Trust Us. The Safeguards Work. Just Don't Ask for the Evidence.

Grab yourself a large mug of tea, coffee, or whatever your favourite beverage happens to be. Make yourself comfortable, because this particular update is going to be rather… detailed.

And with good reason.

When we began our nationwide Freedom of Information investigation on 21 August, we anticipated that obtaining meaningful answers about facial-recognition safeguards might take some persistence. What we did not anticipate was the extent to which the investigation would become an examination of the transparency and accountability of the police forces themselves.

Nearly two months later, we have approached 46 police bodies, received 18 substantive decisions and submitted challenges seeking internal review of 13 of those responses. Twenty-eight original requests remain without a substantive decision, despite the ordinary statutory response periods having passed.

Today, 19 October, was supposed to mark a significant step forward. Numerous forces had already taken additional time to consider whether information could be disclosed under the Freedom of Information Act. For many, this was the date on which that extended consideration was expected to conclude.

Instead, by this evening, 17 police forces covered by those response dates had still not provided substantive answers.

The position is disappointing enough on its own. But delays are only part of the story. What concerns us considerably more is what some of the responses received so far reveal about the difficulty of independently verifying the safeguards on which public confidence in facial recognition is supposed to rest.

It is worth examining these developments carefully, because the implications extend well beyond our own correspondence.

The law applies to public authorities too

The police rightly expect members of the public to respect the law and comply with their legal obligations. The public should be entitled to expect equally serious regard for the obligations placed on the authorities responsible for enforcing those laws.

The Freedom of Information Act 2000 establishes a legal right to request recorded information held by public authorities. Ordinarily, those authorities must respond promptly and no later than 20 working days after receiving a valid request. That requirement is not an optional customer-service target. It is part of the statutory framework designed to make public institutions accountable to the people they serve.

The legislation recognises that some decisions require additional consideration. Under Section 10(3), an authority may take a reasonable amount of extra time to complete the public-interest test associated with a qualified exemption. The Information Commissioner's Office explains that such extensions should generally add no more than another 20 working days, with longer periods justified only in exceptional circumstances.

There is an important distinction here. An extension does not automatically constitute a failure to comply with the Act, and missing an estimated completion date does not, by itself, establish an additional statutory breach. The reasonableness of a delay must be judged against the circumstances of the individual request.

Nevertheless, the requirement to deal with information requests promptly does not disappear simply because additional time has been claimed. The ICO also makes clear that the public-interest extension cannot be used merely to decide whether an exemption applies in the first place.

ICO guidance: Time limits for compliance under Section 10

This distinction matters because many forces informed us during September that they needed additional time to consider potential law-enforcement exemptions. Their correspondence identified revised completion dates, frequently 19 October, following a further period of approximately 20 working days.

We accepted that public-interest considerations should be properly assessed. Where the notices lacked necessary detail, we asked for clarification of the exemption, the questions affected and the nature of the claimed prejudice.

What we reasonably expected in return was a substantive decision within the extended period, or a properly explained account of why further time was necessary.

The responses that did not arrive

Our evening check on 19 October found that 17 forces, representing 16 FOI cases, remained without substantive responses against their recorded completion dates. Norfolk and Suffolk are counted as two forces but operate a joint request.

Those still awaiting substantive decisions were Avon and Somerset Police, Bedfordshire Police, Cambridgeshire Constabulary, Cheshire Constabulary, Devon and Cornwall Police, Hampshire and Isle of Wight Constabulary, Hertfordshire Constabulary, Humberside Police, Lancashire Constabulary, Northamptonshire Police, Northumbria Police, Thames Valley Police, Warwickshire Police, West Yorkshire Police and Wiltshire Police, together with Norfolk and Suffolk under their joint FOI reference.

In Bedfordshire's case, the correspondence presents an additional problem. Its covering email identified 14 October as the revised date, while the accompanying letter stated 19 October. That discrepancy was challenged, but our records do not establish that it was resolved. On either date, a substantive response remained outstanding at the time of this update.

