Last reviewed: August 2026
A store manager calls us after a bad month for shoplifting. Staff are rattled and the loss figures are climbing. Someone on the management team has seen a rival retailer running facial recognition and wants to know if we can fit it here.
It's a fair question, but the wrong first one. The real question isn't whether the equipment can be installed - cameras and software are easy to buy. It's whether you can lawfully run it and whether you've done the work that makes it defensible if something goes wrong.
Get it wrong and the cost isn't just a fine. It's a wrongly-accused customer confronted in front of other shoppers and a press story that outlasts the technical fix.
That question follows a specific sequence set out across UK facial recognition legislation. A 2025 case shows exactly what happens when a retailer skips it. That's why we'd rather talk you through the legislation before we talk you into a system.
In 2025, a shopper was reportedly wrongly matched against a retail watchlist by Facewatch's facial recognition system, deployed at Home Bargains." She was confronted in-store as a suspected shoplifter, according to widespread UK press coverage. It became a widely reported example of a facial recognition false positive in UK retail. Not an abstract statistic - a real person, wrongly accused, in front of other customers.
First, the human-review failure. An LFR system produces a match. That match is intelligence, not evidence - a probability score, not a verified fact. Every credible compliance framework we're aware of insists on one rule: no automated action on an alert alone - a principle rooted in Article 22 UK GDPR's restriction on solely automated decisions with legal or similarly significant effects. A trained member of staff has to check the match, image quality and context and independently decide whether to act. In any deployment, when that step is thin or rushed, the error can become a public confrontation.
Second, the reputational cost. A story like this doesn't stay contained to the store where it happened. It becomes a national talking point about the retailer, the vendor and facial recognition in retail generally. A compliance sign-off after the fact won't undo that kind of coverage. The damage is done the moment the wrong person is stopped, not when a regulator later reviews the paperwork.
Not every camera-based system that claims to spot repeat offenders is facial recognition in the legal sense. Simple people-counting or heat-mapping technology, which doesn't identify a specific individual, sits outside it.
It's also worth distinguishing live facial recognition from retrospective facial recognition (RFR), which matches stored footage against a watchlist after the fact. RFR raises the same Article 9 and Data Protection Impact Assessment (DPIA) questions, just on a different timescale.
Genuine facial recognition means software that extracts a unique biometric template from a face to identify a specific person. That makes it special category data under Article 9 of UK GDPR (the UK General Data Protection Regulation). That triggers a stricter lawful-basis test, a mandatory impact assessment and a higher bar for getting it wrong. Ask any vendor what the system actually does before money changes hands, including what independent bias and accuracy testing evidence they can show for their algorithm - marketing language isn't a reliable guide.
Under Article 6 of UK GDPR, you need a lawful basis for processing personal data at all. For a retailer running LFR, the realistic option is legitimate interests. Crime prevention is a recognised interest, but it has to pass a necessity and balancing test - it can't just be asserted. Consent is rarely workable, since you can't meaningfully obtain it from every walk-in member of the public.
Because facial recognition is special category data, Article 6 alone isn't enough. You also need a condition under Article 9 and DPA 2018 (the Data Protection Act 2018) Schedule 1. The realistic route is Schedule 1, Part 2, paragraph 10 - preventing or detecting unlawful acts. That requires a written Appropriate Policy Document (APD) covering compliance measures and retention, kept for the processing period plus six months. If that condition isn't genuinely satisfied, the honest answer is to stop here. Drafting or certifying it is a job for a data protection specialist or solicitor, not an installer. If we're not qualified to advise on something, we say so rather than guess.
Worth tracking: the Data (Use and Access) Act 2025 introduces a new "recognised legitimate interests" basis. Once in force, it simplifies the Article 6 test for purposes including crime prevention. That only touches Article 6 - it doesn't remove the Article 9 special-category condition or the APD requirement above.
This is where most unlawful deployments actually fail. Is the watchlist genuinely limited to individuals connected to specific, documented unlawful acts? Or is it a general "known troublemakers" list built on suspicion? Is the scope matched to evidenced risk, rather than a blanket rollout?
The clearest precedent is the ICO (Information Commissioner's Office) enforcement action against Serco Leisure in February 2024. That case involved biometric fingerprint scanning used for staff attendance. The ICO found Serco couldn't show the processing was necessary, because ID cards or fobs achieved the same purpose without touching biometric data. The same logic transfers to facial recognition. If a non-biometric alternative - better CCTV, tighter Access Control, more visible staffing - would solve your problem, that weakens the case for biometric processing.
"Biometric data is wholly unique to a person, so the risks of harm in the event of inaccuracies or a security breach are much greater - you can't reset someone's face or fingerprint like you can reset a password."
John Edwards, then Information Commissioner, on the Serco Leisure enforcement action, February 2024
A Data Protection Impact Assessment (DPIA) is mandatory under Article 35 UK GDPR wherever processing is likely to result in high risk. Live facial recognition of the public routinely meets that threshold. It must be completed before processing begins, not written up afterwards.
