Finally, Some Proper Answers. And Now, About Those Councils…

SEEN. NOT PROCESSED. | Investigation Update

Well, it's taken a while, but we're finally getting somewhere.

Three police forces have now provided substantial responses to our facial-recognition enquiries. And, rather refreshingly, some of them contain actual information rather than another explanation of why we might have to wait for it.

Surrey Police, Derbyshire Constabulary and City of London Police have all provided material worth examining.

Not everything has been answered. We've gone back to two of them requesting internal reviews, but credit where it's due: we're making progress.

Meanwhile, we've expanded our enquiries to local councils.

More on that shortly, because I think it's an important development.

Surrey Police: Now This Is Interesting

Surrey's response contained something particularly significant.

The force confirmed that it does not record the completion of post-deployment deletion of Live Facial Recognition data.

Its policies describe the deletion requirements, and officers receive training on the procedures.

Fair enough. But there's a fairly obvious distinction between having a procedure and recording that the procedure was actually followed.

Then came the interesting part.

Surrey disclosed one recorded incident involving a failure or delay in deleting facial-recognition data.

The incident was assessed but was not reported to the Information Commissioner's Office.

We don't know the circumstances or how long the delay lasted. The response doesn't establish that a reportable personal-data breach occurred, and we shouldn't assume otherwise.

Nevertheless, it's an important disclosure.

We've spent weeks asking police forces how they demonstrate that biometric information is deleted correctly. Surrey has now confirmed that at least one deletion failure or delay has been recorded.

Which rather neatly demonstrates why we asked the question in the first place.

How was the incident identified? What records were available? And how is successful deletion normally verified?

Those are questions worth pursuing.

Derbyshire: A Proper Response, With a Few Questions Remaining

Derbyshire Constabulary deserves credit for the material it has provided.

Six supporting documents arrived with its response, including Appropriate Policy Documents, an assurance-control assessment and contractual information relating to its NEC NeoFace retrospective facial-recognition system.

There's some genuinely useful material here about the force's responsibilities, how the system operates and the contractual arrangements surrounding access to police data.

It's encouraging to receive documents rather than simply being directed towards a general website.

However, the distinction between a documented safeguard and evidence that the safeguard worked remains important.

The material describes requirements and responsibilities, but doesn't provide the operational records we requested demonstrating that biometric deletion was completed.

We've also asked Derbyshire to review extensive redactions in one of the contractual documents.

Seven pages were redacted in their entirety, with additional redactions elsewhere. The response did not identify the FOI exemptions relied upon to justify withholding that material.

We've asked for an explanation and for the decision to be reconsidered.

This isn't about demanding commercially sensitive information or compromising security. It's about understanding the contractual safeguards surrounding access to, retention of and deletion of biometric data.

Still, Derbyshire has made a substantial disclosure, and that's worth acknowledging.

City of London: Useful Answers, But Do the Links Actually Answer the Questions?

City of London Police has also provided a substantive response.

The force confirmed that it has not used Live Facial Recognition during the period covered by our request, but does use Retrospective Facial Recognition through the Police National Database.

It also confirmed that it does not hold local audit or assurance documents specifically addressing compliance with national PND facial-recognition deletion requirements.

All useful information.

However, some of the remaining questions were answered by directing us to publicly available documents under Section 21 of the Freedom of Information Act.

We followed the links and read the material.

And this is where things became rather frustrating.

An NPCC Equality Impact Assessment was cited in connection with questions about operating procedures and data-protection assessments.

Home Office testing of facial-recognition algorithms was also referenced in connection with retention and deletion assurance.

The problem is straightforward.

A test showing how accurately an algorithm identifies a face does not demonstrate that the biometric information is subsequently deleted.

They're two entirely different things.

So we've politely requested an internal review, asking City of London to identify the specific passages that answer our questions or clarify which information it does not hold.

The request has already been acknowledged.

To be clear, this is not a criticism of the time spent preparing the response. We appreciate that work.

But an ordinary member of the public should be able to follow an official link and find the information they've actually requested.

