SEEN. NOT PROCESSED.PROJECT JOURNAL

Can the Public Actually Audit Facial-Recognition Safeguards?

Since Sunday, several more pieces have dropped into the Seen. Not Processed. facial-recognition FOI project.

Taken separately, the responses from North Wales Police, Gloucestershire Constabulary, Gwent Police, the Metropolitan Police and the Police Service of Northern Ireland look very different.

Taken together, however, they are beginning to expose a much bigger question.

Not:

Do police forces have facial-recognition policies?

They plainly do.

Not even:

Do those policies say biometric data will be deleted?

Again, many of them plainly do.

The question is becoming:

Can an ordinary member of the public independently verify that those safeguards actually operated?

That is a different test.

And this week's responses have made the distinction much harder to ignore.

First, an important change in the evidence

Until recently, one of the provisional findings of this project was that no force had actually produced the underlying operational evidence showing that post-deployment deletion had happened.

That position has now changed.

Five Metropolitan Police Blancco Data Erasure Reports have reached us.

They are exactly the sort of records this project has been asking for.

But there is a rather significant complication.

They appear to have reached us inside an internal Met referral email, rather than through the normal substantive FOI response process.

More on that shortly.

For now, the important correction is this:

Operational deletion evidence does exist, and we have now seen some of it.

That is a positive finding.

But it creates a new question:

If evidence like this exists, how accessible is it to the public when they ask to verify the safeguards?

North Wales Police: who actually owns the assurance?

North Wales Police responded on Monday 5 October.

Its public position on Live Facial Recognition is reassuring if taken at face value.

People who do not cause an alert are told that their biometric data is automatically and immediately deleted.

Alert information is deleted within a defined period.

LFR CCTV has its own retention period.

That is the published safeguard.

Our FOI asked for something different.

We asked for the recorded evidence showing that those deletion requirements had actually been completed.

North Wales' answer introduces an important complication:

South Wales Police provided the technology and would have carried out the deletion.

North Wales therefore says it would not have the requested deletion and non-retrievability records to disclose.

That tells us who apparently operated the technical system.

What it does not tell us is what assurance comes back to North Wales.

If North Wales Police deploys facial recognition to members of the public and tells those people that their biometric information will be deleted, what evidence does North Wales itself receive that this happened?

Is there a close-out certificate?

A system record?

A deletion report?

A confirmation from South Wales Police?

An audit trail?

A contractual assurance mechanism?

Or is the safeguard accepted because the system is designed to behave that way?

Those are quite different things.

There is also a Freedom of Information issue worth considering.

FOIA does not necessarily treat information as “not held” simply because somebody else physically possesses it. Section 3(2)(b) recognises that information held by another person on behalf of a public authority may still be regarded as held by that authority. ICO guidance explains the distinction.

Whether that applies to the precise North Wales/South Wales arrangement depends on the facts of that relationship.

But that is precisely the point.

The answer should not necessarily stop at:

“South Wales Police did it.”

The next question is:

Did South Wales Police do it on North Wales Police's behalf, and if so, where does the assurance record sit?

And perhaps more fundamentally:

If one police force makes the promise to the public while another operates the safeguard, which organisation is accountable for demonstrating that the promise was kept?

Gloucestershire: “no relevant information”

Gloucestershire Constabulary's response, also received on Monday, is much shorter.

After saying that searches had been conducted by the relevant business areas, the force states:

“No relevant information held.”

That statement covers the entire six-part request.

There is nothing inherently wrong with an FOI response saying information is not held.

Sometimes that is simply the answer.

The problem here is what Gloucestershire itself has previously published.

In May 2025, Gloucestershire responded to another FOI asking whether the force had used retrospective facial recognition between January 2023 and the date of that request.

Its answer was:

“Yes – PND.”

PND is the Police National Database.

Another Gloucestershire response from February 2025 said that relevant PND/RFR information might be held, but that answering the particular questions asked would require examination of large numbers of records.

Those earlier disclosures overlap with the period covered by our current request.

That does not mean Gloucestershire must hold every document we requested.

But it does make the blanket answer difficult to understand.

