{"resourceId":"home-office-immigration-enforcement-lfr-deployment-dpia-standalone-24h-deletion-20261022","versions":[{"version":"external-38ae6ef545ea9c39acda6965bd19bbf3bfcd3f4c67aa824efb1481f75d0b44cf","resource":{"id":"home-office-immigration-enforcement-lfr-deployment-dpia-standalone-24h-deletion-20261022","title":"Home Office publishes Immigration Enforcement live facial recognition DPIA as the programme moves from proof of concept to delivery, with 24-hour deletion and a standalone system","organization":"Home Office (Immigration Enforcement)","sector":"Law enforcement / live facial recognition governance","geography":"United Kingdom","publishedAt":"Published on GOV.UK Oct. 22, 2026","publicationDate":"2026-10-22","eventDate":null,"sourceName":"GOV.UK (Home Office and Immigration Enforcement)","sourceLabel":"Live facial recognition hardware, software and deployment processing: data protection impact assessment (PDF)","sourceUrl":"https://assets.publishing.service.gov.uk/media/6ad72c56a89985bb97026946/IE_Live_Facial_Recognition_Technology_Procurement_-_DPIA_-_URN184.26.pdf","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["data-security","governance-procurement","infrastructure"],"finding":"The 62-page DPIA, published Oct. 22, 2026, redrafts the proof-of-concept assessment because Immigration Enforcement’s LFR programme has moved into a formal delivery phase; it says processing had not commenced under the programme phase. It splits governance into a watchlist-generator DPIA and this deployment DPIA. Watchlists are deployment-specific and time-limited; deployments may be authorised for up to 28 continuous days; non-match images are deleted immediately; watchlist and alert data in the system are deleted within 24 hours after each deployment day. The system runs standalone, not connected to wider Home Office infrastructure during operation; the supplier is not expected to have routine access to live data. Operators review every alert, and alert thresholds are informed by supplier guidance and National Physical Laboratory testing. Under-18s are excluded from watchlists.","sledRelevance":"A detailed public template for deployment-level biometric data controls (retention, supplier access, standalone operation, joint deployments with police) that U.S. agencies can compare against their facial recognition and ALPR policies.","evidence":"Opened the GOV.UK publication page and the DPIA PDF; read the summary, retention, supplier access, system description and proportionality sections.","architectureImplications":"Standalone deployment system not connected to wider infrastructure during live operation; offline watchlist import via encrypted media deleted within 24 hours.","governanceImplications":"Per-deployment regime determination, Authorising Officer approval, deployment-specific data sharing arrangements for joint police deployments, and post-deployment review.","securityPrivacyImplications":"Immediate deletion of non-match images; 24-hour deletion of alert and watchlist data from the system; minimal retained data for performance analysis, anonymised where possible.","caveats":"A self-assessment by the deploying agency, not an independent evaluation; no accuracy or outcome data. Immigration enforcement rather than general policing; UK GDPR and DPA 2018 basis limits transfer.","streamIds":["public-safety"],"roles":{"sales":"Sales framing: this DPIA is a ready reference for what deployment-level biometric controls look like in writing. Agencies under pressure to justify facial recognition or ALPR can compare their policies to its retention, supplier-access and review rules. A bounded engagement could be a privacy impact assessment for one biometric or camera analytics system. The evidence cannot support claims about accuracy or effectiveness; it is an agency self-assessment without outcome data.","engineering":"Engineering framing: notable design choices are a standalone system not connected to wider infrastructure during operation, offline watchlist import with 24-hour media deletion, immediate deletion of non-match images, and supplier access only by authorised exception. Pre-sales should test whether a vendor platform can operate disconnected, enforce those deletion windows and log supplier access. Proof of value should verify deletion technically, not just by policy.","delivery":"Delivery framing: delivery would mirror the DPIA structure: separate assessments for watchlist creation and deployment, per-deployment authorisation, data sharing agreements for joint operations and post-deployment reviews. Dependencies include trained operators and contract terms with the supplier. The operational owner is the deploying agency. Acceptance should be measured by verified deletion, complete authorisation records and reviewed alerts. Applicability to U.S. policing is by analogy only."},"roleDetails":{"sales":{"customerProblem":"Agencies deploying facial recognition need documented, defensible data controls but often lack a deployment-level assessment template.","stakeholders":["Agency privacy officers","Operational commanders","Legal counsel","Procurement and vendor management","Oversight bodies"],"discoveryQuestions":["Does your facial recognition or ALPR system delete non-match data immediately?","Can your vendor access live data, and is that access logged?","Do joint deployments with other agencies have specific data sharing terms?"],"valueHypothesis":"A deployment-level impact assessment modelled on published practice could shorten approval and give the public specific answers on retention and access.","potentialEngagement":"Four-to-six week privacy impact assessment for one biometric or analytics deployment, including vendor contract review.","unsupportedClaims":["Accuracy or bias performance","Operational effectiveness","That UK data protection rules apply in U.S. jurisdictions"]},"engineering":{"fit":"Agencies running or procuring facial recognition or other biometric analytics.","architectureIntegration":"Standalone matching system with offline watchlist import; alerts passed to officers for checks; retained data moved under a data management plan.","prerequisites":["Vendor support for disconnected operation","Deletion controls","Supplier access logging"],"constraints":["UK GDPR and DPA 2018 basis","Immigration enforcement context","No published performance data"],"security":"Isolate the matching system from wider networks during operation; enforce 24-hour deletion; contract restrictions on supplier access and sub-processing.","proofOfValue":["Proposed: test that non-match images are not written to storage","Proposed: verify watchlist and alert deletion within 24 hours from system logs"]},"delivery":{"work":"Produce linked assessments for watchlist creation and deployment, set authorisation steps and negotiate supplier access terms.","dependencies":["Supplier contract amendments","Trained operators and authorising officers","Legal review"],"ownership":"Deploying agency’s operational lead, with its data protection officer","skillsAdoption":"Train operators to review every alert and authorising officers to apply necessity and proportionality tests.","governanceCheckpoints":["Pre-deployment authorisation","Data sharing agreement for joint deployments","Post-deployment review"],"acceptanceCriteria":["Proposed: deletion verified in logs after each deployment day","Proposed: 100% of deployments with completed authorisation records"],"risks":["Policy-only deletion not enforced technically","Supplier access creep","Scope expansion beyond watchlist criteria"]}},"retrievedAt":"2026-10-25T02:56:48Z","enrichedAt":"2026-10-25T03:02:27Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires trained operators and Authorising Officers for every deployment.","procurementImplications":"Supplier access to personal data only when authorised, recorded and governed by contract terms covering sub-processing, audit and destruction.","operatingModelImplications":"Every alert reviewed by an operator, then IE officers check identity and status before any action.","sourceVerification":{"openedUrl":"https://assets.publishing.service.gov.uk/media/6ad72c56a89985bb97026946/IE_Live_Facial_Recognition_Technology_Procurement_-_DPIA_-_URN184.26.pdf","referenceExcerpt":"The LFR system operates as a standalone deployment system and is not connected to wider Home Office infrastructure during live operation.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}