FOI release

BSCC-FOI-0526-CB: information on non-law enforcement deployment of facial recognition and biometric surveillance technologies internal review response

Updated 27 August 2026

Mr Mark Greenhorn
Office of the Biometrics and Surveillance Camera Commissioner
2 Marsham Street
London
SW1P 4DF

21 August 2026

https://www.gov.uk/government/organisations/biometrics-and-surveillance-camera-commissioner

By email to Mr C Garrett

Dear Mr Garrett

Reference: BSCC-FOI-0526-CB

Thank you for your request for an internal review of the response issued on 27 July 2026 to your 22 July 2026 request concerning the deployment of facial recognition and biometric surveillance technologies.

I have conducted an internal review of the handling of your request under the Freedom of Information Act 2000 (FOIA) and, as far as any part of the request may fall within scope, the Environmental Information Regulations 2004 (EIR). This review has considered the original request, the response provided by the Office of the Biometrics and Surveillance Camera Commissioner (OBSCC), and each of the points raised in your request for internal review. In conducting this review, I was not involved in preparing the original response.

In summary, the review upholds the original decision, while recognising that some aspects of the initial response could have been explained more fully. In particular, the response could have provided clearer reasoning on the alternative consideration of EIR, expressly addressed the presumption in favour of disclosure, and offered more practical advice on how the request might be refined. The review also clarifies that the reference to possible future exemptions was not intended to pre-judge any future request. These points have now been addressed in the review, but they do not alter the substantive conclusion that the request, as framed, would exceed the applicable cost or burden threshold.

Internal review outcome

The internal review upholds the original decision to refuse the request under section 12(1) of FOIA. The request is broad in scope, covers thirty-seven separate points, and would require searches of multiple email accounts, the shared team repository and individual team-member repositories to identify, retrieve and extract any information held. The information is not structured in a way that would allow relevant areas to be readily ruled in or out without further review, and any search strategy would need to be broad because of the range of information requested. On the information available, the review considers it reasonable to conclude that compliance would exceed the appropriate limit of £450, equivalent to 18 hours’ work, as set by the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004.

The review also considers that the original response could have explained more clearly the basis on which EIR was addressed and provided more practical advice and assistance on refinement. This letter therefore sets out a fuller explanation and suggests ways in which you may narrow the request to bring it within the cost limit. Under FOIA, the relevant test is whether the statutory appropriate limit would be exceeded. Under EIR, the question is whether the request would impose a manifestly unreasonable burden under regulation 12(4)(b).

Basis for the section 12 estimate

The estimate is based on the locations of relevant recorded information, including shared document repositories, working files and relevant email accounts. The original request was not limited by date range, named organisation, type of record, or a single deployment context. It therefore could not be answered by running a single targeted search or by checking one discrete file set.

Given the breadth of the wording, staff would need to identify potentially relevant records, review search results for relevance against each of the thirty-seven points and then extract any information falling within scope. Even a modest amount of time spent assessing each point, each repository and each email account would be likely to exceed the 18-hour limit. The review therefore considers that the estimate was reasonable and based on the nature and location of the records likely to be engaged, while recognising that the original response could have set out this reasoning more fully.

The reference in the original response to approximately 6,000 files refers to the working document repositories most likely to contain material relevant to OBSCC policy, correspondence, and oversight activity, as identified through scoping. These files include shared team records and individual working files. They are not organised by each of the thirty-seven topics in the request, and relevant material could appear across overlapping subject areas. Keyword searches alone would not be sufficient because terms such as “facial recognition,” “biometrics,” “surveillance,” “CCTV,” “commercial,” “local authority” and similar expressions are likely to produce broad results requiring manual review for relevance.

A simple way to express the cost estimate is: number of request points × number of search locations × number of search cycles × estimated time per search or review task. The resulting time is then multiplied by the statutory hourly rate of £25. If that total exceeds £450, or 18 hours’ work, the section 12 appropriate limit is exceeded.

The £25 hourly rate is the statutory rate prescribed by the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004. It is a standard calculation rate for FOIA cost-limit purposes and is not based on the actual salary or grade of the staff involved. By way of illustration, an initial assessment of the thirty-seven points at only five minutes per point would take just over three hours before any searches were conducted. If at least six search locations, including relevant staff mailboxes and shared repositories, then required searching and each search, review of results and relevance assessment took only 30 minutes, that would add a further three hours for a single search cycle. Six was chosen as a realistic number based on the staff supporting the Commissioner and the shared repository available to the team. In practice, more than one search term or combination of terms would be required because of the breadth of the request, including different search terms and combinations for the main technologies, deployment contexts and organisations referenced. Even six search cycles on that conservative basis would amount to approximately 18 hours before all relevant information could be identified, retrieved, and extracted. The review therefore considers that the appropriate limit would be exceeded.