A proper DPIA documents the purpose, the necessity and proportionality assessment, the risks to individuals and the mitigating measures. It's the record that shows the risk was thought through in advance, not explained away afterwards. If the risk is still high after mitigation, you must consult the ICO before going live. We can supply the technical facts a DPIA needs. Certifying the document itself is a job for a qualified data protection specialist, not a CCTV installer. If we're not qualified to provide a service we won't offer it - and DPIA sign-off is one of those services.
Getting the legal basis and the DPIA right is necessary but not sufficient. LFR needs live, ongoing governance — and this is where the Home Bargains incident appears to trace back to. Retailers who avoid an incident like that treat the six safeguards below as standing operating procedure, not paperwork filed away and forgotten.
Notice which item most plausibly connects back to the Home Bargains case: human review of every match. When that step is genuinely robust, the system catches its own errors before they reach a customer. That means a trained person checking image quality and context every time, with the authority to say "this isn't a match." When it's a formality, the error reaches the shop floor instead. As your installer, we handle the technical side: access restriction, an audit trail on watchlist changes, retention configuration and training material. That's what makes sure human review actually works the way it's meant to. The governance policy itself - who decides who goes on a watchlist and why - sits with you as the data controller.
Your contract with the vendor also needs data processing terms consistent with Article 28 UK GDPR. You remain the data controller even when the matching technology and watchlist hosting come from someone else.
This is where a lot of confusion sits. Installing and maintaining a CCTV or facial recognition system is never licensable under the Security Industry Authority (SIA) regime. That regime applies to individuals monitoring a system and acting on alerts, not to the people who fit it - us included.
SIA licensing currently applies to CCTV monitoring under a contract for services - an outsourced operator. It doesn't apply to your own employees monitoring your own site's CCTV in-house. The Manchester Arena Inquiry flagged this in-house exemption as a gap. A Home Office and SIA consultation on closing it - Monitored Recommendations 7 and 8 or MR7/MR8 - closed on 12 March 2026. No decision has been published yet. Anyone telling you in-house monitoring will soon require an SIA licence is getting ahead of the actual position. We'll flag it the moment that changes.
It's tempting to assume expanding police use of LFR means the private sector is being waved through on the same basis. It isn't.
The starting point for this area of law is R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058. That's the Court of Appeal ruling that first found police use of live facial recognition unlawful. The court cited an inadequate DPIA and a failure to properly assess the risk of demographic bias in the software. That's a breach of the Public Sector Equality Duty under the Equality Act 2010, which binds public authorities like the police - not retailers. A private business doesn't inherit that specific duty. But if biased software led your business to disproportionately misidentify customers of a particular ethnicity, that's different. It could raise separate Equality Act 2010 exposure under the Act's rules on discrimination in service provision - rules that do apply to retailers. Either way, a documented bias and accuracy check is now baseline practice for any LFR deployment, private-sector included.
More recently, in April 2026, the High Court dismissed a judicial review brought by two claimants. The case was R (Thompson and Carlo) v Commissioner of Police of the Metropolis [2026] EWHC 915 (Admin). The court found the Metropolitan Police's LFR policy compatible with Articles 8, 10 and 11 of the European Convention on Human Rights. Those cover private life, freedom of expression and freedom of assembly. The claimants have indicated they intend to appeal, so treat the ruling as significant but not final. Separately, a Home Office consultation on a new statutory framework for police biometrics closed in February 2026 with no government response published yet. Any claim that police LFR now sits on settled statutory footing is premature.
None of that case law changes your position as a retailer. Thompson and Carlo concerns the police's common-law powers as a public authority - a different regime from the one governing your store. Your exposure runs through UK GDPR and the Data Protection Act 2018, not the Human Rights Act, which binds public bodies rather than private companies. So if the police can lawfully use LFR under their framework, that tells you nothing about whether you can under yours.
Worth noting: the ICO's 2023 assessment finding Facewatch's approach compliant is useful evidence a private operator can satisfy this framework. But the ICO was explicit this wasn't a green light for widespread or indiscriminate use - every deployment is assessed on its own facts. The Home Bargains incident happened with the same vendor two years later. It shows a 2023 clearance for one deployment doesn't carry over to a different site.
We'd rather talk you out of a deployment that won't stand up. We'd rather steer you toward a solution that fits the problem - that's why we offer a free, no-obligation survey before any recommendation, not after.
Depending on what's driving the request, here's what we'd usually recommend instead:
None of these carry the DPIA burden, watchlist governance overhead or reputational exposure of a facial recognition deployment.
Castle Point Borough Council has worked with us on CCTV and alarm systems for years - a real example of the better-specified approach we've just described.