Cheshire's 19 October date was derived from the force's statement that a further 20 working days were required from 21 September, rather than from an explicit calendar date. The distinction is preserved in our tracker.

This is not a claim that all 17 forces have necessarily committed a fresh breach of the Freedom of Information Act. It is a documented account of the authorities from which we were still awaiting decisions on the dates their correspondence had led us to expect them.

There are other outstanding requests whose deadlines passed earlier, and others with later completion dates. Those are being recorded separately so that different procedural circumstances are not misleadingly combined.

Some forces did provide decisions ahead of or on 19 October, including City of London Police, Surrey Police, South Yorkshire Police, Greater Manchester Police, North Yorkshire Police and Lincolnshire Police. They deserve acknowledgement for doing so, even where the contents of their decisions have subsequently been challenged.

The concern is not simply that a large number of responses remained outstanding on one particular evening. It is that the additional time already taken has not necessarily produced the clarity the original requests were intended to obtain.

British Transport Police: How many extensions are reasonable?

British Transport Police deserves particular attention because its handling of our request illustrates a different concern: what happens when an extended response date arrives and the authority announces that it needs another extension.

Our original request was submitted on 21 August 2026 and registered under reference 01/FOI/26/4411.

On 20 September, British Transport Police notified us that it was considering Section 31, the law-enforcement exemption, and required additional time to complete the public-interest test. It identified 16 October as the date by which it expected to respond.

We subsequently asked the force to clarify which parts of our six-question request engaged Section 31, what law-enforcement interest might be prejudiced and how disclosure of the requested material could cause that prejudice.

On 21 September, the force's Deputy Data Protection Officer replied that the relevant grounds concerned possible prejudice to operational or tactical capability. However, the reply did not identify which numbered questions were affected or explain the connection between the particular information requested and the claimed prejudice.

We therefore awaited the substantive decision promised for 16 October.

When that date arrived, however, we did not receive a disclosure or a final refusal. Instead, British Transport Police issued a second extension notice.

The force stated that it had still not determined where the balance of the public interest lay and estimated that it required another 20 days. Its new expected response date was 13 November 2026.

That is a substantial period of additional time for a request originally submitted in August.

The ICO's guidance is particularly relevant here. It explains that public-interest-test extensions should generally be limited to an additional 20 working days beyond the ordinary response period. Extensions beyond a total of 40 working days should be exceptional, and authorities must be able to demonstrate why the extra time was necessary.

The guidance does not impose an absolute prohibition on a longer extension. Complexity, substantial volumes of information and consultation with third parties can sometimes justify additional time. But the authority must be able to explain why the circumstances warrant it.

British Transport Police's second notice did not identify any exceptional complexity, unusual consultation requirement or other specific circumstance explaining why a further extension was necessary. It stated that the public-interest balance remained undecided.

That is a description of the position the force says it has reached. It is not, by itself, a detailed justification for the additional delay.

We challenged the second extension on 16 October, asking British Transport Police to explain the exceptional circumstances requiring more time, why the public-interest test had not been completed during the previous period, and why any information not covered by Section 31 had not already been disclosed.

As of the evening of 19 October, we had received no reply to that challenge.

To be clear, we are not suggesting that the passage of 40 working days automatically makes every subsequent extension unlawful. The legislation allows a reasonable period, and the reasonableness of BTP's delay would need to be assessed against the facts.

But that is precisely why the absence of a meaningful explanation matters.

If an authority has already used the normal response period, then an additional period to consider the public interest, and subsequently asks for several more weeks, members of the public should not have to guess what makes their request exceptional.

There is also the unresolved question of partial disclosure. Where some requested information is not subject to an exemption requiring a public-interest decision, the authority should not ordinarily postpone that information simply because other material remains under consideration.

Our request concerned several distinct categories of recorded information. The correspondence received so far has not explained why none of those questions could be answered separately while the remaining public-interest assessment continued.