Consideration of the points raised in your internal review request

1. Whether the response should have identified information held

Section 1(1)(a) of FOIA requires a public authority to confirm or deny whether it holds requested information unless an exemption applies. However, where section 12 is relied upon, a public authority is not required to carry out searches that would themselves exceed the appropriate limit to establish the full extent of information held. The review has not identified a basis to conclude that the original response was unlawful solely because it did not identify every item held, not held, within remit or outside remit. The scale and breadth of the request meant that establishing that position across all thirty-seven points would have required the type of searches that section 12 is intended to avoid.

2. Alleged contradiction regarding EIR information

The statement that it was unlikely that OBSCC held environmental information was not intended to confirm that no environmental information was held. Rather, it reflected an initial assessment that the request appeared principally concerned with biometric surveillance, facial recognition, oversight activity, policy, and regulatory matters, rather than information on the state of the elements of the environment or factors affecting them.

To determine whether any material within the broad scope of the request was environmental information would still require review of relevant records. The review therefore considers that there is no substantive contradiction, but accepts that the original explanation could have been clearer and that your query on this point was understandable.

3. Application of FOIA section 12

The review upholds the use of section 12. The request comprised thirty-seven separate points and would require searches of multiple email inboxes and approximately 6,000 files. The costs of determining whether information is held, locating it, retrieving it, and extracting it may be considered for section 12 purposes. The review has considered whether individual elements could be answered quickly or separately but has not identified any element that could reliably be answered without searches likely to exceed the limit, given the breadth of the request and the absence of limiting parameters. Identifying which elements could be answered without exceeding the limit would itself require searches and assessment across the relevant record sets. FOIA does not require a public authority to carry out that exercise where a reasonable estimate indicates that the aggregate cost of compliance would exceed the appropriate limit.

4. Duty to advise and assist under FOIA section 16

The review considers that the original response attempted to provide advice and assistance by inviting you to refine the request. However, it accepts that fuller and more practical advice could have been provided. A refined request is more likely to fall within the cost limit if it is limited to one or two of the thirty-seven points, a single technology or deployment context, a named organisation, a defined date range, a specific record type, or published material only. For example, a request limited to live facial recognition, correspondence with one named public authority, and a three- or six-month period would be more capable of being considered within the cost limit. Further information to assist you with any revised request is set out later in this response.

5. Application of EIR regulation 12(4)(b)

The review treats the request primarily as a request under FOIA because it is framed principally as a request for information about biometric surveillance, facial recognition, oversight activity, policy, and regulatory matters. EIR has been considered in the alternative. The review has not identified, from the wording of the request alone, a discrete category that plainly falls to be handled only under EIR. Even if some elements were environmental information, regulation 12(4)(b) would apply because identifying, separating and reviewing those elements across the breadth of the request would require a manual assessment of a very large volume of potentially relevant material to determine whether it was environmental information, whether it fell within scope and whether it could be disclosed. The review accepts that the original response should have expressly acknowledged the presumption in favour of disclosure but does not consider that this changes the outcome.

Although the FOIA appropriate limit does not apply directly under EIR, the scale and burden of the work required are relevant to whether a request is manifestly unreasonable under regulation 12(4)(b).

6. Presumption in favour of disclosure under EIR regulation

12(2) The review accepts that the original response did not expressly refer to regulation 12(2). I have therefore reassessed the public interest and applied the presumption in favour of disclosure when considering, in the alternative, regulation 12(4)(b). There is a public interest in transparency about surveillance technologies, particularly where they may affect public spaces, privacy, proportionality, oversight, and public confidence.

Against this, the request is very broad, covers thirty-seven points, and is not limited by date, organisation, record type, or deployment context. Identifying, separating, and assessing any environmental information would require a substantial manual review across multiple repositories and mailboxes, diverting staff from statutory and operational functions.

Having weighed these factors, and applying the presumption in favour of disclosure, the review concludes that the public interest favours maintaining regulation 12(4)(b). This reflects the manifestly unreasonable burden of this request as framed, not any lack of public interest in the subject. A narrower request would allow the public interest to be assessed against a more proportionate search.

7. Partial disclosure

An initial scoping review of the request did not identify any standalone point that could be answered reliably without searching across the same repositories. The difficulty is that the request is not structured around a small number of discrete records or clearly separable topics. Identifying which parts of the thirty-seven-point request could be answered quickly would itself require searches and assessment across the relevant record sets. In the circumstances, the review considers that OBSCC was not required to conduct exploratory searches to identify whether some information might be disclosed. However, a narrower request focused on a smaller number of defined topics would be considered on its own merits.

8. Published information

The review notes your point that OBSCC has published consultation responses, guidance, policy statements, and commentary relevant to biometric and surveillance issues. The existence of published material does not remove the need to search for any unpublished recorded information falling within the scope of the request. The request was not limited to published information, and identifying every published item that may be relevant to each of the thirty-seven points would itself require assessment. If you wish to receive published material only, or material on a specified topic, OBSCC can consider that as a refined request.

