BURNING BRIDGES : THE AUTOMATED FACIAL RECOGNITION TECHNOLOGY AND PUBLIC SPACE SURVEILLANCE IN THE MODERN STATE

Live automated facial recognition technology, rolled out in public spaces and cities across the world, is transforming the nature of modern policing. R (on the application of Bridges) v Chief Constable of South Wales Police, decided in August 2020 , is the first successful legal challenge to automated facial recognition technology in the world. In Bridges , the United Kingdom’s Court of Appeal held that the South Wales Police force’s use of automated facial recognition technology was unlawful. This landmark ruling could influence future policy on facial recognition in many countries. The Bridges decision imposes some limits on the police’s previously unconstrained discretion to decide whom to target and where to deploy the technology. Yet, while the decision requires that the police adopt a clearer legal framework to limit this discretion, it does not, in principle, prevent

Live automated facial recognition technology, rolled out in public spaces and cities across the world, is transforming the nature of modern policing.R (on the application of Bridges) v Chief Constable of South Wales Police, decided in August 2020, is the first successful legal challenge to automated facial recognition technology in the world.In Bridges, the United Kingdom's Court of Appeal held that the South Wales Police force's use of automated facial recognition technology was unlawful.This landmark ruling could influence future policy on facial recognition in many countries.The Bridges decision imposes some limits on the police's previously unconstrained discretion to decide whom to target and where to deploy the technology.Yet, while the decision requires that the police adopt a clearer legal framework to limit this discretion, it does not, in principle, prevent the use of facial recognition technology for mass-surveillance in public places, nor for monitoring political protests.On the contrary, the Court held that the use of automated facial recognition in public spaceseven to identify and track the movement of very large numbers of peoplewas an acceptable means for achieving law enforcement goals.Thus, the Court dismissed the wider impact and significant risks posed by using facial recognition technology in public spaces.It underplayed the heavy burden this technology can place on democratic participation and freedoms of expression and association, which require collective action in public spaces.The Court neither demanded transparency about the technologies used by the police force, which is often shielded behind the "trade secrets" of the corporations who produce them, nor did it act to prevent inconsistency between local police forces' rules and regulations on automated facial recognition technology.Thus, while the Bridges decision is reassuring and demands change in the discretionary approaches of U.K. police in the short term, its long-term impact in burning the "bridges" between the expanding public space surveillance infrastructure and the modern state is unlikely.In fact, the decision legitimizes such an expansion."[T]he Court has agreed that facial recognition clearly threatens our rights.This technology is an intrusive and discriminatory mass surveillance tool . . .We should all be able to use our public spaces without being subjected to oppressive surveillance" -Edward Bridges, 2020 "We will continue our deployment and development of the technology when we have satisfied ourselves that we can meet the specific points identified in the conclusions of the Court of Appeal, and that work is underway as we now consider the comprehensive judgment."-South Wales Police, 2020.

I. INTRODUCTION
Live automated facial recognition technology, rolled out in public spaces and cities across the world, is transforming the nature of modern policing in liberal democracies and authoritarian regimes alike.The technology augments traditional surveillance methods by detecting and comparing biometric features (such as a person's eyes, nose, mouth, skin textures, and shadows) to images in databases to identify individuals. 1Live automated facial recognition can instantaneously assess the facial biometric data in the captured images against a pre-existing "watchlist," flagging any matches and notifying police officers.
In the United Kingdom and other countries, law enforcement agencies have used facial recognition technologies for many years without a legal framework governing their discretion.Train stations, airports, and city squares are increasingly equipped with facial recognition technologies in the United States, China, France and Hong Kong, among other nations.For example, in the U.K., at least four police departments (Leicestershire Police, South Wales Police, Metropolitan Police Service, and Humberside Police 2 ) have experimented with the technology by linking it to CCTV cameras. 3Across the UK, there are an estimated 5.9 million CCTV cameras, 4 and the country ranks third in the number of cameras per 100 people, after the US and China. 5Meanwhile, London ranks eighth in a list of the most surveilled cities in the world (the first through seventh cities are all in China). 6ondon became one of the first cities to link CCTV cameras to facial recognition technologies in the late 1990s, 7 and their use intensified to address the newly perceived threat of terrorism following the September 11 th attacks in the United States. 8Today, facial recognition technologies can identify a single suspect in a city with a population of over three million people within just seven minutes. 9 Yet, despite the increasing use of facial recognition technology in modern policing, there is no comprehensive regulatory framework overseeing its use in the U.K. 10 In R (on the application of Bridges) v Chief Constable of South Wales Police ([2020] EWCA Civ 1058), the Court of Appeal held that the use of automated facial recognition technology by the South Wales Police ('SWP') was unlawful because it was not "in accordance with law" as required by Article 8 of the European Convention on Human Rights ('ECHR'). 11In addition, the South Wales Police failed to carry out a proper data protection impact assessment and thus did not comply with the United Kingdom's public sector equality duty, which required the SWP to have "due regard" to potential equality implications of facial recognition technology when exercising its public function.Bridges is the first major successful legal challenge to police use of automated facial recognition technology anywhere in the world.Recent lawsuits brought by non-governmental organizations ('NGOs') in the United States 13 and France 14 are still pending, and they might result in different judicial responses to the police use of facial recognition technology.Some American cities, like San Francisco and Berkeley, have banned the use of facial recognition technology by local agencies, including transportation authorities and law enforcement. 15Some municipalities in Massachusetts have banned government use of facial recognition data in their communities, 16 and a few other states (California, New Hampshire, and Oregon) have also instituted bans on facial-recognition technology used in conjunction with police body cameras. 17The Automated Facial Recognition Technology (Moratorium and Review) Bill, 18 which would ban the use of technologies in the United Kingdom, is pending in Parliament and its future remains uncertain.
