UK ‘urgently’ needs to regulate biometric technologies, warns review

New laws governing biometric technologies are “urgently needed”, Matthew Ryder QC has found, as part of the conclusions of an independent review commissioned by the Ada Lovelace Institute.

The use of biometric data – including faces, fingerprints, voices, DNA profiles and other measurements related to the body – is becoming increasingly common in new technologies, particularly those related to facial recognition. However, the review has ruled that the legislation currently in place in England and Wales has “not kept up” with developments in this technology, finding it to be “fragmented” and “unclear” regarding its use.

Among the legal review’s ten recommendations are that public use of live facial recognition (LFR) technology be suspended pending the creation of a legally binding code of practice governing its use, as well as the passing of wider, technologically neutral legislation to create a statutory framework governing the use of biometrics against members of the public.

“We urgently need an ambitious new legislative framework specific to biometrics,” said Ryder, of law firm Matrix Chambers, in a statement. “We must not allow the use of biometric data to proliferate under inadequate laws and insufficient regulation.” 

He specifically called for the scope of biometrics legislation to cover the use of the technology not only for the unique identification of individuals but also for classification.

“Simply because the use of biometric data does not result in unique identification does not remove the rights-intrusive capacity of biometric systems, and the legal framework needs to provide appropriate safeguards in this area,” the review argues.

Until very recently, biometric technologies had been used almost exclusively in policing. The Metropolitan Police and the South Wales Police are some of the forces that have been known to use these technologies. However, they are now used by a growing number of private and public organisations, including employers, schools and shops, to score video interviews, alert staff of theft risks and to verify students’ identities.

However, this use of facial-recognition technologies has led to civil rights challenges and condemnation from human rights groups, who argue that the technology is often mistaken and biased.

Last year, the UK’s Information Commissioner’s Office (ICO) expressed similar concerns regarding the reckless and inappropriate use of facial recognition in public spaces, banning facial-recognition company Clearview AI and demanding that the company delete all the data it held that related to UK citizens.

In response to the review’s conclusions, the Ada Lovelace Institute has called for the creation of a national, independent and properly resourced regulatory body that will govern these technologies, which would be required to meet standards of “accuracy, reliability and validity and proportionality”.

Moreover, the Institute has also recommended the establishment of a moratorium on systems capable of mass identification or classification in the public sector until legislation is passed.

“We believe that the prominence and importance of biometrics means that it requires either a specific independent role and/or a specialist commissioner or deputy commissioner within the ICO,” the review notes. “Wherever it is located, it must be adequately resourced financially, logistically, and in expertise, to perform the governance role that this field requires.”

Although the review is predominantly focused on public sector use of biometrics, its authors have also called for further research on the private use of these technologies, warning that further private sector-specific research is “particularly important given the porous relationship between private-sector organisations gathering and processing biometric data and developing biometric tools, and public authorities accessing those datasets and deploying those tools.”

In addition to the review, the Ada Lovelace Institute is also set to publish a policy report that draws upon a reported three-year program of public engagement, including conducting a representative survey on UK public attitudes toward facial-recognition technology and collaboration with the Citizens’ Biometrics Council.

“Both the survey and the citizens’ council highlighted public support for stronger safeguards on biometric technologies,” the Institute said.

In response to the Ryder Review, a spokesperson from the Department for Digital, Culture, Media and Sport told the BBC that the government was “committed to maintaining a high standard for data protection and our laws already have very strict requirements on the use and retention of biometric data”.

The statement continued: “We welcome the work of Ada Lovelace Institute and Matthew Ryder QC and we’ll consider the recommendations carefully in due course”.