British Transport Police now expects to provide its substantive decision on 13 November, almost three months after the original request.

Whether that further delay is reasonable remains open to examination. What is already documented is that the original extended date passed, a second extension followed, and our request for an explanation remained unanswered.

I am therefore giving British Transport Police a further two working days, until the end of Wednesday 21 October 2026, to respond to the questions raised in my correspondence of 16 October.

I consider that a reasonable opportunity, particularly given the length of time the force has already had to consider the original request and explain its continued delay.

If no substantive explanation is received by that date, I will submit a formal complaint to the Information Commissioner's Office, accompanied by a complete chronology of events, both extension notices and copies of the relevant correspondence.

This is not a demand that British Transport Police disregard legitimate security considerations or complete its entire FOI response within two days. It is a request for the force to account for the further delay it has already announced.

There comes a point when repeated extensions should be subjected to independent scrutiny rather than simply accepted. I believe we have reached that point.

When a response fails to resolve the question

It would be misleading to describe every substantive FOI response as an answer that satisfies the information requested.

A public authority can issue a decision that relies on an exemption, explains that certain information is not held or directs the applicant to material already available elsewhere. These are recognised outcomes within the legislation. Whether a particular decision has been properly made is a separate question.

Of the 18 substantive decisions received so far, we have sought internal reviews or submitted challenges to 13. That figure needs to be understood correctly. A review request is not proof that the original decision was unlawful, nor is it a finding against the authority. It means we have identified specific questions about the adequacy of the response which require reconsideration. In Derbyshire's case the authority assigned a new FOI number rather than confirming registration as a review; Nottinghamshire has not clarified how its existing internal review relates to its replacement decision.

What makes the number significant is the nature of the problems we have identified. Across different forces, we have encountered broad references to published material, incomplete distinctions between facial-recognition technologies, unexplained redactions and statements that information is not held despite earlier public records suggesting relevant material may exist.

One recurring issue concerns Section 21 of the Freedom of Information Act, which exempts information that is reasonably accessible to the applicant by other means.

There is nothing inherently objectionable about that exemption. If an authority has already published the exact information requested, directing somebody to it may be entirely appropriate. Indeed, publication ought to make accountability easier.

But Section 21 cannot turn information about a subject into the particular information that was requested. The ICO's guidance states that the publicly accessible material must match the request and that applicants should be given precise directions enabling them to locate it without unnecessary searching.

ICO guidance: Information accessible by other means, Section 21

Cumbria Constabulary, for example, relied on Section 21 and directed us to a broad website search concerning live facial recognition. The published material contains relevant explanations of the force's arrangements, including retention and deletion policies. But our review did not identify the deployment-specific deletion records, completed audit findings or other assurance evidence that had been requested.

Sussex Police also relied extensively on Section 21. Its published facial-recognition information provides useful background, but significant parts of our request concerning operational deletion assurance, audit findings and incident figures did not appear to be answered by the material identified. An internal review was requested in September.

City of London Police presented a different example. Its response established that the force had not used live facial recognition during the period covered, while confirming retrospective facial-recognition use through the Police National Database. Those are meaningful answers.

However, some of its Section 21 references concerned a national equality assessment and published evaluations of facial-recognition algorithm performance. We examined those documents and questioned whether they supplied the operating procedures, retention arrangements and deletion-assurance material requested.

There is a fundamental difference between evidence that a recognition algorithm performs accurately and evidence that the resulting biometric information is subsequently deleted in accordance with policy. The former cannot simply be treated as a substitute for the latter.

Nottinghamshire Police has also been challenged over the scope of information identified under Section 21. Its original Section 21 response was withdrawn as erroneous on 22 September. After a period during which Section 31 was considered, a new substantive response dated 16 October once again relied on Section 21. On 17 October we wrote back after examining all seven published documents, explaining which deletion, audit, non-retrievability, RFR/OIFR and governance questions remained unanswered. We acknowledged the force's answer of zero recorded incidents to Question 4 and asked about the status of the earlier internal review.