In this largely unregulated context the Bridges decision is important because it imposed limits on the relatively unrestrained expansion of police use of facial recognition technologies in the U.K. 19 Before Bridges, automated facial recognition in the U.K. had been used without any constraints on the police's discretion to decide whom to target and where to deploy such technology.In the absence of judicial precedent on this point in many countries, 20 and the implicit approval by courts of last resort in others, 21 this judgment represents an important turning point in legal discourse on the use of sophisticated technologies for biometric analysis in modern policing.
Yet, despite the plaintiff's celebrations of the decision's far-reaching impact, 22 the ruling leaves much to be desired.Most significantly, the Court ruled that deploying automated facial recognition in public spaces to identify very large numbers of people and track their movements is, in principle, acceptable in light of law enforcement goals.While the judgment insisted on a clearer articulation of limits on police discretion while using such technology, the decision did not generally prohibit the use of automated facial recognition technology for masssurveillance in public places.In particular, the Court dismissed the broader risks posed by automated facial recognition technology use in public spaces as 'hypothetical'. 23It thus underplayed the heavy burden that surveillance of public places has on the population as a whole, and especially on democratic participation and the right to protest, which require collective action in public spaces.In addition, the Court did not demand transparency about the technologies used by the police, which are often shielded behind the 'trade secrets' of the corporations who produce them. 24Thus, while the Bridges decision reduces police discretion in the UK in the short term, its long-term impact in burning the "bridges" between the expanding public space surveillance infrastructure and the modern state is much weaker.In fact, the judgment opens the door for such an expansion.
The remainder of this Article is structured as follows.Part II provides the factual and legal background of the case.Part III explains the Court of Appeal's reasoning in the Bridges decision.Part IV emphasizes the formalistic nature of the Court's pronouncement and considers the impact that mass surveillance, facilitated by the use of facial recognition technology, has on political participation worldwide.Part V argues that the Bridges decision will have little impact on the use of automated facial recognition technologies in practice for two reasons.First, the Court offered only a limited discussion of this technology's potential for discrimination.Second, proprietary barriers make it harder to understand how this 20 For an analysis of whether the US Constitution would find impermissible the police use of  See, e.g., Justice K.S. Puttaswamy (Retd.)v. Union of India and Others.(2017) 10 SCC 1 (India).The Supreme Court of India held that the Indian government could make compulsory the use of the "Aadhaar" authentication system, which incorporates facial recognition technology, in accessing government schemes and benefits.While the case is not about the use of facial recognition technology by police, the case concerned the use of this technology by government bodies more generally. 22

A. Factual and Legal Background
The Bridges case concerned a live automated facial recognition technology, called 'AFR Locate,' which instantly assesses the facial biometric data gathered from a live video feed against a pre-existing database (or 'watchlist') of photographs. 25If no match registers, the video is deleted immediately. 26If a match is registered, then a police officer reviews the match before determining whether to stage an intervention. 27Facial recognition technology relies on machine learning software, which 'learns' to recognize facial features and matches biometrics to large databases containing facial photographs of people who have been arrested. 28ata published by the U.K. Home Office shows that arrest rates in the U.K. are 3.2 times higher for people of African origin than Caucasians. 29Facial recognition databases therefore often over-represent ethnic minorities. 30tween 2016 and 2018, the South Wales Police was awarded £2.6 million for an automated facial recognition technology pilot program. 31The South Wales Police overtly deployed the AFR Locate in a pilot scheme on about 50 occasions between May 2017 and April 2019 at a variety of public events, such as protests, royal visits, music concerts, and sporting events. 32The South Wales Police used AFR Locate to identify individuals who were "wanted on suspicion for an offence, wanted on warrant, vulnerable persons and other persons where intelligence [was] required." 33It is estimated that around 500,000 faces may have been scanned. 34lthough AFR Locate is designed to identify a pre-specified list of people, the technology must collect biometric data from every person who appears on the live 25  feed in order to scan it.Therefore, the vast majority of faces scanned were not of persons flagged on a watchlist, and their images were automatically deleted.
