What the police responses now show
A national, evidence-led comparison of what police forces can actually show about facial-recognition deletion, retention, audit and governance — not simply what policy says should happen.
Public snapshot updated 17 October 2026 · Working tracker v35 (Nottinghamshire and BTP correspondence through 17 October)
Latest update · 17 October 2026
The tracked six-part police enquiry now has 14 substantive responses from 46 police bodies, after Nottinghamshire's final response dated 16 October. The 10 previously requested internal reviews are unchanged. BTP's further deadline extension does not count as an answer. These figures reflect the targeted correspondence update, not a complete new inbox reconciliation.
Nottinghamshire: Section 21 withdrawn, reconsidered, then applied again
Nottinghamshire Police's original 17 September Section 21 response was withdrawn on 22 September as erroneous. The force then considered Section 31 during a public-interest-test extension. Its 16 October response (01/FOI/26/015729) again applies Section 21 to Questions 1–3, 5 and 6; it answers Question 4 with zero recorded incidents. The response counts as substantive but only partially answers the six-part enquiry.
All seven documents linked from its public LFR page were checked. They describe retention rules, audit functionality and supplier governance; the deployment register identifies 21 August and 9 October operations with 103,244 faces seen in aggregate (not necessarily distinct people). No deployment-specific completed-deletion record was identified in those documents. The LFR policy expressly excludes RFR and OIFR. On 17 October we asked for exact document/page references for the outstanding answers and the status of the existing 17 September internal review. No unlawful retention is alleged or established.
British Transport Police: a second extension, no substantive reply
BTP (01/FOI/26/4411) issued another Section 31 public-interest-test extension on 16 October, moving its stated response date to 13 November 2026. The previous extension had targeted 16 October. The latest notice says the public-interest balance remains unresolved but gives no specific explanation for the further delay. We asked for the exceptional circumstances and reasons on 16 October. The force has not yet provided a substantive six-question response, and its status remains pending.
Saturday's journal: Why Am I Having to Mark Their Homework?
The new article examines why published policies are not the same as evidence of completed deletion, and why members of the public should not have to repeatedly check the statutory handling of their requests. The current evidence record remains open to correction and proper disclosure.
What changed for the 15 October update
The latest reconciliation covers correspondence through 14 October 2026. Three additional substantive police replies bring the total to 13 of 46; 10 police internal reviews have been requested. The separate council FOI programme now covers three councils. This is an evidence snapshot, not a claim of complete assurance or lawfulness.
Surrey Police: one recorded deletion failure or delay
In response 004354/26 dated 12 October, Surrey says it does not record completion of post-deployment Live Facial Recognition deletion. It separately disclosed one incident of failure or delay in deleting facial-recognition data, which was assessed and not reported to the ICO. The response does not establish whether the incident was a reportable personal-data breach, and gives no duration or technical cause.
Derbyshire Constabulary: detailed documents and a redaction review
Derbyshire's response, dated 12 October and received 13 October (01/FOI/26/008806/Y), included RFR Appropriate Policy Documents, an assurance-control assessment and redacted NEC NeoFace contractual material. An internal review was requested 14 October because seven pages of a contract were wholly redacted without stated FOIA exemptions; the acknowledgement assigned a fresh FOI reference (01/FOI/26/009047/N), not a confirmed review case number.
City of London Police: Section 21 review acknowledged
City of London Police responded on 13 October (letter dated 12 October; FOI2026/01695): no LFR use in scope, but RFR through the Police National Database. A review of its reliance on public documents under Section 21 for parts of Q5 and Q6 was sent 14 October and acknowledged as IR2026/02087.
Councils: requests sent to three local authorities
North Tyneside (FOI-9094) and Hammersmith & Fulham (27574089) have acknowledged their requests, with response targets of 6 November and 9 November respectively. A request to Preston has been sent but no acknowledgement was verified in the 14 October reconciliation. All council requests remain separate from the 46-police-body national series.
Metropolitan Police: no formal disclosure of the erasure reports
The five redacted Blancco reports discussed in earlier updates reached us in error within an apparently internal referral. They were not formally disclosed under the refined FOI request and are not counted as an official response. The Met has not yet formally supplied the deletion-completion records requested. The distinction matters: receiving material inadvertently is not the same as an official response to a public information request.
What changed on 10 October
Two council FOIs are now submitted — North Tyneside (9 October) and Preston (10 October). The police investigation remains at 46 bodies and 10 substantive responses. The South Wales Police internal review was sent on 9 October, bringing the total police internal reviews requested to eight. Council requests are counted separately.
