From £450 to National Security — the Met FOI Timeline

On 21 August, we asked the Metropolitan Police to provide recorded evidence that the safeguards governing facial-recognition data actually operate as described.

We did not ask for watchlists, personal intelligence, passwords, security credentials, network architecture or exploitable vulnerabilities. We asked for records showing deletion, retention, audit and assurance — and expressly accepted appropriate redaction.

Seven weeks later, the correspondence presents a sequence worth examining. The words below are taken from the Met's own records and correspondence. Readers can draw their own conclusions.

21 August: We ask for the evidence

Our national six-part Freedom of Information request included records demonstrating that required deletion had taken place following Live Facial Recognition (LFR) deployments; retention and audit records; testing of non-retrievability; and recorded deletion or retention incidents.

The point was not to establish whether the Met has a deletion policy. It was to establish what evidence shows that the policy was followed.

10 September: Too costly — £450

The Met's response to 01/FOI/26/054717/H relied on section 12(1) of the Freedom of Information Act: the request exceeded the £450 appropriate cost limit (equivalent to 18 hours of work at the prescribed £25 hourly rate).

The Met nevertheless provided some useful information. It referred to 599 LFR deployments, approximately 5,254 alerts, and several types of records, including Blancco deletion reports. This did not establish that a Blancco report existed for every deployment.

We took the Met's cost advice seriously and narrowed the request immediately. The revised FOI, 01/FOI/26/055049/Y, asked for the deletion reports for just five recent deployments, the most recent relevant deletion/retention audit, any recent assurance concerning recovery after deletion, and incident figures already held in recorded form.

29 September: The reports — and an internal statement

On 29 September, an email supplied an NPFDU Central Referral Unit form concerning our revised request, together with five redacted Blancco deletion reports.

Under the form's question about what information was held, the entry read:

“Business area have provided redacted Blancco deletion reports which I have attached.”

The form also explained that section 31 redactions related to an identifier for a police device used to complete the report.

Under the field asking for the views and opinions of the FOI team and business leads, the recorded wording was:

“No harm has been raised by the business area.”

Those words do not, by themselves, settle whether an exemption could subsequently apply to any portion of the information. They do establish what was recorded in the referral form at that point. The five reports were already prepared in redacted form.

We make no assumption about why the referral material was sent to us, or about any unrecorded internal discussions.

6 October: Law enforcement and national security

The Met's next formal notice said it was considering section 31 (Law Enforcement) and section 24 (National Security) and required additional time to complete a public-interest test. Its revised response target was 3 November 2026.

We asked the Met to identify the specific exemptions, which parts of our four numbered questions were affected, and the broad link between disclosure and the harm or national-security interest said to be at issue. We did not ask for the public-interest test to be completed early.

8 October: The Met explains what it is considering

On 8 October, the Met identified section 31(1)(a) (prevention or detection of crime), section 31(1)(b) (apprehension or prosecution of offenders), and section 24(1) (national security).

It said information about LFR management, deletion, retention, audits and assurance could reveal capabilities, safeguards, limitations or other details valuable to someone seeking to undermine policing. It also referred to the possibility of revealing protective arrangements relevant to national security.

The Met's email expressly described the exercise as ongoing:

“Whilst the Public Interest Test remains ongoing and a final decision has not yet been reached regarding disclosure, we can provide some further information regarding the exemptions currently under consideration.”

And, towards the end of the explanation, it stated:

“At this stage, the MPS has not reached a final view on the extent to which either exemption may apply to particular parts of the request.”

Those are the Met's words, not our interpretation of its position.

What Section 10(3) actually permits

This is where the statutory timetable matters.

Section 10(3) of the Freedom of Information Act allows extra time, where appropriate, to decide the public-interest balance relating to an already-engaged qualified exemption. It is not an extension for working out whether the exemption applies in the first place.

The Information Commissioner's published guidance puts the distinction plainly:

“you cannot use the additional time to determine whether the exemptions themselves are engaged.”

The same guidance says authorities should identify the relevant exemptions and satisfy themselves that they apply within the initial 20-working-day period. An initial notice should explain the basis for the exemption and give an estimated date for completing the public-interest decision.

Source: Information Commissioner's Office — Time limits for compliance under FOIA (section 10).

The Met received the revised request on 10 September. Its 6 October notice said sections 24 and 31 were being considered. On 8 October, it said it had not reached a final view on the extent to which either exemption may apply to particular parts of the request.

That wording should be read alongside the Commissioner's guidance above. It remains possible that the Met considers an exemption already engaged in respect of some information and is still identifying its precise boundaries while assessing the public interest. The correspondence does not yet make that distinction clear.

We are not declaring a breach. We are setting the two statements beside each other, so readers can examine what the Met has said and what the published guidance requires.

The sequence, in the Met's own words

Our question has not changed. Can the Met disclose the parts of a deletion-completion record, audit or incident count that do not reveal sensitive operational information — with suitable redactions where required?

The 29 September material shows that specific reports were held and that redacted copies had been prepared. The October correspondence explains exemptions now being considered. The final decision has not yet been made.

We will assess that decision when it arrives. Until then, the original documents and the exact words matter more than speculation about motives or outcomes.

Policy says deletion happens. We ask for evidence it happened.

Trust requires evidence.

SEEN. NOT PROCESSED.

The right to be seen, but not processed.

Evidence: MPS FOIs 01/FOI/26/054717/H and 01/FOI/26/055049/Y; the 29 September referral email and redacted report attachments; the 6 October notice; the MPS email of 8 October 2026; and the ICO's published section 10 guidance. The 8 October email is a procedural explanation, not a final refusal.