In October 2018, civil society activist Edward Bridges, with the support of the UK non-governmental organization Liberty, filed a claim for judicial review.Bridges argued that the use of automated facial recognition by the South Wales Police violated his right to privacy and private life under Article 8 of the European Convention on Human Rights35 and breached both the U.K.'s data protection law 36 and public sector equality duty. 37Bridges claimed to have been in the proximity of the automated facial recognition technology on two occasions: near the automated facial recognition-equipped van in the city center of Cardiff on December 21, 2017 38 and at the entrance of a protest he attended against the U.K. defense exhibition of arms at Motorpoint Arena on March 27, 2018. 39The initial legal challenge also included an explicit claim that the AFR Locate deployment infringed Bridges' rights to freedom of expression, assembly and association under Articles 10 and 11 of the ECHR, but this claim was not pursued before the High Court. 40 September 2019, the High Court (which in this case was a court of first instance) dismissed Bridges' claim, determining that the use of automated facial recognition was both in "accordance with the law" and "necessary and proportionate" to achieve South Wales Police's statutory obligations. 41Under the ECHR, the standard of "necessity and proportionality" is satisfied only when a restrictive measure is more than merely useful, reasonable or desirable. 42The standard also requires a demonstration that such measures are the least intrusive instrument among those which might achieve their protective function and are proportionate to the interest to be protected. 43In the High Court's view, the facial recognition technology satisfied both of these criteria. 44The High Court also dismissed Bridges' claims under the U.K.'s 2018 Data Protection Act for the same reason.Further, it rejected Bridges' assertion that the South Wales Police had not complied with its obligations to foster non-discrimination and equality of opportunity, as prescribed by the 2010 Equality Act. 45The Court thus concluded that "the current legal regime is adequate to ensure the appropriate and nonarbitrary use of AFR Locate, and that SWP's use to date of AFR Locate has been consistent with the requirements of the Human Rights Act, and the data protection legislation." 46 June 2020, Bridges appealed the decision of the High Court to the Court of Appeal on five grounds.Bridges claimed that: 1) the High Court erred in concluding that the appellant's right to privacy under Article 8(1) of the ECHR interfered with by the use of automated facial recognition was 'in accordance with the law' for the purposes of Article 8(2); 2) the High Court erred in assessing whether the use of AFR Locate was a proportionate interference with Article 8 rights by reference to only the two occasions on which the appellant was profiled, as opposed to considering the cumulative interference occasioned on all people who were profiled on those occasions; 3) the High Court wrongly held that the South Wales Police's Data Protection Impact Assessment complied with statutory requirements; 4) the High Court erred in declining to opine on whether the South Wales Police had an appropriate policy document to comply with its data protection duties; and 5) the High Court wrongly held that the South Wales Police complied with its public sector equality duty, particularly in light of the possible indirect discrimination arising from using AFR Locate. 47

B. The Decision of the Court of the Appeal
In August 2020, the Court of Appeal overturned the High Court's determination, finding in favor of Bridges on three of the five original grounds.The High Court held that: 1) the South Wales Police's use of automated facial recognition was not in accordance with law for the purpose of Article 8(2) of the ECHR (ground 1); 2) the Data Protection Impact Assessment did not comply with the Data Protection Act 2018 (ground 3); and 3) the South Wales Police failed to satisfy its public service duty under section 149 of the Equality Act 2010 in not recognizing the risk of a disproportionate impact upon women and minorities of the AFR technology (ground 5). 48rst, the Court found "fundamental deficiencies" in the legal framework governing the use of automated facial recognition, declaring that its use was not "in accordance with law" under the well-established ECHR three-step test governing rights to respect for privacy and family life.That test requires that any interference with a right must 1) be 'in accordance with the law', 2) pursue a legitimate aim, and 3) be necessary and proportional. 49The first element requires that any interference must be in accordance with the law and limited to what is explicitly articulated in the law. 50In other words, the policy and practice of police use of facial recognition technology must be articulated in the law.This criterion of the three-part test is only satisfied if the law is clear, accessible, predictable, and uniformly applied. 51 this regard, the Court distinguished novel automated facial recognition technology, which involves the automated processing of sensitive personal data, from other intrusive measures operating under established legislative frameworks, such as retention of fingerprints and DNA records, 52 or police use of secret 'extremism databases'. 53The Court found that the existing framework gave too much discretion to individual police officers to determine which individuals were placed on watchlists and where AFR Locate could be deployed. 54The Surveillance Camera Code of Practice 55 and South Wales Police local policies did not contain limitations on who can be put on a watchlist, or where the AFR can be deployed. 56he Court commented that "the current policies do not sufficiently set out the terms on which discretionary powers can be exercised by the police and for that reason do not have the necessary quality of law." 57 The Court further described the discretion afforded by the existing policies as "impermissibly wide" 58 because the deployment of the technology was not limited to areas in which it could reasonably be thought that individuals on a watchlist might be present.59 Noting the broad discretion that the police retained, the Court implied the significance of the police's reasonable belief when it stated that "it will often, perhaps always, be the case that the location will be determined by whether the police have reason to believe that people on the watchlist are going to be at that location."60 As such, the appeal succeeded on the first ground that the use of AFR was not in accordance with the law for the purposes of Article 8(2) of the ECHR.61 Because the use of automated facial recognition was ruled unlawful, the Court of Appeal did not need to decide whether its use satisfied the standard of proportionality.But, in an unexpected move, the Court went beyond its strict mandate to address this ground.It held that the High Court had correctly balanced the actual and anticipated benefits of AFR Locate on the one hand with its impact on Bridges on the other hand.Mr. Bridges had specifically argued that proportionality balancing should consider the impact not only on himself, but also on all other individuals whose biometric data was processed by the technology on the relevant occasions.62 The Court of Appeal disagreed, noting that Bridges had only pled the impact on himself, not the wider public, in his original complaint.63 Further, according to the Court, the impact on Mr Bridges was "negligible," and the Court explained that "an impact that has very little weight cannot become weightier simply because other people were also affected."64 The balancing exercise, according to the Court, "is not a mathematical one; it is an exercise which calls for judgement."65 The benefits were potentially great, and the impact on Bridges was minor, so the use of AFR was proportionate under Article 8(2).The Court also found it significant that the police "did all that could reasonably be done to bring to the public's attention that AFR Locate was being deployed at a particular place at a particular time." 66The Court therefore found that the use of facial recognition technology was necessary and proportionate to the South Wales Police's law enforcement goals.