In each case, the question is essentially the same: does the material supplied or identified actually answer the request, and what is the authority's position on the information that remains unaddressed?

If the relevant records do not exist or are not held, that is an answer we can assess. If they are held but exempt, the authority can identify the exemption and explain its application. What we cannot reasonably do is treat a general policy, an algorithm-performance study or a collection of deployment statistics as recorded proof that deletion was completed.

When public records raise questions about a 'not held' response

Another group of challenges concerns decisions stating that no relevant information is held.

Such a response may be entirely accurate. A force that has not used live facial recognition, for example, will not ordinarily possess deployment-specific deletion records for technology it has never operated. Some systems may also be managed nationally or through regional partnerships, with responsibilities and records distributed between organisations.

Our concern arises where an apparently comprehensive not-held answer is difficult to reconcile with other published information.

Cleveland Police provided a blanket response stating that no information was held. Yet the force's own earlier published FOI material recorded retrospective facial-recognition searches through the Police National Database, including monthly search figures during 2024.

That earlier disclosure does not establish that Cleveland holds every deletion audit, contract or governance document we requested. It does, however, provide a clear reason to ask whether the original searches adequately considered retrospective facial recognition and whether relevant records are held locally or by another body.

Read Cleveland Police's published FOI 116/25 concerning PND facial-recognition searches.

Gloucestershire Constabulary presents a comparable issue. Its response to our current request stated that no relevant information was held. But in May 2025, the force had explicitly confirmed retrospective facial-recognition use through the Police National Database in an earlier published FOI response, FOI_25_0395.

Again, that does not prove that the particular assurance records we asked for exist. It means the relationship between the acknowledged use of the technology and the later blanket not-held conclusion requires explanation.

North Yorkshire Police is perhaps the most striking recent example.

On 19 October, the force provided a response stating that no information was held for Questions 1 to 6. Yet its own published Chief Officer Team minutes from 1 April 2026 record consideration of a detailed live facial-recognition implementation proposal, endorsement of a proposed policy and discussion of the safeguards governing the technology.

The force's public facial-recognition information also records a deployment in York city centre on 23 September 2026.

Those public records do not establish that a completed deletion certificate or technical assurance report exists. But they plainly raise questions about how the force arrived at a blanket not-held conclusion, especially where our request also covered deployment information and governance documentation.

A formal internal review was submitted on 19 October seeking a question-by-question reconsideration and an explanation of the searches undertaken. We have also submitted a separate, narrowly focused request concerning the September deployment. That second request asks for records held as at 19 October, recognising that the normal 31-day period for deleting associated CCTV footage had not yet fully elapsed.

North Yorkshire Police: Chief Officer Team minutes, 1 April 2026 · Deployment announcement, 21 September.

These examples should not be presented as proof that officers deliberately concealed records. We do not have evidence to support that allegation. What they demonstrate is why an applicant may reasonably challenge a not-held decision and ask the authority to explain how its searches were conducted.

There is no contradiction in accepting that an authority may genuinely hold no particular record while also expecting it to account properly for a conclusion that appears difficult to reconcile with its existing public disclosures.

Section 31 and the question of public interest

The repeated consideration of Section 31, the law-enforcement exemption, has become another prominent feature of the investigation.

We recognise that policing information can be sensitive. Operating procedures may sometimes contain details that could compromise investigative methods, and the Freedom of Information Act provides mechanisms for protecting such material where the relevant legal tests are met.

But the existence of a legitimate law-enforcement interest does not automatically mean that every aspect of a document should be withheld.

Several forces have identified potential prejudice to tactical capability, particularly concerning retrospective facial-recognition operating procedures, data-protection assessments and supplier arrangements. In some cases, the subsequent explanation has been little more than a broad assertion that disclosure might make the technology less effective.

This is one reason why we have repeatedly asked authorities to identify the exact parts of our request affected and explain the causal connection between disclosure and the prejudice claimed.

