We Asked the Police to Show Us the Safeguards

Today, Seen. Not Processed. became a national Freedom of Information project.

After developing and refining a six-part request concerning police use of facial-recognition technology, we sent substantially the same questions across the country. By the end of the exercise, our tracker covered 46 police bodies, allowing their responses to be compared against a common set of questions.

The premise was deliberately simple.

Police forces repeatedly tell the public that facial-recognition technology operates within safeguards governing the retention, deletion and handling of biometric information.

We wanted to see the recorded evidence that those safeguards actually operate.

The request therefore asked about six areas: evidence of post-deployment deletion and retention compliance; audits and assurance; technical verification that deleted biometric data cannot subsequently be recovered; recorded data-protection or information-security incidents; governance of Retrospective and Operator Initiated Facial Recognition; and supplier, processor and contractual arrangements affecting biometric data.

Just as importantly, we were explicit about what we were not asking for.

We did not request the identities of people on watchlists, intelligence concerning individuals, passwords, encryption keys, security credentials, exploitable vulnerabilities, network architecture or covert policing tactics.

Where genuinely sensitive information appeared within documents, we expressly accepted appropriate redaction. Where only part of a document was exempt, we asked forces to disclose the reasonably severable remainder.

The request was also designed to make comparison possible. Each of the six sections was to be treated separately. If information was already public, forces were asked to identify the actual document and location rather than simply directing us to a website. If cost became a problem, we asked them to identify which part caused it and explain how the request could be narrowed.

Then the acknowledgements started arriving.

Reference numbers began filling the tracker: 20669 at Cheshire, 3153385/26 at West Yorkshire, FOI/01249/26/HR at Kent, 26/44546 at Northamptonshire, 23288 at Staffordshire, 24011 at Essex, 815-2026 at Warwickshire, 1043/26 at South Wales, and many more.

At this stage there was nothing particularly dramatic about the responses. Mostly, forces were simply confirming receipt and beginning the statutory process.

But the experiment had started.

Forty-six police bodies were now being asked essentially the same thing:

Policy says deletion happens. What evidence shows that it happened?

Over the following month, the answers — and in many cases the difficulty of obtaining them — would become a story of their own.

Trust requires evidence.