If Gloucestershire used retrospective facial recognition through PND during the relevant period, how can absolutely no relevant information be held for a question asking whether RFR was used, together with the governance surrounding it?

There may be a perfectly straightforward answer.

Perhaps the relevant information is held centrally.

Perhaps Gloucestershire accesses a national service but does not retain the governance documents.

Perhaps the business areas searched for different terminology.

Perhaps “no relevant information” was intended to apply more narrowly than the response suggests.

But we should not have to guess.

How does “Yes – PND” in 2025 become “no relevant information held” in 2026?

That is exactly the sort of apparent contradiction an internal review should resolve.

And it illustrates another problem with blanket FOI answers.

A six-part request can contain six very different information questions.

If the answer to every one is simply “nothing held”, the public has no way of knowing whether each question was separately considered.

Dyfed-Powys: narrowing the request rather than fighting the cost limit

There was also a smaller development from Dyfed-Powys Police.

Its earlier response relied upon the Section 12 cost limit.

The main problem was our incident question.

Dyfed-Powys said it had 354 data-breach records across the relevant period that would have to be reviewed manually to establish whether any related to facial recognition.

Those 354 records were not facial-recognition breaches.

They were the pool of records that would need examining.

That distinction matters.

The force nevertheless told us that Questions 1, 3, 5 and 6 could be dealt with within the statutory cost limit.

So that is what we did.

Questions 2 and 4 were withdrawn and a much narrower request was submitted.

On 5 October an internal processing email appeared in the requester thread confirming that the refined request is logged under reference 910.2026 and is ready for allocation.

There is no substantive finding there yet.

But there is a useful methodological point.

Where a force identifies a genuine cost problem, the sensible response is not always to shout about Section 12.

Sometimes it is to remove the expensive question and ask again.

The interesting question will be what happens next:

Once the cost obstacle has been removed, does the underlying assurance evidence become available?

Gwent Police: impressive published governance — but what proves the technical claim?

Gwent's response arrived on Tuesday.

There are some genuinely positive elements.

First, Gwent clearly states that it does not use Live Facial Recognition.

That gives a proper answer to the LFR-specific deletion question.

Secondly, Gwent's approach to information already in the public domain is considerably better than some responses we have seen.

For Questions 5 and 6 it relies on Section 21, but points towards a specific facial-recognition resource containing meaningful governance material rather than simply directing the requester towards a website or search page.

Gwent publishes substantial information about its use of Retrospective Facial Recognition and Operator Initiated Facial Recognition.

That includes operating material, DPIAs and other governance documentation. Read Gwent Police's facial-recognition information.

That is useful transparency and should be acknowledged as such.

Interestingly, Gwent had previously been considering Section 31 — Law Enforcement — over parts of the request.

Its eventual substantive response does not use Section 31 to refuse those questions.

Instead, much of the governance information is made accessible.

That is worth recording because this project is not about collecting only bad examples.

If something is disclosed properly, it should be recognised.

But Gwent's answer also provides one of the clearest examples yet of the difference between a technical claim and evidence supporting that technical claim.

Gwent says that facial-recognition data is deleted immediately and automatically.

It also says there is:

“no means of recovery.”

That is a strong assurance.

We therefore asked for any recorded test, technical assurance, acceptance test, audit or supplier assurance that verifies deleted facial-recognition data is non-retrievable.

Gwent says that information is not held.

It also says there is no report confirming the position because there is no data for the system to review.

That leaves a rather obvious question:

How has the conclusion that there is “no means of recovery” been established?

Perhaps it follows directly from the architecture of the system.

Perhaps the supplier has certified it.

Perhaps it was tested during acceptance.

Perhaps it has been security assessed.

Perhaps the operating platform makes recovery technically impossible.

Any of those could be reassuring answers.

But at present we do not know.

And this is exactly the distinction the project is trying to demonstrate.

“The system cannot recover it” is an assurance.

A test or technical record demonstrating why it cannot recover it is evidence supporting that assurance.

Those are not the same thing.

Gwent's response also gives us another useful lesson.