The original response did not refuse the request under section 21 of FOIA or regulation 6(1)(b) of EIR because the request was not limited to published material and would still have required searches for unpublished information. However, where information is already publicly available, OBSCC may direct requesters to that material in response to a narrower request.

OBSCC’s published information can be found on its website at Biometrics and Surveillance Camera Commissioner - GOV.UK, including reports, policy guidance and published consultation responses.

9. Whether the burden was overstated

The review considers that the estimate was reasonable. The request covered a wide range of technologies, deployment contexts, public and private sector actors, policy questions, and oversight issues. In that context, the need to search multiple email accounts and around 6,000 files provides a reasonable basis for concluding that the appropriate limit would be exceeded. The review has considered whether narrower elements might be outside remit or already published, but the breadth of the request means that reaching a reliable position across all points would still require the same type of search and review exercise. A public authority is not required to conduct a precise search before relying on section 12; it may rely on a reasonable estimate based on the nature and location of the records likely to be engaged.

10. Metadata or high-level summaries

FOIA and EIR provide a right of access to recorded information held by a public authority. They do not require a public authority to create new summaries or analysis to answer a request. Confirming whether documents, assessments or correspondence exist may still require searches across the same repositories. The review has therefore not found a basis to conclude that the request could be answered through metadata or high-level summaries without exceeding the cost limit.

11. Repetition

The review notes your statement that this is a first request on these topics. The original response did not rely on repetition as a basis for refusal. The refusal under EIR regulation 12(4)(b) was based on manifest unreasonableness arising from disproportionate burden, not on the request being repeated.

12. Whether the burden is self-inflicted

The fact that OBSCC has published material on related policy issues does not mean that all information falling within the much broader request can be identified and disclosed without significant search and review work. Published material may indicate that some relevant information exists, but it does not remove the need to locate, retrieve, and extract unpublished recorded information across the broad scope of the request. The review has therefore not found a basis to conclude that the burden is self-inflicted.

13. Reference to possible future exemptions

The review accepts that exemptions and exceptions must be applied to specific information where a request is being answered. The statement in the original response that other exemptions might apply to any revised request was not intended to pre-judge such a request. It was intended only to explain that any future refined request would be considered on its own facts and that other provisions of FOIA or EIR may be relevant, depending on the information identified.

Advice and assistance

To assist you in making a refined request, OBSCC would be most likely to be able to consider a request that is limited in one or more of the following ways:

• One or two specified points from the original thirty-seven-point request.
• One specific technology, such as live facial recognition, retrospective facial recognition, or another named biometric technology.
• One deployment context, such as local-authority CCTV, commercial use, or public space surveillance.
• A named organisation, public authority, or sector.
• A narrow date range, for example three or six months.
• A specific category of recorded information, such as correspondence, guidance, meeting minutes, or assessments.
• Final guidance or policy documents on one named biometric technology.
• Published material only on non-law enforcement use of facial recognition.

For example, a refined request might ask: “Please provide recorded information held by OBSCC between [date] and [date] relating to correspondence with [named organisation] about [specific technology or deployment].” Any refined request will be considered afresh under FOIA or EIR as appropriate.

To reduce the search burden further, you may wish to specify the search parameters you want OBSCC to apply. For example, you could limit any revised request to one named technology, one deployment context, one organisation, one date range or one record type. You may also wish to exclude drafts, duplicate material, attachments, internal administrative emails, or information that is already publicly available. The more precisely the scope is defined, the more likely it is that OBSCC will be able to determine whether the request can be answered within the appropriate limit.

For example: “Please search the central OBSCC mailbox only for final correspondence between 1 January 2025 and 30 June 2025 with [named organisation] concerning live facial recognition in local-authority CCTV. Please exclude drafts, duplicate emails, attachments, and internal administrative correspondence.”

Conclusion

For the reasons set out above, the internal review upholds the decision to refuse the request under section 12(1) of FOIA. EIR has been considered in the alternative. Even if any information within scope were environmental information, the review also upholds the application of regulation 12(4)(b). The review accepts that the original response could have provided fuller reasoning on EIR, the presumption in favour of disclosure, and advice and assistance. Those points have been addressed in this internal review, but they do not alter the substantive outcome.

I appreciate that this may not be the outcome you were seeking. However, I hope the explanation above clarifies the basis for the decision and the steps you may take if you wish to submit a narrowed request. Any further request will be considered on its own merits under FOIA or EIR, as appropriate.

If you remain dissatisfied, you may complain to the Information Commissioner. For FOIA matters, this right arises under section 50 of FOIA. The Information Commissioner also considers complaints under EIR. The ICO usually expects complaints to be made within three months of the internal review outcome. The Information Commissioner’s Office can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or through www.ico.org.uk.

Yours sincerely,

Mark Greenhorn

Head of Office for the Biometrics Surveillance Camera Commissioner

Home Office Science
Digital and Innovation Group
2 Marsham Street, London SW1P 4DF

Email: enquiries@obscc.org.uk