The Court then moved on to address the third ground of appeal, relating to South Wales Police's failure to carry out a sufficient data protection impact assessment under Section 64 of the UK's Data Protection Act of 2018.A data protection impact assessment is a is a process that helps organizations identify and minimize the data protection risks of a particular tool, project or technology.Such an assessment "must describe the nature, scope, context and purposes of the personal data processing; assess necessity, proportionality and compliance measures; identify and assess risks to individuals; and identify any additional measures to mitigate those risks." 67In Bridges, the Court rejected the bulk of the applicant's arguments on the SWP assessment's deficiencynamely, that the assessment failed to acknowledge that personal data which were deleted were still 'processed' within the meaning of the data protection law; that the assessment did not mention the 61 66 Id. at [70]. 67Data Protection Impact Assessments, INFORMATION COMMISSIONER'S OFFICE, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protectionregulation-gdpr/accountability-and-governance/data-protection-impact-assessments(last visited May 12, 2021).rights of individuals under Article 8 of the European Convention on Human Rights; and that it did not acknowledge the risks to freedom of expression and assembly. 68onetheless, the Court agreed with Bridges that the South Wales Police's data protection impact assessment was deficient because it failed to establish the correct legal framework for using automated facial recognition.The Court noted that the assessment "proceed[ed] on the basis that Article 8 . . . is not infringed," and therefore, failed to properly address the requirement that facial recognition be "in accordance with the law." 69The Court concluded that "[t]he inevitable consequence of those deficiencies is that . . . the DPIA failed properly to assess the risks to the rights and freedoms of the data subjects" and consequently breached Section of the Data Protection Act 2018. 70e Court next addressed the fourth ground of appeal, quickly dismissing it.This ground challenged the use of facial recognition under Section 42 of the Data Protection Act 2018, which sets out what an appropriate policy document relating to data protection matters must contain. 71However, this ground failed because that provision had not been enacted at the time of the two occasions on which the appellant was captured by AFR Locate. 72nally, the Court addressed Bridges' complaint that the South Wales Police breached their positive duty to have 'due regard' to the need to eliminate potential bias and indirect discrimination associated with automated facial recognition technology. 73The Court held that the South Wales Police were deficient in fulfilling their public sector equality duty because they failed to recognize the risk that automatic facial recognition profiling could disproportionately impact women and minorities. 74The Court found that the breach of the public sector equality duty was a "serious issue of public concern." 75This duty requires that "a public authority give thought to the potential impact of a new policy which may appear to it to be neutral but which may turn out in fact to have a disproportionate impact on certain sections of the population." 76re, the Court reasoned the South Wales Police had "never sought to satisfy themselves, either directly or by way of independent verification, that the software program in this case does not have an unacceptable bias on grounds of race or sex." 77 The Court pointed to evidence from computer expert Dr. Anil Jain showing that automated facial recognition can sometimes have unacceptable bias because [Vol.22:284   their training data sets contain a disproportionate number of people from certain demographics. 78Consequently, the automated facial recognition technology could result in a higher rate of false positives when scanning women or ethnic minorities.The Court did not determine whether the South Wales Police's technology actually resulted in disparate impact. 79Nevertheless, the Court found that the South Wales Police "never sought to satisfy themselves, either directly or by way of independent verification, that the software program in this case does not have an unacceptable bias on grounds of race or sex."Consequently, the Court upheld the fifth and final ground of appeal, finding that the South Wales Police had failed to fulfill its public sector equality duty. 80

III. ANALYSIS AND IMPLICATIONS
Bridges is the first case to consider police use of automated facial recognition technology in public spaces.As such, it has important implications for the rights to privacy and data protection, and for the rights to political protest and democratic participation more generally.Although Bridges concerned the legality of facial recognition technology under specific legislation in the U.K., it is emblematic of wider concerns worldwide around the ad hoc regulation and discretionary use of automated facial recognition technology by police.This technology is used without an appropriate legal framework to govern its use and without sufficient oversight or public awareness.Meanwhile, governments can use algorithmic and biometric technologies to discriminate against various groups.Thus, while Bridges is a landmark ruling about the limits of police discretion when using automated facial recognition technology, the long-term impact of the Court's pronouncement on future expansion and deployment of automated surveillance technologies in public spaces is much weaker.In particular, the Court found that the deployment of facial recognition technology for mass surveillance in public spaces was acceptable and proportional to law enforcement goals.And the Court did not mandate increased transparency or require that the police publicly release clear information about their operation of facial recognition technology.The Court also did not consider how regulatory guidance may fragment across local authorities, making the law less predictable and certain.Instead, the Court imposed minimal formalistic requirements that the police must meet to comply with the public sector equality duty and the right to privacy.I discuss these limitations in turn.

