About Face

by | Aug 30, 2023 | Uncategorised

In March, Deputy Information Commissioner Stephen Bonner announced that the facial recognition company Facewatch would face “no further regulatory action”. Given that all the Commissioner’s staff had done up to that point was investigate (since 2019), “no action at all” might be more accurate, but we’re dealing with an organisation that claims reprimands are enforcement.

Facewatch explicitly mischaracterised this decision, making the false claim that the Commissioner’s verdict was that they were fully compliant, while using the ICO’s logo in their promotional materials without permission. The Commissioner’s staff told me that they only found out about this when I made an FOI request about it.

At the end of July, the Observer reported that policing minister Chris Philp, Home Office officials and staff from Facewatch had met secretly in March and that the minister was planning to write to the Commissioner as a result. I hope that ministers and civil servants will be more circumspect about who they meet with in future, given Facewatch’s subsequent decision to use misinformation about a regulator’s official position as a marketing tool.

Following the Observer story, I made another FOI request to the Commissioner to find out what the minister actually said, and for information about why the Facewatch investigation was dropped. Their reply relies heavily on exemptions.

I can say some things for certain. The decision to close the investigation was taken by John Edwards. Philp didn’t put pen to paper, but his people talked to Edwards’ people repeatedly in the run up to making the decision public. Despite the claim that Philp didn’t want to apply pressure, a Home Office civil servant said they could probably head off his letter if the ICO’s decision was going in Facewatch’s favour. But if the Commissioner was minded to take action against Facewatch, it would be sent. It’s not exactly subtle.

Another thing is clear. In February 2023, the Commissioner was weighing up three options. These were: close the investigation, keep it going and a third choice which the ICO is keeping secret using FOI S31, the law enforcement exemption. Specifically, they did this to avoid prejudice to their ability to consider whether someone has failed to comply with the law, and to consider whether regulatory action is justified.

I do not know what this third option is. Every time it is mentioned in the internal correspondence the Commissioner sent me, the details are redacted. However, the recommendation is that the Commissioner should take the first and third options: end the investigation and do whatever the secret option is.

On February 9th, meeting minutes show someone recommending closing the investigation, then a sentence is redacted under S31, followed by ‘JE agreed’. It could be ‘close the investigation and do this other thing’. It could also be ‘close the investigation and do nowt else’. I don’t see how confirming the latter would prejudice the ICO’s regulatory powers given that this was the result, but I can’t say for certain.

On February 28th, ICO staff had verbal contact with Home Office staff, which the latter followed up with an email. “Is there any update or has there been any change in the ICO position re Facewatch?” they asked. They chased this up a week later. ICO replied a few days after that saying “this is taking longer than we initially thought”, even though Edwards’ decision had apparently been taken a month before. The Home Office then said that Philp was thinking of writing his letter.

It’s worth saying that while I asked for “any internal correspondence within the ICO about the decision to close the Facewatch investigation, including any information that shows why the Commissioner decided to close the investigation”, despite the fact that the decision was not finalised until mid-March, the last information the ICO provided was from February 13th.

I am guessing what the mystery third option was, but it would make sense if it involved some form of action, and frankly, the documents provided to me would make less sense if it didn’t. It’s possible that the third option was actually a wider investigation into the sector as it would have involved multiple case officers. However, one of the few unredacted sentences about it says “we could examine further technology providers as well”, which implies that it is mainly about Facewatch.

By the end of the month, with the Home Office asking whether the position had changed (so knowing what that position currently was), everything seemed to slow down. Then Philp started to agitate, and the final outcome was to close the case and do nothing else.

I think it is fair to say that Philp wanted to put his thumb on the scale in Facewatch’s favour. The Home Office repeatedly asked what the Commissioner was planning to do and the threat of a ministerial letter was dangled. A third option that was distinct from closing the case or keeping it open was recommended, and it might have been what Edwards originally agreed to, but it apparently wasn’t taken forward.

I’m biased. I think Edwards is in the UK to deliver this government’s agenda and is easily the least capable Commissioner we’ve had, so I find it hard to be objective about his approach. But especially given Facewatch’s outrageous claim about the outcome and the close interest from the Home Office right when the decision was being finalised, I think more transparency about what happened here is warranted. I will ask for an internal review of this decision.

In the meantime, it’s obvious that the Home Office is keen on more facial recognition being operated by retailers, and the Information Commissioner isn’t going to stand in the way of that. Even if I’m wrong and action was never really on the table, that’s not an outcome anyone with an interest in privacy should be comfortable with.