Constitutional implications of judicial review on the use of facial recognition technology by the police in UK

Abstract

Between May 2017 and April 2019, the South Wales Police in the UK operated the system called “AFR Location” equipped with automated facial recognition technology (henceforth, AFR) for the purpose of finding criminals and missing persons in need of protection. The system is deployed CCTV cameras on police vehicles and analyzes the faces of members of the public are taken from the CCTV feeds and compares them with the faces of the Watchlist to check whether they are the same person. These systems were temporarily used at large public events, such as the Defence Exhibition, and had safeguards to control the risk of data processing, such as software management to delete data such as facial images and biometric data immediately or within 24 hours. However, a civil liberties campaigner filed a lawsuit in October 2018 to challenge the lawfulness of the South Wales Police’s use of AFR, stating the use of AFR violates his right of privacy. This was reportedly the first case to deal with the lawfulness of facial recognition technology by police in the worlds. The Divisional Court dismissed the Claimant’s claim for judicial review on all grounds and ruled in favor of the South Wales Police, but the Court of Appeal affirmed the unlawfulness of the South Wales Police’s use of AFR. The main reason for the unlawfulness is the breach of the requirements of Article 8 of the European Convention on Human Rights. Article 8(1) stipulates “the right to respect private life”, and Article 8(2) provides that such rights shall be no interference by a public authority except such as is “in accordance with the law” and is necessary in a democratic society. According to this, Court of Appeal concluded that there is not a sufficient legal frameworks to properly control the use of AFR by the South Wales Police. There are not enough legal safeguards to properly control the use of AFR system, because there are not any criteria for determining where AFR can be deployed and who can be placed on the watchlist. This judgment of the Court of Appeal has great implications for us. In light of the fact that Article 8(2) of the European Convention on Human Rights is similar to Article 37(2) of the Constitution of Republic of Korea, it provides implications for how the principle of rule of law should be interpreted in relation to the processing of personal and sensitive information processed by biometrics. In other words, whether or not the principle of rule of law has been uphold should be evaluated as whether there are sufficient safeguards to prevent the actual risk of abuse and arbitrary use, not just whether there is a legal basis of processing of data in the Missing Children Act, Act on the Performance of Duties by Police Officer, and the Personal Information Protection Act. In this dimension, this study attempted to suggest proposals of these Acts.