Lincolnshire Police, which issued its substantive decision on 19 October, has already received a request for internal review. Among other matters, we have asked why an operating policy could not be partially disclosed with genuinely sensitive passages redacted, and whether relevant national governance records are held elsewhere.

Surrey Police has also received a targeted review request concerning its application of Section 31 to material associated with retrospective facial recognition. We have asked for the distinction between information withheld on law-enforcement grounds and personal information withheld under Section 40(2), together with a clearer explanation of the particular prejudice claimed.

We are not arguing that an operational document must always be published in full. We are asking authorities to distinguish information whose release would genuinely create a policing risk from material explaining retention, deletion, accountability and compliance assurance.

Those subjects may overlap, but they are not interchangeable.

The public-interest test should involve consideration of the public interest in disclosure as well as the reasons for withholding information. Independent scrutiny of how biometric information is governed is relevant to that exercise.

Greater Manchester Police: The records appear to exist. Getting them is another matter.

Greater Manchester Police's 19 October response deserves particular attention because, alongside a Section 12 cost refusal, it gives a useful indication of where relevant operational evidence may actually be located.

The force states that information relating to post-deployment deletion is recorded by LFR operators in deployment logbooks, while audit information is maintained separately. It reports approximately 90 deployments and estimates that its response would require examination of around 160 logbooks. At approximately ten minutes per logbook, it estimates 26 hours to retrieve and extract the information sought under Questions 1B and 1C, exceeding the appropriate cost limit.

That calculation is part of the force's stated basis for refusing the request under Section 12; it is not an independent measurement by this project. The refusal notice also directs us to published material under Section 21 for aspects of Questions 1A and 6A, states that no information is held for Questions 2 to 4, and offers advice about submitting a narrower request.

This is not the completed deletion evidence we requested. But it is meaningful information. The logbooks and separate audit arrangements provide a much more concrete picture of what kinds of recorded assurance may be available than a general policy statement alone.

It also highlights a question for the next stage of our investigation: if the records exist but searching them all exceeds the FOI cost limit, can a properly narrowed request establish what they demonstrate without demanding a force-wide manual review?

We should not mistake a lawful cost refusal, if properly calculated, for proof that the safeguards have failed. Equally, a cost refusal does not answer the question of whether those safeguards can be independently verified.

What meaningful transparency can look like

It would be wrong to leave readers with the impression that nothing useful has emerged.

Derbyshire Constabulary provided six supporting documents with its substantive response, including governance records, an assurance-control assessment and contractual material concerning its retrospective facial-recognition arrangements. That disclosure has helped us understand responsibilities and aspects of the system's data-handling arrangements.

The response still did not supply the completed operational deletion evidence at the centre of our investigation, and substantial redactions in a supplier document prompted a request for review. Nevertheless, the material provided was meaningful and deserves to be recognised as such.

Surrey Police made another important disclosure. Its response identified one recorded incident involving a failure or delay in deleting facial-recognition data. The incident was assessed and was not reported to the Information Commissioner's Office.

We do not know from that disclosure alone whether the incident constituted a reportable personal-data breach, and we are not suggesting otherwise. The significance is that a deletion-related problem was recorded, demonstrating the practical relevance of asking how failures are identified and how successful deletion is verified.

The Metropolitan Police has previously identified the scale of its live facial-recognition activity and categories of records held, including references to deletion reports. Its original request was refused on cost grounds, and a narrower follow-up remains subject to further consideration.

Five redacted Blancco reports also reached us as part of material that appeared to be an internal referral, rather than as a formal FOI disclosure. They are not counted as a formal response to our refined request. This provenance distinction matters: it would be inaccurate to imply that the records had never reached us in any form, just as it would be inaccurate to describe them as an official disclosure under the request.

These disclosures illustrate the approach we intend to maintain throughout the investigation. Where a force provides relevant information, we will acknowledge it. Where questions remain unanswered, we will explain what is missing and why it matters.

