Cambridgeshire Promises Transparency. Now We Ask for the Evidence.
Today, Cambridgeshire Constabulary is deploying Live Facial Recognition in Cambridge city centre for the first time.
Further Cambridge deployments are already listed for 17 and 18 October.
Alongside those deployments, the force has made an important public commitment.
“We will be open and transparent in the development, deployment and use of LFR technology.”
That is welcome.
Because the safeguards Cambridgeshire is using to reassure the public are almost exactly the safeguards our Freedom of Information request is testing.
Read Cambridgeshire Constabulary's LFR information.
What Cambridgeshire tells the public
Its LFR information page says that captures of people who do not match the watchlist are automatically deleted and the data is irretrievable.
It says data associated with an alert is kept for no more than 24 hours, with deletion again described as automatic and the data irretrievable.
It says mobile CCTV footage is normally deleted within 31 days.
It says biometric data will not be passed to third-party agencies.
And it says use of LFR is subject to regular audits and independent oversight, including governance involving the Police and Crime Commissioner and an Ethics Panel.
Those are significant assurances.
They also map remarkably closely onto the questions we sent to Cambridgeshire on 21 August.
What our FOI asks
Our request does not ask for watchlists, identities, covert tactics, security credentials, exploitable vulnerabilities or network architecture.
It asks for the evidence surrounding the safeguards.
Among other things, we asked for:
Recorded evidence showing that required deletion was actually completed after LFR deployments.
Final audit, compliance and assurance reviews.
Tests or technical assurance showing that deleted biometric material cannot subsequently be recovered.
Recorded incidents involving deletion failures, delayed deletion or retention beyond policy.
Governance documents, suppliers and third-party processing arrangements.
The distinction is simple.
A policy saying data must be deleted is evidence of the rule.
A webpage saying deletion is automatic and irretrievable is a public assurance.
A deletion record, audit or technical test is evidence that the safeguard actually operated.
And Section 31?
Cambridgeshire has told us that it is considering Section 31(1)(a) and (b) — Law Enforcement in relation to parts of our request.
Importantly, its clarification identifies the affected parts as Q5(a), Q5(b) and Q6, concerning RFR/OIFR policy and DPIA material and wider governance/supplier information.
It has not identified our core Q1 request for recorded LFR deletion evidence as one of the parts engaging Section 31.
Cambridgeshire says the claimed prejudice is to “tactical capability”, explaining that disclosure could make the tool less effective at preventing and detecting crime and apprehending offenders.
Its substantive response is currently estimated for 19 October.
The timing is useful
The public deployment schedule lists Cambridge city-centre deployments on 2, 17 and 18 October — all before that revised response date.
Our request covers the period from 1 July 2024 to the date the request is processed.
So the force is now publicly describing, in real time, the safeguards that sit at the heart of the information we have asked it to evidence.
We are not alleging that Cambridgeshire's public statements are untrue.
We are asking a much simpler question:
What recorded evidence exists to demonstrate that those safeguards operated as described?
If Cambridgeshire intends to be open and transparent about its use of Live Facial Recognition, evidence demonstrating that its safeguards are working should strengthen public confidence.
Trust requires evidence.
Policy says deletion happens. We ask for evidence it happened.