"Blakes have worked with Castle Point for a number of years installing and servicing our CCTV and alarm systems. They have always gone above and beyond to help look for solutions."
Tim Read, Operational Services Team Leader, Castle Point Borough Council
It's the same document-first, no-shortcuts approach we'd bring to any facial recognition compliance review.
Facial recognition is arguably the most legally and reputationally demanding tool available to a retailer managing theft or access risk. The Home Bargains case shows what happens when the safeguards around it aren't genuinely robust.
Go through that process properly, and you'll end up in one of two honest places. Either a defensible position to go ahead - the DPIA, the APD and a human-review process you could show a regulator or a challenged customer without flinching - or a clear reason not to. That's decided before you've spent the money, not defended after the fact.
Not sure yet which of those two places you're in? We're a family-run firm - NSI Gold approved, SSAIB certificated and BAFE SP203-1 registered - protecting Essex, Southend-on-Sea and London for 46 years. Big enough to cope, small enough to care - that's true whether you need one camera or a multi-site retail rollout.
If facial recognition is genuinely on the table for your site, a compliance-led review is worth doing before a single camera is ordered. That means the DPIA, the watchlist governance, the human-review process and whether a non-biometric alternative would do the job just as well. As qualified CCTV specialists, we can walk you through that technical assessment. We'll fit whatever comes out of it, biometric or not, alongside the data protection and legal advice that decision genuinely needs. Two of the legal questions covered above - the Data (Use and Access) Act 2025 provisions and the SIA consultation on in-house monitoring - are still moving, so a review done today is worth revisiting if either changes.
Call us on 01702 447800 or get in touch online for the same free, no-obligation survey we offer every commercial client. We'll help you work out where you stand before you spend anything on cameras or software.
Live facial recognition extracts a unique biometric template from a face to identify a person. That makes it special category data under Article 9 of UK GDPR - stricter than ordinary CCTV footage. It triggers a stricter lawful-basis test under Article 6, a mandatory DPIA under Article 35 and a higher bar if something goes wrong. People-counting or heat-mapping technology that doesn't identify a specific individual falls outside this framework. We'd always confirm exactly what a system technically does before treating it as "just CCTV" - marketing language isn't a reliable guide.
Under Article 6 of UK GDPR, the realistic lawful basis is legitimate interests. Crime prevention qualifies, but only after a necessity and balancing test. Because facial recognition is special category data, Article 6 alone isn't enough. You also need an Article 9/DPA 2018 Schedule 1 condition, typically the unlawful-acts provision, backed by a written Appropriate Policy Document. That's a job for a data protection specialist, not an installer. The Data (Use and Access) Act 2025's "recognised legitimate interests" basis simplifies Article 6 only. It doesn't remove the Article 9 condition or the APD requirement.
In 2025, a shopper was wrongly matched against a retail watchlist by a facial recognition system deployed at Home Bargains. She was confronted in-store as a suspected shoplifter - a widely reported example of a facial recognition false positive in practice. The core failure was human review. An LFR match is intelligence, not evidence. Every credible compliance framework requires a trained staff member to independently check the match, image quality and context before anyone acts on it. Reputational damage happens the moment the wrong person is stopped, not when a regulator later reviews the paperwork.
Yes. A DPIA is mandatory under Article 35 of UK GDPR wherever processing is likely to result in high risk. Live facial recognition of the public routinely meets that threshold. It has to be completed before processing begins, not written up afterwards. It documents the purpose, necessity and proportionality, the risks to individuals and the mitigating measures. Where residual risk stays high even after mitigation, the operator must consult the ICO before going live. We can supply the technical facts for a DPIA. We won't present ourselves as certifying it unless we genuinely have a qualified data protection specialist on the job.
No. Installing and maintaining a CCTV or facial recognition system is never a licensable activity under the Security Industry Authority regime. That applies to individuals monitoring a system and acting on alerts. SIA licensing currently applies to outsourced CCTV monitoring under a contract for services, not to a retailer's own employees monitoring their own site's CCTV in-house. The Manchester Arena Inquiry flagged this in-house exemption as a gap. A Home Office and SIA consultation on closing it, Monitored Recommendations 7 and 8, closed on 12 March 2026 with no decision published yet. Treat this as a live regulatory question, not a settled requirement.
No - the two sit under entirely different legal frameworks. The starting point for UK facial recognition law is R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058. That case first found police LFR unlawful over an inadequate DPIA and an unassessed bias risk. In April 2026, the High Court dismissed a judicial review brought against the Metropolitan Police Commissioner. The case was R (Thompson and Carlo) v Commissioner of Police of the Metropolis [2026] EWHC 915 (Admin). The court found the Met's policy compatible with the European Convention on Human Rights. The claimants intend to appeal, so treat it as significant but not final. That's a public-authority case. A retailer's exposure runs through UK GDPR, not the Human Rights Act, so it says nothing about whether a retailer can lawfully deploy LFR.