The purpose is not to compile a list of institutions to criticise. It is to establish what recorded evidence exists, who holds it, and whether that evidence supports the assurances being given to the public.

Why this matters beyond Freedom of Information

Facial recognition is not simply another administrative system operating somewhere inside a police station.

Live facial recognition can process the faces of people moving through public spaces, including individuals who are not suspected of wrongdoing. Its operation therefore raises questions about necessity, proportionality, privacy and the safeguards governing how biometric information is created, used and removed.

The existence of those safeguards is central to the justification offered for the technology.

If a force states that non-matching biometric templates are deleted immediately, that is a relevant policy commitment. It tells the public what the system is supposed to do. But the further question is how compliance with that requirement is established, what records are produced, and what happens when a process does not work as intended.

This is not an unreasonable distinction. Public institutions routinely depend on documented assurance in areas where failures may have serious consequences. Procedures establish what should happen; records, tests and audits help demonstrate what actually happened.

There may be technical constraints on what individual deletion events can be recorded. Some verification may take the form of independent testing or system-level assurance rather than a certificate for every face processed. Those are legitimate matters for the authorities to explain.

We are not insisting that evidence must take one particular form. We are asking to examine the recorded assurance that actually exists.

And that brings us back to public trust.

It is entirely possible for a police force to operate a safeguard correctly without holding every document requested. It is equally possible for a published policy to be accurate while offering members of the public little independent means of verifying compliance.

What we cannot responsibly conclude from an incomplete FOI disclosure is that biometric data has been unlawfully retained. The absence of disclosed evidence is not proof of a failure.

But neither should the existence of a policy be treated as proof that its requirements have been met.

After nearly two months, that remains the central distinction in this investigation.

Accountability should not require extraordinary persistence

There is something troubling about the amount of correspondence required merely to establish whether recorded assurance can be made available.

Original requests have led to deadline extensions, clarification exchanges, exemption notices, document searches, follow-up questions and formal internal-review requests. In some instances, we have had to use previous official publications to challenge the conclusions in more recent responses.

British Transport Police's successive extensions provide a particularly clear example of how an information request can remain unresolved long after the normal response period has passed, while the requester is left seeking an explanation for the further delay.

That work is part of a legitimate scrutiny process, but it is reasonable to ask how accessible the system would be to somebody who lacked the time or willingness to pursue it.

Freedom of Information is intended to enable members of the public to obtain recorded information from the institutions that exercise authority on their behalf. Its effectiveness depends not only on a right existing in legislation, but on that right being practical to exercise.

None of this means that police forces should release genuinely sensitive material, disregard lawful exemptions or create records they do not hold.

It means that decisions should explain clearly what has been provided, what is withheld, what is not held and why. Where the information is already public, the reference should lead to the actual answer. Where additional time is necessary, the reasons and revised expectations should be explained properly.

And where published assurances are central to public confidence in a technology, the recorded basis for those assurances ought to be capable of meaningful scrutiny wherever disclosure is lawful.

Our investigation is continuing. We will record late responses accurately, publish the relevant evidence with appropriate redactions, distinguish original decisions from internal-review outcomes and correct our reporting where new information changes the picture.

For now, the position is straightforward. We have received useful policies, governance information, explanations of technological safeguards and some important factual disclosures. We have also encountered incomplete answers, unresolved challenges and substantial delays.

What we have not yet received through a formal FOI disclosure is the requested operational evidence demonstrating that required post-deployment biometric deletion was actually completed.

That does not mean the safeguards failed.

It means their operation has not yet been independently verified through the evidence formally disclosed in response to this investigation.

The police are entitled to explain why facial-recognition technology is necessary, what safeguards govern its use and how those safeguards protect the public. Members of the public are equally entitled to ask for the evidence supporting those assurances.

One obligation does not cancel the other.

If the safeguards are sufficiently important to justify public trust, the evidence demonstrating that they work should matter just as much.

Trust requires evidence.

SEEN. NOT PROCESSED.

The right to be seen, but not processed.