Immigration Enforcement published its overdue Holyhead facial recognition data this month, 231 days late. Its own table records two arrests from zero recorded alerts, a week before deployments become permanent.
Estimated reading time: 7 minutes
In short. Immigration Enforcement's transparency data for live facial recognition (LFR), updated 15 October 2026, finally publishes the results of its February 2026 trial at the Port of Holyhead: 231 days after the deployment ended, about five and a half times the six-week turnaround the department itself set with the previous trial [2] [3]. Two of the ten rows logged for that trial, both from 25 February 2026, record an "arrest or disposal" and what the table calls a "positive intervention" against a watchlist that the same row says generated zero total alerts and zero positive alerts [3]. Three weeks later, a new 62-page data protection impact assessment confirms the programme is moving from "proof of concept" into a permanent "formal delivery phase" from 1 November 2026, and its own risk register scores "insufficient transparency to travellers" and "equality impacts not fully mitigated" among its highest-rated residual risks [1]. Three documented mistakes: four stars.
Immigration Enforcement has run LFR at the Port of Holyhead twice: eight deployments across 10 to 29 November 2025, and ten more across 24 to 26 February 2026 [2] [3]. This site found in October that the February results were still unpublished seven months after the trial ended, with the department's own six-week precedent from November as the only benchmark available to measure the gap against. They are published now, folded into a renamed collection, "Live facial recognition deployment records," that replaces the single November-only page this site cited at the time [2] [3]. What the new rows show is not only how late they arrived, but a table that does not add up on its own terms, days before the programme they describe stops being a trial at all.
The claims, tested
| The document's own words | What the department's own figures show | Verdict |
|---|---|---|
| "LFR is used only where necessary and proportionate, with safeguards, oversight, transparency and ongoing review to uphold data protection and human rights standards" (page 5); "LFR is used only where it is assessed as necessary and proportionate for the specific deployment" (page 27) [1] | The transparency safeguard this claim invokes is the same one this site found broken in October: the February 2026 trial's results were not published until 15 October 2026, 231 days after the deployment ended, versus 41 days for the November trial, about five and a half times longer [2] [3] | The ongoing review and transparency the document describes is a cadence the department's own current year has not matched |
| The department's own published transparency data, updated 15 October 2026, two rows for the Holyhead deployment of 25 February 2026 (11:17-11:25 and 14:08-14:15, watchlist 6,535, threshold 0.64): "Total alerts: 0", "Positive alerts: 0" [3] | The same two rows, same document: "Positive interventions: 1", "Arrests or disposals: 1" [3] | The department's own newly-published figures record an arrest and a positive intervention against a watchlist alert count of zero, in the same row, with no note anywhere on the page explaining how |
| The DPIA's risk register lists "insufficient transparency to travellers if signage/leaflets are unclear or missing" as a high-impact, medium-likelihood risk scored 19 out of 25, its second-highest band (page 48), mitigated by "ensure signage/leaflets are visible, bilingual and consistent with NPCC materials; officer engagement on-site," reducing the residual score to 10 (page 53) [1] | Every listed mitigation addresses signage and officer conduct during a deployment. None addresses publishing deployment results afterwards, the specific transparency failure now on the record twice over: results that went unpublished for months, then arrived with an unexplained inconsistency [1] [2] [3] | The risk the document names is real but narrower than the risk its own recent record actually produced |
The mistakes, counted
The transparency commitment this site found broken in October is now resolved, 231 days late (1). Immigration Enforcement's equality impact assessment promises to publish deployment results, and met that promise in six weeks for the November 2025 trial [4]. The February 2026 trial's results did not appear until 15 October 2026, 231 days after the deployment ended on 26 February, about five and a half times the November precedent [2] [3]. The new DPIA, drafted across April to August 2026 and published 22 October, repeats the same necessity-and-proportionality framing without once mentioning that the department's own transparency commitment had, at the time of drafting, already been broken by months [1].
