Judgment Approved by the court for handing down.
16.
R (Bridges) -v- CC South Wales & ors
The CCTV camera records footage for the duration of any AFR Locate deployment.
AFR Locate is capable of scanning 50 faces per second (although that does not
necessarily mean 50 different people). Beyond those technical limitations, there is no
limit on the number of persons who may have their facial biometrics captured during
any given deployment. It is SWP’s intention during each deployment to allow AFR
Locate to process as many individuals as possible. It is clear that the numbers of persons
processed are very large. Over the 50 deployments that were undertaken in 2017 and
2018, around 500,000 faces may have been scanned. The overwhelming majority of
persons whose biometrics are captured and processed by SWP using AFR Locate are
not suspected of any wrongdoing and are not otherwise of interest to the police.
Data retention
17.
If no match (false or positive) is made – as in the overwhelming majority of cases –
then AFR Locate does not retain the facial biometrics or image of persons whose faces
are scanned. They are immediately and automatically deleted. That data is not available
to the system operator or any other police officer. The CCTV feed is retained for 31
days in accordance with the standard CCTV retention period. Data associated with a
match is retained within AFR Locate for up to 24 hours. In the event of no match, the
data is immediately deleted.
18.
SWP’s Standard Operating Procedures and Data Protection Impact Assessment provide
for data retention periods. These are kept under review. The current data retention
periods are as follows:
(1) CCTV feed to AFR Locate deployments: retained for 31 days with automatic
deletion as part of the “Milestone” software.
(2) Facial images that are not matched against: immediately deleted.
(3) Biometric template (regardless whether match made): immediately deleted.
(4) Facial images alerted against: images either deleted immediately following the
deployment, or, at the latest, within 24 hours following the deployment.
(5) Match report to include personal information (name of individual alerted
against): retained for 31 days.
(6) Watchlist images and related biometric template: deleted immediately
following the deployment, or at the latest within 24 hours following the
deployment.
Public awareness of when AFR Locate is used
19.
When AFR is deployed, SWP take steps to inform members of the public about AFR
and as to its use at the event or in the area in question. Those steps include the following:
(1) prior to each AFR deployment, utilising Facebook and Twitter to advertise the
deployment and its location and invite engagement with officers who are deploying the
technology; (2) displaying large A2-size “Fair Processing Notices” on the AFRequipped police vehicles on site and at approximately a 100 metre radius of the AFR
cameras; and (3) handing out postcard-sized notices to members of the public in the