A. Surveillance and Protests in Public Spaces: The Acceptance of the FRT as 'Proportionate'
"There is nothing in the Court of Appeal judgement that fundamentally undermines the use of facial recognition to protect the public.This judgement will only strengthen the work which is already underway to ensure that the operational policies we have in place can withstand robust legal challenge and public scrutiny."81-South Wales Police, 2020 Civil rights activists and advocacy organizations, who have long been concerned with the use of automated facial recognition technology to covertly gather intelligence on citizens, particularly those who exercise rights to engage in political protest, commended the Bridges decision handed down by the Court of Appeal. 82However, the Bridges decision did not ban or limit the use of facial recognition technology to monitor political protests.On the contrary, the Court legitimized the use of facial recognition technology in public places by declaring it proportionate in principle.As a result, the case will likely only be the first among many in the continuing resistance to law enforcement's use of intrusive surveillance technologies in public spaces.
The Court of Appeal acknowledged that automated facial recognition involves "sensitive processing," and that issues in the case are very factand circumstancespecific. 83 Thus, its judgment was narrowly confined to issues relating to Bridges' experience with the South Wales Police's use of AFR Locate; it did not analyze AFR Locate's broader impacts.The Court also emphasized what it considered to be two important safeguards: that image data which did not result in a match was automatically deleted 84 and that facial matches made by AFR Locate were reviewed by a police officer. 85The judgment therefore does not provide carte blanche for the police to make arrests solely on the basis of automatic facial recognition without human review.But the decision still affirms the role of automated facial recognition in modern policing and law enforcement.
The Bridges ruling does not go far enough to protect public spaces from intrusive surveillance.First, the Court understated the wider impact of facial recognition technology in public spaces on the social fabric of population and on wider democratic participation.The Court held that the South Wales Police's use of facial recognition technology was "not in accordance with the law." 86But had it been so, its use would have been proportional to law enforcement goals.Indeed, the Court chose to explain this point even though it did not have to. 87The Court emphasized that, even if it had to consider the impact of facial recognition technology, "[a]n impact that has very little weight cannot become weightier simply because other people were also affected.It is not a question of simple [Vol.22:284 multiplication." 88In other words, the Court views public space surveillance as small separate harms affecting individuals rather than an aggregate harm affecting the entire population.
The Court focused on the burden on Edward Bridges' individual right to privacy, refusing to consider the wider, chilling effect of surveillance on the political freedoms of the populace as a whole-the sum of which is arguably greater than its parts.Bridges raised this point and argued that the Court ought to have taken into account the potential reach of AFR Locate. 89But the Court flatly rejected this approach, stating that it is neither "necessary [nor] helpful to consider hypothetical scenarios which may arise in the future." 90It is unclear whether the Court chose not to engage with the wider impact argument because Bridges' appeal did not sufficiently plead that the AFR Locate deployment infringed the rights to freedom of expression, assembly, and association under Articles 10 and 11 of the ECHR, or for some other reason.The claim under Articles 10 and 11 of the ECHR was included in the initial legal challenge launched by Bridges before the High Court, but it was not actually argued before that Court and therefore could not be appealed.
Irrespective of its reasons, the Court's opinion understates the wide-ranging implications of surveillance in public spaces.These implications include not only particular individuals' right to privacy, but also the ability of the population as a whole to participate in the political process.NGOs in the UK have been especially concerned about the use of facial recognition technology nationwide to gather intelligence, particularly around protests. 91deed, facial recognition technology has been used to directly target protests around the world in the past few years.For example, concerns have been raised that 'smart lampposts' scattered throughout Hong Kong have built-in facial recognition technology.The Hong Kong government claims that such lampposts only collect data on traffic, weather, and air quality, but protesters have been cutting them down over concerns that they contain facial recognition software used for surveillance by Chinese authorities. 92Similarly, law enforcement likely used facial recognition technology to scan Black Lives Matters protests in Oakland and Baltimore in 2015. 93A journalist, who participated in the protests, believes that his arrest near 88  The police deployment of facial recognition technology in public spaces may have a 'chilling' effect on collective action. 97Protests typically take place in public places.As more public spaces come under surveillance, fewer protesters are truly anonymous.But anonymity is fundamental to protest movements.When people can protest anonymously, they tend to feel confident that they can gather in public spaces, without fear of reprisal, to manifest their disagreement with the status quo.For this reason, many scholars have argued that facial recognition technology can result in a chilling effect on dissident speech. 98Indeed, studies have shown that individuals are less likely to share their opinions, both online 99 and offline, 100 when they feel they are in the minority and feel monitored.And when citizens feel unsafe voicing their opinions, robust democratic participation is not possible.https://www.aclunc.org/blog/facebook-instagram-and-twitter-provided-data-access-surveillanceproduct-marketed-target. 94 Therefore, the Bridges court's judgment reaffirms, if not strengthens, the legality of the facial recognition technology used for mass surveillance in modern policing.Given the already-existing use of this technology to monitor public protests, and the harmful chilling effects that result, the Court's legitimization of automated facial recognition and the failure to consider its wider impact will be harmful in the long-term.