For the incident question, Gwent says:

Information not held.

That must not be quietly converted into:

Zero incidents.

Zero is a recorded number.

Information not held means the force cannot provide the requested recorded figure.

That distinction matters enormously when comparing forces.

The Metropolitan Police: the evidence we may not have been meant to see

The Metropolitan Police story is the most unusual development in this update.

The original national FOI was refused under the Section 12 cost limit.

However, that response revealed something extremely useful.

The Met identified the types of records associated with its LFR deployments.

Among them were:

Blancco deletion reports.

That immediately gave us something concrete to ask for.

So the request was narrowed dramatically.

Instead of asking about hundreds of deployments, the refined request asked for:

Then, on 29 September, something unexpected happened.

An email arrived under the refined FOI reference.

It was not a conventional FOI response.

It was not a normal disclosure letter.

The body of the email was headed:

“NPFDU CRU Referral Form.”

It contained what plainly appear to be internal processing fields.

Among them were prompts asking:

Attached to that internal-looking referral were five redacted Blancco Data Erasure Reports.

We searched the subsequent correspondence.

We have found no later email saying:

“sent in error”

or:

“please disregard”

and no attempt to recall the material.

So we cannot responsibly state as fact that the Met accidentally disclosed it.

But equally, it would be misleading to describe what happened as a normal formal FOI disclosure.

The accurate position is:

Five operational deletion reports reached the requester attached to an apparently internal Met referral document.

Whether that was intended is currently unknown.

And that matters.

What the internal Met document tells us

The referral form states:

“Business area have provided redacted Blancco deletion reports which I have attached.”

So the records had already been located.

Redacted versions had already been prepared.

The referral then explains that Section 31 was being used for the redaction because the reports contain identifying information for a police device.

That is quite understandable on its face.

Device-identifying information may be something the Met has a legitimate reason to protect.

But then comes perhaps the most interesting line.

Under the section asking for the views of the FOI team and business leads, it records:

“No harm has been raised by the business area.”

That does not decide whether Section 31 can ultimately apply.

The FOI team can identify issues that an operational business area has not.

But it gives us unusually useful context.

The business area had apparently:

Then those records reached us.

And what do the deletion certificates actually show?

This is the genuinely reassuring part.

The Blancco certificates are not another policy document.

They are operational records.

Across all five, the main file-shredding operation and the listed target files are marked:

Successful.

That is precisely the sort of evidence we wanted.

It demonstrates why asking for operational evidence is worthwhile.

If a force says biometric material is deleted, and it can produce a contemporaneous deletion certificate showing a successful deletion operation, public confidence is stronger than it would be from policy wording alone.

That is important.

We asked for evidence. Evidence exists. And what we have seen is, in significant respects, reassuring.

There is one field on the reports that remains unexplained.

The certificates contain a separate entry:

“Previous Versions Erased.”

Three reports show:

No

and two show:

Failed.

We are not treating that as proof of a deletion failure.

We do not know from the certificates whether any previous versions actually existed.

We do not know what that field means in this particular Blancco configuration.

We do not know whether it relates to recoverable biometric information.

It would therefore be irresponsible to claim that it shows data remained recoverable.

But it makes our separate question about non-retrievability even more relevant.

What does that field mean?

Were there previous versions to erase?

Does “Failed” describe a meaningful residual-data risk, or simply an inapplicable function of the erasure process?

A simple technical explanation may resolve it completely.

That is why we asked.

Then came Sections 24 and 31

Fast-forward to 6 October.

Rather than the remaining substantive answers, the Met sent a public-interest-test extension.

The Met says it is considering:

Section 24 — National Security

and:

Section 31 — Law Enforcement.

The new estimated response date is 3 November.

Again, the existence of an exemption is not itself evidence of anything improper.

There may be legitimate information within these records that should not be placed into the public domain.

The problem is that the notice does not tell us what information the Met believes creates the problem.

It does not identify the Section 31 subsection or limb.

It does not say which of the four narrowed questions Section 31 applies to.

It does not identify the law-enforcement interest said to be prejudiced.

It does not provide even a broad causal explanation of how disclosure would create that prejudice.

