MPS's use of Live Facial Recognition (LFR)

Freedom of information request reference no: 01.FOI.22.024139

I note you seek access to the following information:

I have a request regarding the MPS' use of Live Facial Recognition (LFR).

1. I am requesting the Community Impact Assessments for all LFR deployments from 2016 to 2022 to be shared. The LFR Standard Operating Procedure states for each authorised LFR operation, a Community Impact Assessment (CIA) needs to be created, reviewed, and amended where necessary. However, these CIAs have not been published on the MPS website.
2. I have another request regarding all Live Facial Recognition Technology (LFR) deployments from 2016 to 2022. What is the distribution of true alerts and true alerts engagements for all LFR deployments across demographic classes (IC codes)?
3. What is the distribution of false alerts and false alert engagements for all LFR deployments across demographic classes (IC codes)? There is no public information about the demographic breakdown of true alerts. For the demographic breakdown of false alerts, this information is only provided for the deployments from 2016 to 2019 in MPS' report.

I have a few information requests regarding MPS' use of Retrospective Facial Recognition (RFR) and the Police National Computer (PNC).
4. What legal basis for MPS' planned use and updated capability of RFR?
5. How is it different from the legal basis for LFR?
6. For the previous or current function of RFR under the PNC, what are the criteria for where can the probe image come from?
7. Can the probe image come from social media?
8. In what circumstances can RFR be used?
9. What is the distribution of the PNC across demographic classes (IC codes)?

Decision

I have today decided to disclose some of the requested information. Some data has been withheld as it is exempt from disclosure and therefore this response serves as a Refusal Notice under Section 17 of the Freedom of Information Act 2000 (the Act) by virtue of the following exemptions:

Section 21(1) – Information accessible to applicant by other means
Section 31(1)(a)&(b) – Law Enforcement
Section 40(2)&(3) – Personal Information

Reason for decision

When a request for information is made under the Act, a public authority must inform you, when permitted, whether the information requested is held. It must then communicate that information to you. If a public authority decides that it cannot comply with all or part of a request, it must cite the appropriate section or exemption of the Act and provide you with an explanation.

Section 21(1) – Information accessible to applicant by other means
The Section 21 exemption applies to Question 1, where one document is already in the public domain and I have provided the relevant link below.

Section 21 of the Act provides public authorities with an exclusion from the duty to disclose information, under Section 1(1)(b) of the Act, when the information requested is reasonably accessible to the applicant. This exemption is accordingly claimed in respect of the information requested that is published. Where information is already in the public domain we are not required to re-publish the data, instead, public authorities are required to direct you to the information, which we have done in this instance.

Section 31(1)(a)(b) – Law Enforcement - of the Act provides that any information is exempt if its disclosure under the Act would, or would be likely to, prejudice the prevention or detection of crime or the apprehension or prosecution of offenders.

When information is released under FOIA it is also published on the MPS website and considered to be a release to the world and the MPS then has no control over what use is made of that information.

Whilst not questioning the motives of any applicant, providing information that we believe would prejudice law enforcement any information that would reveal policing tactics or would compromise law enforcement tactics. This would hinder the MPS’ ability to prevent and detect crimes and would allow criminals to gain knowledge about capabilities and investigative processes of police forces as a whole. Such criminals will be able to determine vulnerabilities and specifically target those force areas where they see a potential area to exploit. This would undermine the operational integrity of our activities, which would adversely affect law enforcement.

The public interest is not what interests the public but what will be of greater good if released to the community as a whole. It is not in the public interest to disclose information that may compromise the MPS’ ability to accomplish its core functions of law enforcement.

The MPS is reliant upon the techniques used during investigations and the public release of some of the information requested would prejudice its ability to conduct policing of investigations.

When considering whether the release of information is in the public interest, I have to consider whether the public interest is in favour of releasing information into the public domain or whether there is sufficient reason to support withholding the requested information.

I have found that that the public release and publication of the information requested would provide persons intent on disrupting the work of MPS, with information that would assist them in this endeavour.