That doesn't seem an unreasonable expectation.

And Now, the Councils…

Until recently, most of our attention has been directed towards police forces.

But facial recognition isn't exclusively a policing issue.

Local authorities operate extensive CCTV networks, manage public buildings and provide services that people need to access.

And we're beginning to examine where facial-recognition technology fits into those arrangements.

We've now submitted requests to three councils.

North Tyneside Council

A February 2026 Cabinet report refers to facial-recognition technology within the council's CCTV arrangements.

We've asked for the retention rules, deletion records, technical assurance and details of who is responsible for protecting the biometric information.

That includes the respective responsibilities of the council, Northumbria Police and any commercial supplier.

The council has acknowledged our request.

Preston City Council

This one is particularly interesting.

Reports concerning facial recognition at Preston's One Stop Shop refer to a watchlist containing just one individual.

We've asked the council to provide the decision-making records and explain what alternatives were considered before introducing facial recognition.

We've also requested its operating policy, privacy assessment, deletion safeguards and figures demonstrating how effectively the system has performed.

If the reported circumstances are accurate, there is an obvious question about proportionality.

Was facial recognition necessary, or could the security objective have been achieved through less intrusive measures?

We'll wait for the council's evidence before drawing conclusions.

Hammersmith & Fulham Council

The council's CCTV investment programme has referenced proposed live and retrospective facial-recognition capabilities.

Here, we're particularly interested in who would control the biometric information and how responsibilities would be divided between the council, the Metropolitan Police and technology suppliers.

We've asked for the relevant agreements and deletion-assurance records, including any evidence generated during commissioning or testing.

The council has acknowledged the request.

These enquiries are at an early stage, but they're opening up another important area of the investigation.

Why Does Council Facial Recognition Matter?

Think about the last time you visited a council building.

Perhaps you needed help with council tax, housing, benefits or another local service.

You might reasonably expect CCTV cameras to be present. They've been commonplace for decades.

But would you expect your face to be processed by facial-recognition software?

And if it were, would you know?

That's the difference worth examining.

Facial recognition can involve extracting biometric information from an image and comparing it with a database. That's a rather different proposition from simply recording CCTV footage.

It also raises a question about choice.

If facial recognition is operating in a shopping centre, somebody might decide to shop elsewhere.

But what happens when it's operating in a building providing an essential public service?

People may have little practical alternative.

Which makes the decision to introduce the technology, and the safeguards surrounding it, particularly important.

There's also the question of accountability.

Imagine a council authorises the installation, a police force provides access to information and a commercial supplier operates or maintains the technology.

Who is ultimately responsible for ensuring that biometric information is deleted?

Who checks?

And if something goes wrong, whose records demonstrate what happened?

Hopefully, the councils' responses will provide clear answers.

Because responsibility shouldn't become harder to establish simply because more organisations are involved.

So, Where Does That Leave Us?

For the first time in several weeks, there's something genuinely positive to report.

Surrey has disclosed a recorded deletion incident.

Derbyshire has provided substantial governance and contractual documentation.

City of London has clarified its facial-recognition arrangements and acknowledged our request to review aspects of its response.

None of these answers should be dismissed simply because they don't resolve every question.

That's how a proper investigation works. We acknowledge what has been provided, examine it carefully and follow up where necessary.

We're also seeing the investigation move beyond police operations into local government and the services people use in everyday life.

That could prove just as interesting as the original police responses.

There is, however, one important distinction that remains unresolved.

We've received policies explaining when biometric information should be deleted.

We've received documents describing responsibilities for handling that information.

And we've now received confirmation that a deletion failure or delay has occurred.

What we haven't yet received through a formal FOI disclosure is the operational evidence demonstrating that the required deletion was successfully completed.

That doesn't mean it wasn't deleted.

It means the evidence we've requested has not been formally provided in response to those questions.

And that's precisely why we'll keep asking.

At least now we're getting some proper answers.

Long may that continue.

Trust requires evidence.

SEEN. NOT PROCESSED.

The right to be seen, but not processed.