Preston City Council: second council request submitted
On 10 October we sent a four-question FOI about the facial recognition camera at Preston One Stop Shop. It requests the decision and alternatives assessment, the operating policy and DPIA, non-match biometric deletion rules and the latest test or assurance record, and aggregate figures for alerts, confirmed matches and false matches.
The request explains that we have already searched the council's published materials. We have not yet received a council acknowledgement, reference number or substantive response. The provisional response target is 6 November 2026, assuming receipt on 10 October.
South Wales Police: internal review now submitted
The targeted review of response 1043/26 was sent on 9 October. It asks the force to reconsider searches for recorded evidence of biometric deletion and assurance, the scope of its Section 21 links, and the unanswered incident figures. An internal review request is not a new substantive response and does not establish that any safeguard has failed.
New journal article: council spending, necessity and operator accountability
Our 10 October investigation update examines the wider CCTV and AI programmes announced or approved by Hammersmith & Fulham and Harlow, including facial recognition, retrospective searching, vehicle tracking and ANPR. We distinguish planned capabilities from verified operational use and ask what documented need, full costs, authorisations and public oversight support these investments.
What changed on 9 October
The national police enquiry now has 10 substantive responses from 46 police bodies. Local-authority requests are recorded separately: one council FOI sent, no council response yet. South Wales Police’s subsequent internal review was submitted on 9 October and is counted in the 10 October headline total.
South Wales Police: FOI 1043/26 answered; verification still unresolved
South Wales Police responded on 9 October. It describes automatic deletion of LFR biometric data but states that requested deletion evidence, audit assurance or non-retrievability reports are not held. The force relied on FOIA Section 21 for some material, linking to published LFR deployment results; the applicability of that link to the specific information requested remains in question.
The response is included in the six-question scorecard as a substantive, partly unresolved response. A targeted internal review was subsequently sent on 9 October. Absence of records disclosed is not evidence that deleted personal data have been improperly retained.
North Tyneside Council: first council FOI submitted
On 9 October we sent a separate FOI to North Tyneside Council seeking recorded safeguards, deletion evidence, technical assurance, audits and accountability arrangements for its facial recognition systems. No response has yet been received. The provisional 20-working-day response target is 6 November 2026.
The council–police watchlist arrangement raises further questions about public consultation and whose safeguards apply. This is a new branch of the investigation, not a 47th police body.
What changed on 8 October
Today's correspondence clarifies some outstanding positions but does not increase the number of substantive answers. The count remains nine substantive responses across 46 tracked bodies. Reviews, public-interest-test notices and delay acknowledgements are recorded separately.
Metropolitan Police: sections 31(1)(a), 31(1)(b) and 24(1) clarified
The Met has now identified the law-enforcement provisions it is considering in refined FOI 01/FOI/26/055049/Y: section 31(1)(a) (prevention or detection of crime), section 31(1)(b) (apprehension or prosecution of offenders), and section 24(1) (national security).
It says that LFR deletion, retention, management, audit and assurance information might reveal capabilities, limitations or protective measures which could be exploited. No final view has been reached about which parts of the request these exemptions cover. The public-interest test remains ongoing; the stated target is 3 November 2026.
Cleveland Police: independent internal review underway
Cleveland acknowledged the review of FOI 827/26 and confirmed an independent reviewer. Its response of 7 October said “No information Held” for all six numbered questions; the mismatch with earlier published records of RFR/PND use is still to be resolved. Review target: 4 November 2026. The acknowledgement is not a revised substantive response.
West Midlands: overdue and awaiting business-area input
West Midlands Police apologised for the delay in FOI 1923/26 and said its response is still awaited from the relevant business area. No substantive answer was supplied. The requester's stated 21 October 2026 ICO complaint checkpoint remains a checkpoint, not a police response deadline.
Other internal reviews acknowledged
Gloucestershire (FOIIR_26_0793) and North Wales (2026/863) acknowledged their respective reviews on 7 October. Both stated targets of 3 November 2026. Neither acknowledgement changes the original force's substantive response.
Next response checkpoints
These dates describe expected correspondence or review targets. They are not forecasts of what any force will decide.
13 November 2026 — BTP further stated target
British Transport Police says it expects to complete the Section 31 public-interest test and provide a response by this date. This is a further extension, not confirmed disclosure.
Question-by-question scorecard
The same six questions are scored across 14 substantive police responses recorded through 17 October. “Answered” includes evidenced non-use or not-applicable answers. “Problem responses” include partial and unanswered items. Procedural public-interest-test extension notices are not counted as substantive answers.
| Request area | Answered / evidenced N/A | Partial or unanswered |
|---|---|---|
| Q1 | 4 | 10 |
| Q2 | 2 | 12 |
| Q3 | 2 | 12 |
| Q4 | 5 | 9 |
| Q5 | 0 | 14 |
| Q6 | 0 | 14 |
A traffic-light assessment measures the completeness and transparency of an FOI response, not whether the force's technology is lawful or its governance is effective. These figures are a snapshot, not final findings.
