Lessons For AI Use By Public Authorities In Divisional Court’s Decision On Lawfulness Of Facial Recognition Technology

A Divisional Court has considered the lawfulness of the police’s use of live facial recognition (LFR) in R (on the application of Thompson and Carlo) v the Commissioner of Police of the Metropolis [2026] EWHC 915 (Admin) . In finding that it was in accordance with the law, the judgment gives helpful guidance on what framework and safeguards might be required for future use of AI by public authorities where broad discretionary powers are involved. 

Key Points

• To be lawful a measure must have sufficient clarity and foreseeability so as not to allow arbitrariness.
• The mere fact that a discretionary power is broad is insufficient to make that power not in accordance with the law; rather the focus is on clarity as to the scope of the power and the circumstances and conditions in which the power can be exercised.
• Unrestrained power will not be in accordance with the law, but neither is an overly rigid approach necessary.
• The more intrusive the act complained of, the more precise and specific must be the law said to justify it. 

Background

The claimants in this case were Mr Thompson and Ms Carlo. Mr. Thompson was stopped, detained and questioned after having been matched using LFR with a different person who was on a police watchlist. Ms. Carlo is the director of the civil liberties organisation Big Brother Watch. 

The Equality and Human Rights Commission (the Commission) intervened in the case, emphasising that the world has recently seen the rapid development of AI, giving rise to potentially significant risks unless constrained by domestic and international law. 

The claimants challenged the legality of the policy adopted by the Metropolitan Police in relation to the deployment of LFR in London (the Policy). The grounds of challenge were: 

1. that the Policy violated Article 8 of the European Convention on Human Rights (ECHR) in that it allows interference with the right to respect for private and family life by the use of LFR which is not in accordance with the law (IAWL) (Ground 1); and
2. that the Policy violated Articles 10 and 11 ECHR, in that it allows restrictions upon the freedom of expression and the freedom of assembly and association by the use of LFR which is not prescribed by law (PBL) (Ground 2). 

It was common ground that whether the Policy is IAWL raised the same issues as whether it is PBL, such that the grounds were dealt with together. 

The key previous authority on the use of LFR by the police was R (Bridges) v South Wales Police [2020] EWCA Civ 1058, in which the Court of Appeal held that South Wales Police’s use of LFR was not IAWL for the purposes of Article 8(2) ECHR. This was because it left too broad a discretion to individual police officers, and it was not clear who could be placed on the relevant watchlist, nor was it clear that there were any criteria for determining where the technology could be deployed. 

Judgment

The central question, as in Bridges, was whether the Policy left too much discretion to individual officers to have the quality of law, in the sense of being accessible, foreseeable as to its consequences and compatible with the rule of law. 

The accessibility of the Policy was not in issue, and so foreseeability was crucial here in considering whether the Policy conferred such a broad discretion that it “is in practice dependent on the will of those who apply it, rather than on the law itself”, effectively allowing it to be arbitrarily applied. 

The court made it clear that foreseeability was not the same as considering proportionality but was rather a prior question, in that if a measure is not foreseeable then it violates the relevant ECHR right, whereas if it is foreseeable then an examination of justification and proportionality may be required. In this case, the claimants did not question proportionality or justification, focusing entirely on IAWL.

The court relied heavily on Bridges but ultimately reached the opposite conclusion in finding the Policy was IAWL. Although the court was clear that any exercise of power that is unrestrained by law is not IAWL, there is no need for codification or an overly rigid approach as long as there are appropriate safeguards around discretionary power. It interpreted the authorities as demonstrating that “the mere fact that a discretionary power is broad is insufficient to make that power not IAWL”; rather the focus is on clarity as to the scope of the power and the circumstances and conditions in which the power can be exercised. These safeguards or principles can be set out in law, policy or a combination of the two. However, this does not necessarily mean any particular individual or entity needs to be able to see how the power will be exercised in relation to them. 

The relativist approach from Bridges was confirmed, i.e the more intrusive the act complained of, the more precise and specific must be the law said to justify it. LFR was not considered to be at the highly intrusive end of the spectrum (compared to e.g. DNA sampling or bugging), but it was noted to be a novel technology processing sensitive data in an automated manner. 

Unlike in Bridges, this Policy did address the questions of who, why and where in relation to the use of LFR, such that there were interlocking and cumulative requirements before LFR could be deployed. Importantly, the Policy specifically flagged the need to consider proportionality and relevant ECHR rights, and this was described as “an overarching constraint on all aspects” of the use of LFR. Such issues also formed part of the authorisation process required for deployment of LFR, meaning proportionality should be considered at the level of each deployment and not just at the general level. The questions decision-makers had to consider before deployment were tied closely to the legal test, focusing on the relevant objectives and whether less intrusive measures could be used to achieve them as well as the overall question of fair balance. 

The court was not concerned by high level factors such as “operational experience” being part of the criteria, despite the submission that the term “operational experience” is too opaque and subjective to meet the test of foreseeability. Holgate LJ and Farbey J considered that, looked at in its proper context, the term reflected evidence-based judgments encompassing specialist and corporate knowledge, and could be distinguished from individual “hunches”, “intuition”, or “whims” which would give rise to concerns as to the potential for arbitrariness. It was notable that although the claimants raised concerns about discrimination issues there was no challenge on discrimination grounds. 

In relation to the arguments by the Commission as to potential future uses and developments, the court acknowledged that the uses to which LFR may be put, and the technology which supports it, will doubtless evolve. However, it emphasised that this claim is concerned only with the terms of the Policy under challenge and its current lawfulness. 

As an aside, the judgment provides a helpful reminder of the need to take a strict approach to evidence, with significant sections of a witness statement being declared inadmissible for containing opinion, criticism of lack of specificity and irrelevance in other evidence and permission refused to rely on proposed expert evidence which was described as “unenlightening” and “limited”.

Comment

Although the court focused on LFR and explicitly refused to speculate on future uses of technology, despite concerns over AI raised by the Commission, this judgment is obviously significant in relation to use of other forms of AI by public authorities, as well as to more traditional broad discretionary powers. 

In clarifying, and perhaps narrowing Bridges, it suggests that broad discretion will be permissible provided there is a proper framework for use of the technology in place and issues such as proportionality are emphasised. However, the question will be how high level that framework can be, given the clear message from Bridges that constraints vague and general enough to effectively still be dependent on the will of those applying a power in practice will not be sufficient. 

In relation to the focus on proportionality in the Policy, the court placed emphasis on the specific and practical guidance and did not accept that it was just a statement of the law, suggesting public authorities will need to do more than pay lip service to ECHR rights.

Public authorities seeking to put in place policies and procedures around use of AI should take note of the detailed review the court undertook to ensure that the Policy was in accordance with the law – simply because something is a novel technology or part of a trial does not alter the need for any interference with ECHR rights to be in accordance with the law.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.