And for Section 24 it does not identify which part of the request has a connection with safeguarding national security.

So today we asked them.

Not to complete the public-interest test early.

Not to disclose genuinely sensitive information.

Simply to tell us:

Which exemption?

Which question?

Which interest?

What broad connection exists between disclosure and the claimed harm?

ICO guidance on Section 10 says the extended period is for considering the public-interest balance where a qualified exemption is engaged.

That makes specificity important.

The Met sequence now deserves some thought

We need to be extremely careful here not to turn sequence into motive.

The documents do not establish that the Met intended to conceal the deletion reports.

They do not establish that the 29 September email was accidentally sent.

And they do not establish that Sections 24 or 31 are being invoked improperly.

But the sequence is now objectively interesting:

The Met identifies Blancco deletion reports as relevant records.

↓

A narrowed request specifically asks for five of them.

↓

An apparently internal referral shows redacted reports had been prepared.

↓

The referral says Section 31 relates to police-device identifier information.

↓

The same referral records “No harm has been raised by the business area.”

↓

Five redacted deletion certificates reach the requester attached to that internal-looking referral.

↓

A week later, the remaining refined request is placed under consideration of Section 24 National Security and Section 31 Law Enforcement.

That sequence raises questions.

It does not answer them.

And perhaps the most obvious is this:

If the internal referral email had not reached the requester, would the five Blancco deletion reports eventually have been formally disclosed?

We genuinely do not know.

But it is a perfectly reasonable question for the public to ask.

There are others.

If the sensitive issue was the identifier of a police device, and that identifier could be redacted, what wider prejudice is now being considered?

If redacted deletion certificates can apparently exist without revealing the sensitive device identifier, why should the remaining assurance evidence necessarily be withheld in full?

What information within a deletion audit or a non-retrievability test could genuinely threaten national security?

There may be an answer.

What we want is for the Met to state it.

PSNI: Section 31 again — but which bit?

Not long after the Met correspondence, another notice arrived.

The Police Service of Northern Ireland has extended its response while considering:

Section 31 — Law Enforcement.

The new estimated response date is 4 November.

This is not yet a substantive refusal.

PSNI says it has not completed the public-interest balance.

That should be recorded fairly.

But the notice has the same basic weakness we have seen elsewhere.

It does not tell us which subsection or limb of Section 31 applies.

It does not identify which of the six questions is affected.

It does not identify the law-enforcement interest said to be at risk.

And it does not explain the causal relationship between disclosure and the potential prejudice.

So once again we are left with a broad label:

Law Enforcement.

But what does that actually mean in the context of this request?

The FOI expressly excludes:

We are asking primarily about whether data was deleted, whether deletion was audited, whether supposedly deleted material can be recovered, and what governance surrounds the technology.

So the question for PSNI — as with the other forces considering Section 31 — is not:

“Why are you hiding this?”

That would presume an answer we do not have.

The proper question is:

Which precise piece of assurance information creates a law-enforcement risk, and what is that risk?

Because unless that distinction is made, “Law Enforcement” risks becoming a label placed over a very broad range of governance material.

There is now a much bigger question emerging

The most important finding from the last few days is not that every police force is behaving in the same way.

They clearly are not.

The differences are becoming more interesting than the similarities.

North Wales says the technical deletion was performed by another police force.

Gloucestershire says no relevant information is held.

Dyfed-Powys encountered a genuine cost issue and is now processing a narrowed request.

Gwent publishes substantial governance information and makes strong technical claims about deletion, but says it holds no technical report demonstrating non-retrievability.

The Metropolitan Police has generated operational deletion certificates — five of which we have now seen — but those certificates reached us attached to what appears to be an internal referral document.

PSNI is considering Section 31 but has not yet identified what part of the request creates the supposed law-enforcement concern.

Those are very different answers.

Yet they all lead back to one question:

Where is the auditable chain?

For a safeguard as important as deletion of biometric data, you might reasonably expect a chain something like this:

Policy

↓

Deployment

↓

Deletion takes place

↓

A record confirms deletion

↓

That record can be audited

↓

Failures or exceptions are recorded

↓

The force can demonstrate that the safeguard worked

That is not an exotic standard.

