively on law enforcement. Despite this, one part of the consultation offered an opportunity to reflect upon whether such a narrow focus was appropriate. My response focused on this point, arguing that these future laws must extend to private bodies, particularly when live facial recognition is used.

Why should future regulation include private bodies?

At present, whether it be the police or high-street retailers that utilise live facial recognition, these deployments all occur in public places. For instance, suppose when walking to your local supermarket, let’s say Sainsbury’s, you pass a police live facial recognition van. In this instance, upon entering the supermarket, you would have been scanned by law enforcement and private facial recognition systems during this short walk. The issue is that the laws governing each sector vary.

Therefore, if you are misidentified as a criminal or placed on a watchlist in error, your avenues of recourse depend on whether the error was made by the police or the private sector. In other words, the law depends on who is behind the camera, not in front of it.

While the differences span across human rights and equality law, the divergence discussed within my response centred on the lawful grounds for processing biometric data.

When live facial recognition is used, it processes biometric data, which is prohibited unless it falls into at least one category on a closed list. When private bodies, such as retailers, deploy facial recognition, they do so for a substantial public interest, namely, preventing and detecting unlawful acts.

The term ‘unlawful’ includes both criminal and civil offences, which, as noted by the ICO, has led some users to deploy this technology to enforce the eviction of ‘individuals considered to be in breach of the rules of the premises.’ Despite the fact that all private-sector watchlist uploads should demonstrate substantial public interest, some retailers have disclosed that they process data on so-called ‘troublemakers’.

Compare this to the rules governing the police, where, due to the sensitive nature of biometric data, policing facial recognition is confined to law enforcement purposes. This includes using facial recognition to prevent, investigate, detect, or prosecute criminal offences and safeguard against threats to public security. From a purely legal perspective, differences in the lawful use of live facial recognition in public spaces create divergent surveillance practices.

 The complexity of the current regime was highlighted by the Home Office in its consultation brief, which observed that a member of the public would need to read multiple statutes and layers of guidance to understand the legal basis for police live facial recognition on the high street. If transparency and public understanding are core objectives, excluding private-sector deployment will do little to address these issues as a whole.

How can we adopt a unified approach to regulating live facial recognition in public spaces?

A more coherent approach would be to require that all live facial recognition use in public places be restricted to law enforcement purposes. This would ensure that individuals in public places are subject to a single, consistent legal regime, shifting the focus from the operator to the technology’s operation.

For policing bodies, this would preserve the existing lawful bases on which such systems operate. For private retailers, it would remove the ability to rely on broader discretionary grounds and confine deployment to circumstances related to crime prevention and threats to public security.

In practice, the impact on most retailers would be limited, as facial recognition is typically justified on grounds of safety and loss prevention. The reform would instead address a smaller category of outlier practices, where deployments risk exceeding what can properly be justified in the substantial public interest.

Will Legislative Reform encompass the private sector?

 A unified framework for live facial recognition should be rooted in its presence in public spaces, rather than having legality depend on who is behind the camera. This approach appropriately recognises the value of public spaces and the need to ensure consistent and fair facial recognition practices in towns and cities.

Yet despite the importance of establishing coherent public-space standards, the key question remains: will the Home Office extend these reforms to align private-sector use with policing standards, or will facial recognition continue to operate under two separate legal frameworks?

William Page, is a Teaching Fellow at Birmingham Law School

This post originally appeared on the Birmingham Law School Research and Scholarship Blog and is reproduced with permission and thanks