Position as at 7 October
The evidence has moved on materially. We now have direct operational deletion records from the Metropolitan Police; North Wales, Gloucestershire and Gwent have produced very different answers to the same underlying assurance question; and Cleveland Police has supplied a blanket “No information Held” response that conflicts with its own published RFR/PND disclosures. The Met and PSNI are also considering further qualified exemptions.
Metropolitan Police: operational deletion evidence exists
Five redacted Blancco Data Erasure Reports reached the requester on 29 September under refined request 01/FOI/26/055049/Y. They relate to Stratford Broadway, Harrow, Bethnal Green, Walthamstow and Finsbury Park deployments in August 2026.
The email body was an NPFDU CRU Referral Form containing internal processing fields, not a conventional substantive FOI letter. No later correspondence has been identified saying the material was sent in error, asking for it to be disregarded or attempting a recall. The public record therefore needs to stay precise: the reports reached the requester attached to an apparently internal referral; whether that was intended is unknown.
All five certificates mark the main file-shredding operation and listed target files as Successful. The referral says the business area supplied redacted copies, identifies police-device information as the reason for a Section 31 redaction, and records that “No harm has been raised by the business area.”
This is the strongest direct operational deletion evidence obtained so far. It is also why the route by which it arrived matters.
Metropolitan Police: Section 24 and 31 notice (position on 7 October)
On 6 October the Met extended its refined response estimate to 3 November while considering Section 24 — National Security and Section 31 — Law Enforcement.
The notice does not identify the Section 31 limb, the numbered question or questions affected, the law-enforcement interest said to be prejudiced, or the broad connection between the requested information and national security. A narrow clarification has therefore been sent asking for those particulars without asking the Met to complete the public-interest test early.
The final exemption analysis remains pending. The project is not treating the notice as proof of improper withholding.
Cleveland Police: “No information held” meets Cleveland's own published record
On 7 October Cleveland Police responded to all six parts of request 827-26 with the same answer: “No information Held”.
That answer does not presently reconcile with Cleveland Police's own published FOI material. FOI 116/25 records PND facial-recognition searches in July, August, September, October, November and December 2024 — inside the period covered by our request. FOI 437/25 answers “Yes – PND” when asked whether Cleveland had used retrospective facial recognition, while FOI 616/25 states that RFR is utilised through a function within the Police National Database.
An internal review was requested the same day. The tracker does not infer why the incorrect blanket response was given; it records the narrower point the documents establish: Cleveland's answer to the RFR question is contradicted by Cleveland's own published records.
What changed on 24 September
The overdue chasers produced several different explanations. Some forces openly cited workload. Others issued late public-interest extensions. Most importantly, two forces independently confirmed national-level referral of this request.
National Central Referral Unit: now confirmed by two forces
“currently sitting with the national Central Referral Unit for further advice & guidance to be provided to all police forces”Merseyside Police, 24 September 2026
“being reviewed by the National Central referral Unit who provide a national steer on FOIs”Derbyshire Constabulary, 24 September 2026
What this establishes: national referral/advice is part of the handling of this request in at least these two forces. It does not yet establish what the guidance says, who authored the repeated Section 31 wording, or that forces were instructed to reach a particular outcome.
The Section 31 pattern
Section 31 is a prejudice-based exemption. The issue is not whether facial recognition can ever justify withholding operational information — it plainly can. The question is whether the claimed harm is tied to the particular information requested.
The repeated formulation
Fifteen forces have now supplied the same full combination:
s31(1)(a) and (b) → Q5(a), Q5(b) and Q6 → “prejudice to tactical capability” → disclosure would make the tool less effective at preventing/detecting crime and apprehending offenders.
- Northamptonshire
- South Wales
- Cambridgeshire
- Kent
- Warwickshire
- Lancashire
- Lincolnshire
- Gwent
- Devon & Cornwall
- West Yorkshire
- North Yorkshire
- Cheshire
- South Yorkshire
- Surrey
- Avon & Somerset
This is strong evidence of shared wording, a common template or precedent material. It is not, by itself, proof of central instruction. Merseyside and Derbyshire now separately establish national referral/advice, but the source of the wording remains an evidence question.
Read the rules yourself
- ICO guidance asks which law-enforcement interest could be harmed.
- The claimed harm must be real, actual or of substance.
- There must be a causal link between disclosure and that harm.