The department's own newly-published numbers do not add up (2). Across all eight November 2025 rows and eight of the ten February 2026 rows, every "positive intervention" and "arrest or disposal" lines up with at least one recorded "total alert" and "positive alert" in the same row, exactly as the mechanism is supposed to work: the system flags a match, an officer reviews it, an intervention follows [2] [3]. Two rows from 25 February 2026 break that pattern: both record zero total alerts and zero positive alerts, yet both also record one positive intervention and one arrest or disposal [3]. The accessible page and the underlying CSV carry no footnote, methodology note or column definition that reconciles an arrest with a watchlist that, by the same document's own count, never alerted.
The new risk assessment flags exactly this failure mode, and mitigates it with signage, not a publication deadline (3). The DPIA's own risk register rates "insufficient transparency to travellers" and "equality impacts not fully mitigated despite EIA completion" at 19 out of 25 each, its second-highest severity band, alongside a third risk rated the same, "future expansion of LFR deployments creating greater monitoring exposure" (page 48, page 50) [1]. All three are mitigated down to a residual score of 10, but the listed measures are on-site signage, officer training and "central IE governance for any future deployments; strict scope control" (pages 51, 53, 54) [1]. None commits to a publication timetable for deployment results, the one transparency measure this site has now watched fail twice in the same programme. The DPIA sets processing to commence under the new, permanent delivery phase from 1 November 2026, six days after it was published [1].
Credit where due
No incorrect alert and no incorrect intervention has been recorded in either deployment published to date: zero across 7,512 faces seen in November 2025, zero across 2,752 faces seen in February 2026, 10,264 faces in total [2] [3]. The DPIA is also candid where it could have stayed quiet: its opening page states plainly that the programme has moved from proof of concept into formal delivery, and its risk register names the expansion of monitoring as a risk in its own right rather than presenting growth as costless (page 4, page 48) [1]. The legal basis Immigration Enforcement relies on, implied powers under the Immigration Act 1971, and its exclusion of anyone under 18 from the watchlist are both restated in the same terms this site checked against the policy document in October, unchanged [1] [5].
Verdict
Four stars, from three documented mistakes. The missing data this site flagged in October has been published, which is itself the right outcome. What arrived with it is a seven-and-a-half-month delay against the department's own six-week precedent, two rows of transparency data that do not reconcile an arrest with a watchlist that triggered no alert, and a fresh risk assessment that rates transparency failure as a live risk without once pointing at the transparency failure already on the record, days before the scheme it governs stops being a trial.
The star score counts three documented mistakes. First, the department's own transparency commitment, to publish deployment results, took 231 days for the February 2026 Holyhead trial, about five and a half times the 41-day precedent it set with the November 2025 trial. Second, the department's own published transparency data for two deployments on 25 February 2026 records an arrest or disposal and a positive intervention against a watchlist that the same rows say generated zero total alerts and zero positive alerts, with no note anywhere reconciling the figures. Third, the new data protection impact assessment's own risk register rates insufficient transparency and incomplete equality mitigation among its highest-scored residual risks, but mitigates them only with on-site signage and internal governance commitments, not a deployment-data publication deadline, as the programme moves to permanent, continuous operation from 1 November 2026. Three falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding about the conduct of any named individual; the drafting, review and publication of these documents are institutional processes, not any one official's decision. Checked directly against the DPIA and the department's own transparency data and CSV, both fetched 25 October 2026.
Sources
- Live facial recognition technology: data protection impact assessment (DPIA), Home Office, published 22 October 2026
- Live facial recognition deployment results (accessible), Home Office, published 9 January 2026, updated 15 October 2026
- Live facial recognition deployment results, CSV, Home Office, updated 15 October 2026
- Live facial recognition: equality impact assessment (EIA), Home Office, updated 5 October 2026
- Immigration Enforcement: live facial recognition legal mandate (accessible version), Home Office and Immigration Enforcement, updated 24 February 2026