Immigration Enforcement's legal mandate for facial recognition rests partly on a landmark court ruling. The same ruling found a police force's near-identical use of the technology unlawful, twice over.
Estimated reading time: 7 minutes
In short. Immigration Enforcement's legal mandate for live facial recognition, updated 29 October 2026, cites R (Bridges) v Chief Constable of South Wales Police as backing for the lawfulness of the technology: "the common law position recognised in Bridges further supports the lawfulness of using Live Facial Recognition" [1]. The Court of Appeal's actual ruling in Bridges found South Wales Police's near-identical use of the technology was not "in accordance with the law" under Article 8, because "too much discretion is currently left to individual police officers" over who could be watchlisted and where it could be deployed [2], and separately found the force had breached the Public Sector Equality Duty by never testing its software for racial or sex bias [2]. Two documented mistakes: four stars.
Immigration Enforcement has been using overt live facial recognition against people suspected of breaching deportation orders since November 2025, and this site has tested three of the documents governing it already: a policy with no age rule for children [5], an equality impact assessment whose transparency promises slipped by months [6], and deployment data that recorded arrests against a watchlist that produced no alerts [7]. The fourth document in the set is the one meant to settle whether any of this is lawful in the first place: the Legal Mandate, now in version 2.2, updated again on 29 October 2026 [1]. It runs to 25 numbered sections of statute, case law and data protection analysis. Two of them lean on a single court case that, read in full, says something close to the opposite of what the mandate uses it for.
The case the mandate cites
Section 8 of the mandate, "Common law basis recognised in Bridges," sets out Immigration Enforcement's position in two sentences. The first: "In R (Bridges) v Chief Constable of South Wales Police [2019] EWHC 2341 (Admin), the High Court accepted that common law powers were sufficient for police use of Live Facial Recognition. That finding was not disturbed by the Court of Appeal." The second: "The common law position recognised in Bridges further supports the lawfulness of using Live Facial Recognition as a tested identification tool where it is properly authorised, necessary, proportionate and subject to safeguards" [1].
The narrow point is true. Whether a common law power to use facial recognition existed at all was never one of the five grounds Edward Bridges argued on appeal, so the Court of Appeal had no reason to disturb it. But Bridges was not, on the whole, a case that found facial recognition lawful. It was the case in which the Court of Appeal unanimously ruled South Wales Police's deployment of the same kind of technology, AFR Locate, unlawful, allowing three of Bridges' five grounds of appeal [2] [3]. The mandate's section 8 mentions none of that. It cites the one uncontested fragment of a five-ground judgment and presents it as the case's verdict on lawfulness in general.
The claims, tested
| The mandate's own words | What Bridges actually decided | Verdict |
|---|---|---|
| Section 8: "The common law position recognised in Bridges further supports the lawfulness of using Live Facial Recognition" [1] | The Court of Appeal held SWP's AFR use was not "in accordance with the law" under Article 8(2): "The fundamental deficiencies... relate to two areas of concern. The first is what was called the 'who question'... The second is the 'where question'. In relation to both of those questions too much discretion is currently left to individual police officers" (para. 91); "the current policies do not sufficiently set out the terms on which discretionary powers can be exercised by the police" (para. 94) [2] | The case cited for support is the case that struck down the near-identical legal basis for not controlling discretion tightly enough |
| Section 20 (Equality Act 2010 and Public Sector Equality Duty): "All alerts must be subject to human review. The system does not decide whether a person is engaged. Trained officers must assess any alert before further action is taken" [1] | SWP ran the identical "human failsafe" argument in Bridges. The Court of Appeal rejected it outright: "We do not consider the 'human failsafe' is sufficient to discharge the PSED" (para. 185), and found SWP "have not done all that they reasonably could to fulfil the PSED" because it never tested its software for bias (para. 201) [2] | Section 20 does not mention Bridges at all, despite the mandate citing the same case three sections earlier, for a different and narrower point |
What section 8 leaves out
The "who question" and "where question" that sank South Wales Police's legal basis are not abstract. Watchlist discretion is precisely what the mandate's own section 10 tries to constrain, with rules that a watchlist entry must be "purpose-specific; deployment-specific; time-limited; no broader than necessary" [1]. That looks, on its face, like a design built to answer the exact defect the Court of Appeal found in SWP's practice. But section 8 never says so. A reader working through the document in order meets Bridges first as an unqualified endorsement, three sections before meeting the safeguards that would only make sense as a response to a case the mandate has not admitted went against the police.