IV. DISCRIMINATION AND COMMERCIAL SECRECY: A LIMITED JUDICIAL DEMAND
FOR TRANSPARENCY "This judgment is a major victory in the fight against discriminatory and oppressive facial recognition.The Court has agreed that this dystopian surveillance tool violates our rights and threatens our liberties." 101-Megan Goulding, Lawyer, Liberty, 2020 The Bridges judgment also highlights the tensions between the discriminatory impact of facial recognition technology on ethnic minorities and women and the public's inability to investigate the technologies' operation because of trade and commercial secrecy barriers.The Court made a number of remarks suggesting that, to comply with its equality duties, the South Wales Police's use of facial recognition technology software should be more transparent-or at least independently reviewable.Even before Bridges, the UK Equality and Human Rights Commission had called for a moratorium on facial recognition technology in England and Wales pending independent scrutiny of the discriminatory impact the technology may have on protected groups. 102In Bridges, the Court of Appeals expressly held that the South Wales Police breached its public sector equality duty because it did not independently seek to verify whether or not the software could give rise to bias. 103This judgment is important because it puts the onus on police to carefully select and scrutinize the technologies they buy from private companies.This scrutiny may require companies to reduce the discriminatory impact of their technology if they seek to sell to government agencies. 104 increasing body of academic research has demonstrated the discriminatory effects of facial recognition technology-and surveillance generally-on minority groups. 105The emerging consensus is that facial recognition technologies are not "neutral" 106 but instead reinforce historical inequalities. 107For example, studies have shown that facial recognition technology performs poorly when applied to women, children, and individuals with darker skin tones. 108Such poor performance is concerning because groups that have been historically discriminated against and marginalized may be discriminated against further.This kind reinforced discrimination is particularly important in the law enforcement context because training data for facial recognition technologies comes from photos relating to previous arrests and convictions. 109Thus, minority groups are overrepresented in facial recognition technology training databases. 110This is especially true in jurisdictions like the United States, where racial minorities face a much higher risk of being pulled over, 111 searched, 112 arrested, 113 incarcerated, 114 and wrongfully convicted. 115Under these circumstances, facial recognition technology is capable of producing a large number of false positives for individuals from overpoliced communities because it operates against a background of structural inequality and discrimination.A false positive is when a system says that two images are of the same person when, in fact, they are not.The rate of such false positives is much [Vol.22:284 higher for African-American population, which is over-represented in criminal databases, leading to wrong members of this demographic to be arrested.
The Bridges Court acknowledged that it would be difficult to detect or measure any discriminatory impact of the AFR Locate system because a 'safeguard' "would instantly delete the majority of profiles registered by the system." 116The Court recognized that details of the training dataset could not be made public due to "commercial confidentiality," yet, the Court held that "it does not enable a public authority to discharge its own, non-delegable, duty." 117To the extent Bridges protects individual rights, it is because it puts the onus on the police and the legislature to provide appropriate safeguards against the discriminatory application of automated facial recognition technology. 118The Court explained that it was necessary for the South Wales Police to take "reasonable steps to make enquiries about what may not yet be known to a public authority about the potential impact of a proposed decision or policy on people with the relevant characteristics." 119wever, it is unclear what steps can be taken to ensure that facial recognition technologies are applied equally with respect to the characteristics protected under the public sector equality duty.In particular, the relationship between private companies developing automated facial recognition software police departments who employ them is based on corporate secrecy laws and procurement practices.Facial recognition software is considered a trade and commercial secret and is not shared with police or any other parties. 120Such secrecy, some scholars note, "fails to foreground the public interest[.]" 121Importantly, commercial secrecy may entirely preclude the use of facial recognition technologies by UK public agencies if it prevents them from complying with their public sector equality duty.
Therefore, when government agencies procure private technologies, such technologies should be open-source and the procurement contracts should be transparent.The procurement practices should be standardized in legislation.For example, the original draft of the 2019 Washington State House Bill 1655 would have addressed some of these concerns. 122This legislation, which has now been substituted, likely because of industry pressure, included sections banning nondisclosure provisions, 123 and required that all automated decision systems and the data used in the system be made "freely available by the vendor before, during, and after deployment for agency or independent third-party testing, auditing, or research to understand its impacts, including potential bias, inaccuracy, or disparate impacts."124While these provisions were removed from the substitute bill, they demonstrate one potential way to regulate procurement contracts in the public interest.