- The authority must address whether the harm would occur or would be likely to occur.
The ICO facial-recognition decision
In IC-333147-L9X3, dated 4 March 2025, the Information Commissioner accepted that North Wales Police could withhold a small amount of genuinely operational LFR information under s31(1)(a) and (b), but found the exemptions were not engaged for the remaining held information.
The important point is the distinction: a facial-recognition document is not automatically exempt simply because it concerns policing. The prejudice test has to fit the particular information.
Deadline compliance
Twelve tracked bodies missed their original statutory target. Some have since replied or issued late procedural notices, but the original miss remains part of the audit trail.
| Body | Position after chase |
|---|---|
| Bedfordshire | Section 31 PIT notice arrived after its original 16 September target. |
| Police Scotland | Substantive response issued 24 September after apologising for missing the 20-working-day period. |
| Cleveland | Substantive six-part “No information Held” response on 7 October; internal review independently assigned on 8 October, target 4 November. |
| Derbyshire | Awaiting National Central Referral Unit steer; no revised date. |
| Dorset | No substantive response or extension after original target at this snapshot. |
| Durham | No substantive response or extension after original target at this snapshot. |
| Gloucestershire | High request volume acknowledged earlier; 7 October internal-review acknowledgement now gives a target of 3 November for review of the substantive not-held response. |
| Hampshire & Isle of Wight | Workload explanation followed by late generic Section 31 extension to 19 October. |
| Merseyside | Late Section 31 extension to 8 October; National Central Referral Unit involvement confirmed. |
| Thames Valley | Late generic Section 31 extension to 19 October. |
| West Mercia | Delay acknowledged on 28 September; no revised response date or statutory extension identified. |
| Wiltshire | Late s31(1)(a)/(b) PIT extension issued 30 September to 19 October; clarification requested on scope and prejudice. |
Nine substantive police responses recorded by 8 October
Historical position at 8 October; South Wales Police’s 9 October response is described above and included in the current totals.
| Body | Current outcome |
|---|---|
| Metropolitan Police | Original six-part request: whole-request s12 cost refusal. Refined follow-up: five redacted Blancco deletion reports reached the requester attached to an internal-looking referral; audit, non-retrievability and incident answers remain pending, with s24/s31 now under consideration. |
| Cumbria | s21 signpost response; internal review requested. |
| Sussex | s21 signpost response; internal review requested. |
| Dyfed-Powys | s12 cost refusal driven principally by Q4; refined request for Q1, Q3, Q5 and Q6 has been accepted for processing. |
| Police Scotland | Mostly answered: no LFR, CAID identified, multiple s17 not-held findings, and s18 NCND applied to part of Q5. |
| North Wales | Partial: SWP identified as the technology provider and deletion operator; no operational deletion/non-retrievability evidence supplied by NWP and the assurance chain remains unresolved. |
| Gloucestershire | Blanket statement that no relevant information is held. The position requires reconciliation with earlier published Gloucestershire disclosures recording RFR/PND use during an overlapping period. |
| Gwent | Partial but useful: no LFR; specific public governance material supplied by s21 for RFR/OIFR; no disclosed technical report supporting the non-retrievability assurance. |
| Cleveland | Partial: blanket “No information Held” response. Q5 is contradicted by Cleveland's own published FOIs recording RFR/PND use during the requested period; internal review requested 7 October. |
The tracker scores non-use fairly. A force is not penalised simply because it does not use a particular technology. “Information not held” is also kept distinct from a recorded zero.
What we asked
Recorded evidence that required post-deployment deletion actually occurred, plus retention-overrun counts.
Final audits, review outcomes, recommendations, corrective actions and deletion-related audit trails.
Technical or supplier assurance that deleted probes/templates cannot subsequently be recovered.
Recorded deletion failures, unauthorised retention/access, breaches and ICO reporting.
Whether used, plus policy/procedure, DPIA, APD, retention/deletion schedule and assurance.
Governance documents, suppliers, processor/controller roles and relevant contractual provisions.
What we deliberately did not ask for
Watchlist identities; operational intelligence about particular people; passwords; IP addresses; encryption keys; security credentials; exploitable technical vulnerabilities; covert policing tactics; or network architecture.
Where genuine sensitive material appears within a document, the request expressly accepts appropriate redaction and asks for the reasonably severable remainder.
Policy is not the same as evidence
The investigation keeps three things separate:
- what policy says should happen;
- what recorded evidence demonstrates did happen; and
- what remains unknown.
The raw working tracker contains correspondence links and internal handling notes, so it is not published directly. This page is the public snapshot and will be updated as substantive responses, reviews and decisions arrive.
Trust requires evidence.