Given this and the fact that the removal of this information does not detract from the quality of the information being disclosed, I have found that the release of this information is not in the public interest.

Section 40(2)&(3) - Personal Information - of the Act provides that any information to which a request for information relates, is exempt information if the first condition of Section 40(3A)(a) is satisfied. The first condition of Section 40(3A)(a) states that personal information is exempt if its disclosure would contravene any of the data protection principles. If the disclosure of the requested personal data would not contravene the data protection principles, the disclosure must also not contravene Sections 3A(b) and 3B of the Act.

There are six principles that are set out in Article 5(1)(a) of the General Data Protection Regulations (GDPR) that dictate when the processing of personal data is lawful. The first principle requires that any processing of personal data must be lawful, fair and transparent. Under Article 6(1)(f) of the GDPR, the disclosure of personal data is considered to be lawful if:

a. There is a legitimate interest in the disclosure of that personal data.
b. The disclosure of the personal data is necessary to meet that legitimate interest.
c. The disclosure would not cause unwarranted harm to the data subject.

The requested records contain names and contact details of members of staff and other individuals which the MPS considers is of a personal nature. Having considered the legitimate interest test in respect of this personal data, I have found that:

• Names of MPS and outside agencies’ employees
The MPS and outside agencies’ employees named in the requested records would not reasonably expect their details to be published in response to a Freedom of Information Act request. I have not identified a legitimate interest that would be satisfied in disclosing their personal data in response to this request for information.

• Email addresses, telephone numbers and locations of staff members
The public release of email addresses, telephone numbers and locations of MPS employees and other agencies’ employees in connection with the Freedom of Information Act request would not satisfy any identifiable legitimate interest.

The provision to refuse access to information under Section 40(2)(a)(b) and (3A)(a) of the Act is both absolute and class based. When this exemption is claimed, it is accepted that harm would result from disclosure. There is accordingly no requirement to demonstrate what that harm may be in refusing access to information.

If the link below is broken on receipt of this response, please copy and paste it into your web browser.

The Section 31 & 40 exemptions also apply to Question 1. This is because details in the attached document have been redacted.

Disclosure

Q1 - I am requesting the Community Impact Assessments for all LFR deployments from 2016 to 2022 to be shared. The LFR Standard Operating Procedure states for each authorised LFR operation, a Community Impact Assessment (CIA) needs to be created, reviewed, and amended where necessary. However, these CIAs have not been published on the MPS website.

We have located 2 Community Impact Assessment documents which have been attached in redacted format. We are pleased to advise that 1 Community Impact Assessment.pdf is already in the public domain.

Q2 - I have another request regarding all Live Facial Recognition Technology (LFR) deployments from 2016 to 2022. What is the distribution of true alerts and true alerts engagements for all LFR deployments across demographic classes (IC codes)?

This data is not measured or collated, the information is therefore not held.

Q3 - What is the distribution of false alerts and false alert engagements for all LFR deployments across demographic classes (IC codes)? There is no public information about the demographic breakdown of true alerts. For the demographic breakdown of false alerts, this information is only provided for the deployments from 2016 to 2019 in MPS' report.

This data is not measured or collated, the information is therefore not held.

Q4 - hat legal basis for MPS' planned use and updated capability of RFR?

This information is not held, however, the MPS intends to publish a similar document to the LFR Legal Mandate prior to the operational deployment of Retrospective Facial Recognition.

Q5 - How is it different from the legal basis for LFR?

This question requires an opinion and is therefore not a legitimate FOIA question. FOIA deals with information that is already held in a recorded format.

Q6 - For the previous or current function of RFR under the PNC, what are the criteria for where can the probe image come from?

This is not in operation.

Q7 - Can the probe image come from social media?

This is not in operation.

Q8 - In what circumstances can RFR be used?

This is not in operation.

Q9 - What is the distribution of the PNC across demographic classes (IC codes)?

Although the MPS uses the PNC system, responsibility for sharing PNC data falls under ACRO and not the MPS.