What Bridges v South Wales Police Really Decided About AI and Accountability

A Narrow Ruling With a Wide Lesson

In August 2020, the Court of Appeal handed down its judgment in Bridges v South Wales Police, the first UK case to test whether police use of live facial recognition complied with human rights and data protection law. The claimant, Ed Bridges, had been scanned by South Wales Police's live facial recognition system on two occasions in Cardiff, without his consent and without having done anything to attract police attention. He argued that this breached his right to privacy.

The case gets cited constantly in debates about AI and policing, but it is often summarised loosely, as the court banning facial recognition outright, or ruling that AI surveillance is unlawful as such. Neither is accurate. The judgment is narrower than that, and for that reason it is more useful as a template for anyone building or deploying AI systems that make or inform decisions about identifiable people, not only police forces.

What the Court of Appeal Actually Held

The Court of Appeal did not rule that live facial recognition technology is inherently unlawful. It ruled that South Wales Police's specific deployment, under the policy it had in place at the time, was unlawful because the legal framework governing it gave individual officers too much discretion over two particular questions: who could be placed on a watchlist, and where the technology could be deployed. Because those two questions were left to officer judgement rather than fixed by clear, published criteria, the interference with the right to private life under Article 8 of the European Convention on Human Rights was not, in the court's view, in accordance with the law, which is the threshold the Convention requires before any interference with that right can be justified at all.

The court also found that South Wales Police had not complied with its public sector equality duty, the obligation under section 149 of the Equality Act 2010 to have due regard to the need to eliminate discrimination. This part of the case is frequently misquoted. The court did not find that the facial recognition software was in fact biased by race or sex. It found that the force had not taken reasonable steps to satisfy itself, one way or the other, that the software did not carry an unacceptable bias on those grounds before deploying it. The failure identified was one of due diligence, not a proven finding of discriminatory outcomes.

Separately, the court found the force's data protection impact assessment deficient, because it did not properly address the same gaps around who could be watchlisted and where the system could be used. In reaching this result, the Court of Appeal partially overturned an earlier High Court ruling from 2019, which had found South Wales Police's use of the technology lawful on the facts before it.

Oversight After Bridges: Guidance Without a Dedicated Statute

Bridges exposed a structural problem that has not gone away: there is no single, purpose-built UK statute governing police use of live facial recognition. Forces operate instead under a patchwork of general human rights law, data protection law, equality law, common law policing powers, and guidance.

The main standing oversight body in this space is the Biometrics and Surveillance Camera Commissioner, a role that brought together two functions that previously sat separately: oversight of police retention and use of biometric material such as DNA and fingerprints, and oversight of compliance with the Surveillance Camera Code of Practice issued under the Protection of Freedoms Act 2012, which covers CCTV, automatic number plate recognition, and camera based systems more broadly. The Commissioner produces guidance and reports to the Home Secretary, and has repeatedly pointed to the absence of a dedicated legislative framework for live facial recognition specifically, as distinct from the general data protection and equality law that forces currently rely on to justify its use.

What the Commissioner's role does not do is pre-approve or block a specific deployment. That function, in practice, falls to the courts, as in Bridges, to the Information Commissioner's Office where data protection is engaged, and to each force's own internal policy review. For any organisation watching this space, the lesson is that UK oversight of biometric AI currently runs mainly through after-the-fact legal challenge and voluntary alignment with codes of practice, rather than through a single regulator with pre-clearance power over individual deployments.

What This Means for Any Organisation Using AI on Identifiable People

Strip away the policing context and Bridges is, at its core, a case about documentation. The force lost not because it used an AI system to flag people in public, but because it could not point to a sufficiently clear, published policy fixing who the system could be used to search for, and where it could be switched on. A system applied consistently in practice but governed only by unwritten officer judgement still fails the in accordance with the law test.

That logic travels well beyond policing. Any organisation, public or private, using an AI system to make or inform a decision about an identifiable person, whether that is flagging someone at a border, screening an applicant, or matching a face against a database, should expect to be judged on whether it can show, in advance and in writing, who the system can be used on, under what circumstances, and who is accountable for approving each use. Saying the system is only used sensibly is not a defence if those limits were never documented.

Bridges also shows that a data protection impact assessment is not a box ticking formality. The court treated its adequacy as a live legal question, scrutinising whether it actually grappled with the specific risks of the deployment rather than restating generic AI risk language. The equality duty point is a reminder in the same spirit: an organisation deploying AI on identifiable people needs to be able to show it checked for bias before going live, not that it happened to avoid criticism afterwards.

At Mickai, where we build a Sovereign Intelligence Operating System, this is the kind of accountability question we think any organisation deploying AI in decisions about identifiable people needs to be able to answer, not only police forces. The practical takeaway from Bridges, six years on, is not a verdict on any one technology. It is a standing requirement: before an AI system is pointed at identifiable people, the organisation deploying it should have a written answer, fixed in advance, to who the system can be used on, where, and on what evidential basis, available for scrutiny rather than reconstructed after a complaint.

Sources

• R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058, the Court of Appeal judgment on South Wales Police's use of live facial recognition, handed down in August 2020.
• Equality Act 2010, section 149, the public sector equality duty considered in the Bridges judgment.
• Biometrics and Surveillance Camera Commissioner, the UK oversight role covering police use of biometric material and compliance with the Surveillance Camera Code of Practice issued under the Protection of Freedoms Act 2012.