What counts as biometric data in policing?
Biometric data is any information derived from a person's physical or behavioural characteristics that can be used to identify them. In UK policing the term covers fingerprints and DNA profiles taken after arrest, custody photographs used for facial matching, and increasingly voice recordings, iris scans and gait analysis, which identifies someone from the distinctive way they walk. Facial recognition is the most publicly debated of these technologies, but it sits within a much older and, in volume terms, larger system of biometric identification that has operated in England and Wales since long before any camera could recognise a face automatically.
Under UK GDPR and the Data Protection Act 2018, biometric data used for the purpose of uniquely identifying a person is classed as special category data, alongside health records and information about a person's ethnicity or political opinions. That classification is not a formality. It means police forces must satisfy a stricter legal test before collecting, storing or using it, and it is the reason biometric retention has become one of the more closely watched corners of policing law.
Fingerprints and DNA: the retention framework
The rules governing fingerprint and DNA retention sit mainly in the Police and Criminal Evidence Act 1984, commonly known as PACE, as amended by the Protection of Freedoms Act 2012. Under section 63E of PACE, a fingerprint or DNA sample taken from someone who has been arrested can be retained while the investigation continues. If that person is charged and convicted, the record can generally be kept indefinitely. If they are arrested but never charged, or charged and acquitted, the default position is that the material should be deleted.
There is an exception, and it is one that has attracted sustained criticism. Under section 63G of PACE, a chief officer of police can apply to retain an unconvicted person's fingerprints and DNA for a further three years, extendable by a further two with a district judge's approval, where the offence under investigation was serious enough to qualify and the force can show a case for retention. The person concerned has the right to make representations against the application. Successive biometrics commissioners have used their annual reports to note that far more of these applications are approved than are refused, and have described a persistent institutional reluctance within policing to delete biometric material once it has been collected, even where the legal default is deletion.
The Biometrics and Surveillance Camera Commissioner
Oversight of this system rests with the Biometrics and Surveillance Camera Commissioner, a combined role created in 2021 by merging what had previously been two separate commissioners, one responsible for biometric retention casework and the other for police compliance with the Surveillance Camera Code of Practice. The office has had an unusually turbulent recent history. The Data Protection and Digital Information Bill, introduced in 2023, proposed abolishing the role outright and transferring its biometrics casework to the Investigatory Powers Commissioner's Office, prompting the then commissioner, Fraser Sampson, to resign in anticipation of the office's closure.
That bill fell in 2024 without becoming law, and the commissioner role survived, though not without a period of genuine uncertainty about who, if anyone, was providing independent oversight of biometric retention decisions. An interim commissioner held the post through 2025 before a permanent Biometrics and Surveillance Camera Commissioner was appointed later that year. The episode illustrates a wider point that recurs across UK policing technology: oversight bodies created for a specific purpose can be reorganised, merged or abolished by ordinary legislation, and the continuity of scrutiny over sensitive police powers depends on decisions that have little to do with how well those powers are being used.
Beyond fingerprints and DNA: voice, iris and gait
Facial images and fingerprints remain the dominant biometric identifiers in day to day policing, but investment in other modalities is growing. Voice analysis is used in some fraud investigation and custody contexts to compare a recorded voice against a suspect, though its use in UK policing remains far less widespread and far less legally tested than fingerprint or facial matching. Iris recognition has seen limited operational deployment, largely confined to specific access control and identity verification settings rather than open street policing. Gait analysis, which attempts to identify a person from the pattern of their movement even when their face is not visible, remains substantially a research and pilot technology rather than a settled operational tool, though its appeal for use against low quality CCTV footage where a face cannot be resolved is obvious, and it is likely to receive more attention as the underlying computer vision techniques mature.
Each of these technologies raises a version of the same question that already applies to fingerprints and facial images: how accurate is the match, who is affected disproportionately if it is wrong, how long is the resulting data kept, and who checks that it was collected and retained lawfully in the first place. The regulatory architecture built for fingerprints and DNA over the past four decades was not designed with these newer identifiers in mind, and how far it can be stretched to cover them is one of the open questions this site tracks.
What is not settled
Several things remain genuinely unresolved. There is no single statute that comprehensively governs all forms of police biometric identification; the framework has grown by amendment, largely to PACE and POFA, rather than by deliberate design for the technologies now in use. The government has signalled an intention to bring forward a wider legal framework covering biometrics and facial recognition together, but as of the most recent reporting this had not been enacted. Retention practice remains, on the evidence of the commissioner's own reports, more permissive than the formal legal default of deletion would suggest. And the boundary between biometric identifiers that are tightly regulated, such as DNA and fingerprints, and newer ones such as gait or voice that fall into less clearly defined territory, has not been tested in court in the way that facial recognition has.
Follow the coverage
PoliceAI News tracks every biometrics story from across the English-speaking world as it breaks: new deployments, court rulings, parliamentary debates, academic research, and community responses. The feed refreshes every 30 minutes.
View Live Biometrics StoriesYou can also browse every biometrics story in the feed, or explore every subject PoliceAI News covers.