However, to foreground the public interest even further, police and other public authorities should only use facial recognition technologies if they are open source.In the Court's view, an independent review of the automated facial recognition training data set and regular audits of the software performance on new datasets could be sufficient. 125But this does not go far enough: it is hard to justify commercial secrecy when the technology has such a significant impact on the rights of the public.Compliance with the public sector equality duty requires built-in transparency and accountability safeguards in relevant commercial contracts and the designs of technologies themselves.Such safeguards should be a prerequisite for technology companies seeking to sell their software to government agencies.

A. Room for Fragmentation and Ad Hoc Use
"I very much welcome the findings of the court in these circumstances.I do not believe the judgement is fatal to the use of this technology, indeed, I believe adoption of new and advancing technologies is an important element of keeping citizens safe.It does however set clear parameters as to use, regulation and legal oversight" 126 -UK Surveillance Camera Commissioner, 2020 "What the judgement has done is helpfully describe how we might strengthen deployment policies and influence codes of practice in how this technology is used across the UK … [It has been] a really helpful process…placing a rigorous test on our policies and the way that we approach things." 127-South Wales Police, 2020 Despite the Court's insistence on more procedural safeguards and transparency, the judgment left a lot of room for fragmentation and divergence in police practices around the use of facial recognition technology.In particular, the Court reasoned that the South Wales Police's local policies would constitute "law" under Article 8 of the ECHR: "As we have said, in principle a police force's local policies can constitute relevant 'law' in the present context, provided they are published." 128Instead of emphasizing the need for legislative reform on a national scale, the Court has opened the door for each police department to develop their own guidelines on the use of facial recognition technology, which will result in fragmentation of facial recognition technology policies across the U.K.This is concerning, as police use of facial recognition technology in the United Kingdom is only likely to expand.London police plan to integrate the technology with the CCTV and Automatic Number-Plate Recognition network. 129There are plans to use facial recognition technology on video footage taken from mobile devices, CCTV, and police body cameras after the fact. 130There are also plans for mobile facial recognition technologies which integrate biometric tracking software across multiple devices. 131In early 2020, the Metropolitan Police Service in London announced that it would roll out live facial recognition as part of its general policing strategy. 132Facial recognition is becoming and essential tool of modern policing and is here to stay.
If law enforcement use of facial recognition technology is not comprehensively regulated, the ad hoc and fragmented regulatory framework will reduce the predictability and consistency of police action.It will enable police departments, as well as other public and private agencies, to share citizens' information among themselves with little transparency or oversight.For example, in the United States, law enforcement agencies in at least 40 states use facial recognition technology in the absence of a federal regulatory framework. 133State and federal agencies also promote inter-agency access to facial recognition databases, enlarging the size of the population over which individual jurisdictions hold biometric information. 134olice also actively collaborate with other public authorities and private corporate entities.For instance, the New-York-based company Clearview AI claims to have 128  Bridges [2020] EWCA Civ 1058 at [121]. 129Big Brother Watch, supra note 33, at 31. 130Id. at 32. 131 Id. at 32-33. 132James Vincent, London police to deploy facial recognition cameras across the city, THE VERGE (Jan. 4 2020), https://www.theverge.com/2020/1/24/21079919/facial-recognition-londoncctv-camera-deployment. 133 a database of over three billion images. 135Their software was purportedly used by over 600 law enforcement agencies in 2019 and 2020. 136Even if a police department has stringent collection and storage guidelines, that department may share the information with other police departments lacking such safeguard requirements, thereby defeating the purpose of such protective policies.The ad hoc regulation of facial recognition technology use in the United States illustrates the risks of granting police departments too much discretion.Allowing police departments to effectively write their own rules undermines the basic protections for citizens that sound public policy, as well as the courts, should seek to preserve.
Instead of enabling police departments to rely on their internally developed 'local policies' to meet the 'in accordance with law' standard, the Court of Appeals should have encouraged the development of a comprehensive regulatory framework.This framework could be implemented through amendments to the Data Protection Act 2018, the Surveillance Camera Code of Practice, or by an entirely new law.Legislative intervention could prevent fragmentation and limit undue police discretion.Currently, the Automated Facial Recognition Technology (Moratorium and Review) Bill proposes to ban the use of technologies in the UK. 137owever, it is unlikely to be enacted, given the long history of use of CCTV and facial recognition technology in the UK.
