From the Public Safety edition of November 1, 2026
Merseyside Police impact assessment finds at least 300,000 people with custody images overdue for deletion, and the force did not adopt officer-initiated facial recognition
Merseyside Police (England) · Policing / facial recognition and biometric data retention · Merseyside, England, United Kingdom
- Publisher
- Liverpool Echo
- Original publication
- Liverpool Echo, Oct. 31, 2026
- Source retrieved
- 2026-11-02
What happened
The Liverpool Echo reported on Oct. 31, 2026 that an internal Merseyside Police data protection impact assessment (DPIA) on officer-initiated facial recognition (OIFR), a phone tool that checks a photo taken during a stop against police databases, found "potentially 300,000 nominals who could have multiple images overdue for deletion" in the Niche records system. The assessment warned the force could compare against an unlawful image. The Echo understands OIFR was never adopted because of this. The force says OIFR is not in operational use and that custody image retention is a long-standing national issue. Big Brother Watch supplied the document. A 2012 High Court ruling found long retention of images of people not convicted unlawful; Police Scotland reportedly reviews and deletes such images.
Why it matters
A rare documented case of a privacy impact assessment stopping a police AI tool because the data it would search was not lawfully held.
Evidence and measured results
Opened and read the full Liverpool Echo article, which quotes the DPIA directly. The DPIA itself was not published or opened; the 300,000 figure is the force’s own estimate as quoted.
Limitations and uncertainty
Single news report based on a leaked internal document supplied by an advocacy group; the DPIA date is not given; England and Wales law differs from U.S. state law, so the lesson transfers by analogy.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-02; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Biometric tools would search image galleries that may contain records the agency should no longer hold.
- Stakeholders
- Chief officer or police chief
- Data protection or privacy officer
- Records management lead
- Legal counsel
- Discovery questions
- How many custody images are past their lawful retention date today?
- Can the records system link each image to a case outcome?
- Has any biometric tool been run against this gallery already?
- Value hypothesis
- A gallery lawfulness audit lets the agency decide on biometric tools with known legal exposure.
- Potential engagement
- Retention and gallery-lawfulness assessment ahead of any facial recognition procurement.
- Unsupported claims
- That OIFR would have been accurate or useful
- That other forces hold similar backlogs at the same scale
- That the DPIA has been formally published
Pre-sales engineering
Role takeaway
- Fit
- Relevant to any agency considering face matching against booking or custody photos.
- Architecture and integration
- Custody image store in the records management system feeding a matching service; retention metadata and query filters are the control points.
- Prerequisites
- Image-to-outcome linkage
- Retention rules per jurisdiction
- Deletion audit log
- Constraints
- Legacy records systems
- National databases outside local control
- Incomplete case outcome data
- Security
- Block matches against images past retention and log every query with officer and reason.
- Proof of value
- Sample audit of overdue images
- Working retention filter on a test gallery
- Deletion log reconciled to the sample
Delivery
Role takeaway
- Work
- Measure the backlog, set a deletion schedule, build a retention filter and repeat the impact assessment.
- Dependencies
- Case outcome data from courts
- Records system vendor support
- Legal sign-off on retention rules
- Ownership
- Records manager and data protection officer, with chief officer sign-off.
- Skills and adoption
- Records staff need procedures for outcome-based deletion; officers need clear rules on what tools are off until the gate is passed.
- Governance checkpoints
- Backlog measured
- Impact assessment repeated
- Chief officer approval before pilot
- Acceptance criteria
- Overdue-image count reported and falling on schedule
- Retention filter verified on a test set
- No biometric tool live until the assessment is passed
- Risks
- Backlog too large to clear
- Pressure to launch before clean-up
- National data outside force control
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
A face-matching tool is only as lawful as the gallery behind it; the gallery (Niche custody images) needs retention flags and deletion before any matching service is connected.
Governance
Who approves, reviews and stays accountable for outcomes?
The DPIA functioned as a gate: it identified unlawful source data and the tool was not adopted. The underlying retention backlog remains unresolved.
Security and privacy
What data, permissions and controls need testing?
Matching against images that should have been deleted creates legal exposure and privacy harm for people never convicted.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Clearing a 300,000-person backlog would take records staff time; the Home Office has called mass review resource-intensive.
Procurement
What should contracts, pricing and exit terms secure?
Biometric tool purchases should be conditioned on a lawful, cleaned gallery, not just on the vendor’s matching accuracy.
Operating model
Which teams own the service once it runs?
Retention review is a standing records-management duty that must run before and alongside any biometric search service.
Publication history
- 2026-11-01Public Safety · Issue 565 resources
Stable resource ID: merseyside-police-dpia-300000-custody-images-overdue-deletion-oifr-not-adopted-20261031