It is essentially the difference between saying:

“We have a process.”

and saying:

“Here is the evidence that the process operated.”

The Met's Blancco reports actually demonstrate what this can look like.

Which makes the next question unavoidable:

If this evidence can exist, why isn't comparable assurance readily available across forces using the technology?

Questions the public should be asking

There are now some fairly pointed questions worth sitting with.

If a force tells you that your biometric data is deleted immediately, should you be able to see evidence that the deletion control is actually tested?

If one police force uses another force's facial-recognition equipment, who is accountable for proving that your biometric data was deleted?

If another force physically holds the records, has anybody considered whether those records are legally held on behalf of the force that deployed the technology?

If a system has “no means of recovery”, what evidence supports that statement?

If there is no test or technical report, on what recorded basis is the assurance being made?

If an earlier FOI says a force used retrospective facial recognition, how can a later FOI covering the same period say that no relevant information is held?

If Section 31 applies, which exact information creates the policing risk?

If Section 24 applies, what is the connection between evidence of deletion safeguards and national security?

If the sensitive material is a police-device identifier, why can't that identifier simply be removed while the assurance evidence itself is disclosed?

If operational deletion certificates already exist, should producing them after deployments become routine rather than exceptional?

And, in the Met case:

Would we have received the five deletion reports through the normal FOI process if the internal referral email had never arrived in our inbox?

We do not know the answer to that last question.

That is precisely why it matters.

What we are not saying

This project needs to remain disciplined.

None of this establishes that police forces are unlawfully retaining biometric data.

It does not establish that a particular deletion failed.

It does not establish that the Met deliberately sent internal material to the requester.

It does not establish that the Met intended to withhold the Blancco reports.

It does not establish that Section 24 or Section 31 is being misused.

It does not establish coordination between different police forces.

And an FOI response saying information is not held does not, by itself, prove that the underlying safeguard does not exist.

Those would all go beyond the evidence.

The finding emerging so far is narrower:

The public's ability to independently audit the safeguards surrounding police facial recognition is inconsistent and, in some cases, surprisingly difficult.

And that matters.

Because the legal and ethical case for using facial recognition in public places relies heavily on safeguards.

One of the most important safeguards is that biometric information belonging to people who are not of interest to police does not simply remain in the system.

If that safeguard is central to public reassurance, then evidence that it operates should matter too.

Something else has changed

The Met certificates have actually strengthened this project.

Before seeing them, it would have been possible for someone to argue that asking for deletion evidence was unrealistic.

Perhaps systems simply delete things automatically and leave nothing useful behind.

We now know that isn't universally true.

At least in the Met's LFR process, deletion records exist.

They can be generated.

They can be redacted.

They can record a successful deletion operation.

And they can provide the public with something far stronger than a policy statement.

That is good.

It also raises the standard.

Because once you know that auditable operational evidence exists, it becomes harder to argue that public confidence should rely solely upon statements that the system behaves as intended.

Trust requires evidence

This project is not asking police forces to reveal how to defeat facial-recognition systems.

It is not asking for passwords, security credentials, exploitable vulnerabilities or covert tactics.

It is asking a much simpler question.

When the public is told:

“Your biometric data is deleted.”

what recorded evidence exists to demonstrate that this happened?

Sometimes the answer may be a deletion certificate.

Sometimes it may be an audit log.

Sometimes it may be an independent technical assurance.

Sometimes another organisation may legitimately hold the evidence.

And some parts may genuinely need redaction.

None of that is incompatible with transparency.

In fact, the Metropolitan Police deletion certificates show exactly why transparency can work.

Where a safeguard works, evidence of that safeguard should increase confidence in the system.

So this is where the project currently stands:

Policy tells us what should happen.

Operational evidence tells us what did happen.

And the public should be able to understand the difference.

Because public confidence in biometric policing should not depend solely on being told that safeguards work.

Trust requires evidence.

SEEN. NOT PROCESSED.

The right to be seen, but not processed.