Sir John Whittingdale

My right hon. Friend has anticipated my next point extremely effectively. I was Minister at the time of the passage of the Data Protection and Digital Information Bill, which did not cover live facial recognition technology. At the same time, my right hon. Friend the Member for Croydon South (Chris Philp), who is the shadow Home Secretary, was the Minister for Policing and he made a speech about how valuable live facial recognition technology was. I therefore sought advice about how that fitted in with GDPR. The advice that came back following consultation with the Information Commissioner’s Office was that there is no blanket approval by the ICO for the use of LFR technology. Essentially, it should be judged on a case-by-case basis, but the ICO had expectations that data protection and privacy should be respected. It went on to say that the use of LFR can be highly intrusive and future uses of the technology may require updates, but that the ICO is monitoring it closely. That is only partially reassuring. Essentially, the ICO recognises that breaches of data protection could be possible, and is monitoring it, but there is no clear guideline to assist the police or anybody else with precisely how it should be used. I am grateful to legal consultants Handley Gill, who wrote to me yesterday and who are involved in advising a number of people about the legality of the technology. They said that “it is undesirable for individual Chief Officers and PCCs to have to engage in the wide ranging review and preparation of the necessary documentation, and that a move toward a common national approach (and choice of technology provider) would secure efficiencies and also enable closer monitoring…to ensure their efficacy and lawfulness.” Although we are no longer bound by European Union law, the EU has brought in much more stringent controls than exist here.