The Bridges decision opened the door for police to use facial recognition technology, but it left the regulation of this technology to other courts and policymakers.Other jurisdictions are in the process of considering such regulation.For example, in the US, the Algorithmic Accountability Act was introduced in the House of Representatives, 138 while New York City's Public Oversight of Surveillance Technology Act 139 was introduced and has increased transparency around the New York Police Department's use of facial recognition technology. 140legal action launched in 2020 against the use of facial recognition by the French police before the Conseil d'État (the highest administrative court in France) might clarify the limits on police use of facial recognition technology in that jurisdiction.The claim focuses on provisions in the French Criminal Code of Procedure which authorizes police use of facial recognition to identify people registered in a police criminal record database.This database called the [Vol.22:284 "Traitement des antécédents judiciaires" contains 19 million files and more than eight million images of people. 141The ACLU is bringing similar challenges before U.S. courts.In October 2019, it brought an action against the US Department of Justice, the FBI, and the Drug Enforcement Agency, claiming that the public had a right to know when facial recognition software was being utilized under the Freedom of Information Act.The case was filed after the ACLU made a freedom of information request in January of 2019, and the DOJ, FBI, and DEA failed to produce any responsive documents. 142However, it remains to be seen whether these challenges will result in more stringent, comprehensive regulation of police use of facial recognition technology, or whether the current ad hoc and fragmented regulatory framework will continue.

V. CONCLUSION
The Bridges decision is an important first step in limiting police discretion over the use of facial recognition technology.But it is far from a great victory for those opposed to the expansion of surveillance infrastructure in public spaces.The Court has underplayed, if not explicitly rejected, facial recognition technologies' wideranging impact on public participation, public life, and civil discourse.The Court also did not require transparency as a prerequisite for the use of facial recognition technology, which can remain shielded behind trade secret law.Nor did the Court insist on any comprehensive legislative reform, leaving room for inconsistent and fragmented regulation of these technologies in the future.
Notwithstanding the Court's short-sighted analysis, facial recognition infrastructure in public spaces not only impacts the individual's right to privacy and ability to pass through public spaces but also burdens the population's ability to act collectively.The presence of facial recognition technology in public spaces is not merely a 'negligent' invasion of privacy, but cuts to the heart of democratic participation.The Court in Bridges considered the use of automated facial recognition technology "proportionate" to law enforcement's goals-but only because the Court did not take into account these broader societal concerns.The Court failed to engage directly with questions of democracy, public participation, and individual identity in public spaces.It therefore missed an opportunity to balance law enforcement goals with the broader democratic value of political participation and to secure the future of public spaces in the technological state.
Similarly, the Court's analysis of the discriminatory nature of facial recognition technology did not address the barriers preventing public officials from determining whether the technology they use satisfies their legal obligations.Although the Court acknowledged the need for safeguards when government agencies use cutting edge surveillance technologies, it left development of specific safeguards to the police.It is unclear what safeguards would satisfy the Court's standard.Would the creation of an independent advisory board with access to the software be sufficient?And 141 La Quadrature du Net, supra note 16. 142 ACLU Challenges FBI Face Recognition Secrecy, AM.CIV.LIBERTIES UNION (Oct.31, 2019), https://www.aclu.org/press-releases/aclu-challenges-fbi-face-recognition-secrecy.

2021]
Automated Facial Recognition and Public Space Surveillance 307 can such a board genuinely demonstrate to any public authority that the technology applies to all persons if there is no way to know how it operates?The tension between trade secrecy laws and public governance is not easily resolvable, and the Court could have signaled the direction in which the balance should be tipped.It is hard to see why police forces should be able to use the technologies when exercising public functions and duties, especially when they themselves are unable to know how using such technology may discriminate against large segments of the population.
Finally, the Court left much room for fragmentation in the regulatory framework overseeing police use of automated facial recognition technologies.By accepting that a local policy could constitute a 'law' for the purposes of Article 8 of the ECHR, the Court opened the door for different police forces to establish their own distinct guidelines.National legislative reform could ensure consistency and predictability in police use of facial recognition technology.Other courts will have to more firmly demand comprehensive reforms in the future.
The Court of Appeal's decision in the Bridges case has sparked a public debate on the use of automated facial recognition technology.By requiring police departments to rethink their deployment of the technology, the Court opened the door for reform on police use of biometric technologies more generally.The Court signaled that some regulation of such technology was appropriate.Instead of allowing individual police departments to invent the rules as they go, legal limits on the use of automated facial recognition must be clearly articulated in advance.However, the Court has also given police forces significant leeway to define these limits through their own policies rather than insisting on legislative intervention.Importantly, the Court held that the use of facial recognition for mass surveillance in public places is proportional to the goals of modern policing.Because it demands clearer limits on police discretion, the Bridges decision is reassuring in the short term.But its long-term impact in burning the bridges between the expanding public space surveillance infrastructure and the modern state is much weaker, if not damaging.
THE AUTOMATED FACIAL RECOGNITION TECHNOLOGY AND PUBLIC SPACE SURVEILLANCE IN THE MODERN STATE Monika Zalnieriute *
Id. at [143].Black Lives Matter protests in 2014 was due to police use of facial recognition.94Facialrecognitiontechnologyhasreportedlybeen used to monitor and screen crowds during the 2020 protests connected to the killing of George Floyd,95and officers in Dallas have actively requested video footage of protest activity, presumably to run through facial recognition software.96Theseglobal examples illustrate how police can use facial recognition technology to interfere with protest movements by threatening crowds with monitoring, screening and matching faces, and aiding in potential arrests.