Section 20 is a sharper gap. South Wales Police's defence of its equality duty rested heavily on the fact that a human officer reviewed every computer-generated alert before acting on it. The Court of Appeal examined that argument specifically and dismissed it: human review goes to what happens after a match, not to whether the underlying software was ever checked for bias, which is what the Public Sector Equality Duty requires before deployment, not after an alert [2]. Immigration Enforcement's section 20 offers the same kind of safeguard, in near-identical language, as if the point had never been tested in court and found wanting.
Credit where due
Unlike South Wales Police in 2018, Immigration Enforcement did commission the testing Bridges found missing. Its published equality impact assessment cites a National Physical Laboratory study that set out specifically to measure demographic variation in false-match rates, and reports no statistically significant difference by gender or ethnicity at the 0.64 confidence threshold the system uses operationally [4]. That is the specific gap the Court of Appeal in Bridges found fatal to the Public Sector Equality Duty argument, and on the published evidence, Immigration Enforcement has closed it. The problem is that section 20 of the Legal Mandate does not say so, or say what the gap was, or cite the case that found it. A reader is left to take the safeguard's adequacy on trust, in a document whose purpose is to demonstrate that trust is not required.
Verdict
Four stars, from two documented mistakes. Nothing here says Immigration Enforcement's facial recognition deployments are, in substance, as legally exposed as South Wales Police's were in 2018: its watchlist rules address the "who" and "where" questions Bridges raised, and its equality impact assessment does the bias testing SWP skipped. The finding is narrower and about the document itself: a legal mandate whose entire purpose is to state the law accurately cites a landmark case twice, for two different safeguards, and both times leaves out that the same case is the one where a police force's comparable safeguards were tested in court and found wanting.
The star score counts two documented mistakes. First, section 8 cites R (Bridges) v Chief Constable of South Wales Police as supporting the lawfulness of live facial recognition, quoting only the High Court's undisputed finding that common law powers existed, while omitting that the Court of Appeal ruled South Wales Police's deployment unlawful under Article 8 for giving officers "too much discretion" over watchlists and deployment locations. Second, section 20 defends the programme's Public Sector Equality Duty compliance using a human-review safeguard the Court of Appeal examined in the same case and explicitly rejected as insufficient, without mentioning Bridges, the safeguard's rejection, or the case's Public Sector Equality Duty finding at all. Two falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding that Immigration Enforcement's own facial recognition practice breaches the Public Sector Equality Duty or Article 8; its published equality impact assessment appears to address the specific defect Bridges identified. The finding is narrower: the legal mandate's own account of the case it relies on is incomplete in a way that would mislead a reader checking only this document. Checked directly against the Legal Mandate's full accessible text, the Court of Appeal's judgment in [2020] EWCA Civ 1058, the judiciary.uk press summary and Immigration Enforcement's published equality impact assessment, all fetched 30 October 2026.
Sources
- Immigration Enforcement: live facial recognition legal mandate (accessible version), Home Office and Immigration Enforcement, version 2.2, updated 29 October 2026
- R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058, Court of Appeal (Civil Division), judgment of 11 August 2020
- R (Bridges) v Chief Constable of South Wales Police, press summary, Judicial Office, 11 August 2020
- EIA Facial Recognition v1.03, Immigration Enforcement equality impact assessment, Home Office
- Immigration Enforcement's facial recognition policy runs 52 pages on who goes on a watchlist, Tracked Changes, 9 October 2026
- Immigration Enforcement scanned 7,500 faces at a Welsh ferry port and promised to publish the results of every deployment, Tracked Changes, 6 October 2026
- Immigration Enforcement published its overdue Holyhead facial recognition data this month, Tracked Changes, 25 October 2026