New code of practice planned for UK businesses using facial recognition and biometrics

The proposals, announced by the UK government on 4 November, include the establishment of a new biometrics regulator focused on overseeing law enforcement use of biometric technologies. The regulator will also contribute to the development of a separate legal code of practice for private sector organisations using facial recognition and similar systems. 

According to the government, businesses using facial recognition to tackle crime, including retailers, will be expected to follow the new framework, which is intended to support the responsible use of the technology and provide greater consistency between public and private sector applications. The government has emphasised, however, that the code will recognise the different legal and operational contexts in which businesses and law enforcement agencies deploy biometric tools. 

The announcement comes at a time when biometric technologies are being adopted in increasingly diverse settings. While facial recognition has become more common in areas such as site access controls, account security and crime prevention, organisations are also exploring innovative uses of biometric monitoring beyond traditional security applications.

For example, World Rugby’s recently launched fan engagement study is using biometric sensors to assess how supporters physically respond to different moments during matches. The initiative forms part of the governing body’s wider strategy to enhance the appeal of the sport while maintaining player welfare and improving the flow of games.

Initially focused on supporters watching matches at home, the proje ct could eventually be expanded to fans attending fixtures in person. The study aims to identify which moments generate the strongest reactions from supporters, potentially helping organisers better understand audience engagement and informing decisions about competition formats, broadcast production and the wider matchday experience.

Dom White, a data protection law specialist at Pinsent Masons, said: “The initiative reflects a broader shift in how organisations collect and analyse data about the people who engage with their products and services. Sports organisations have long measured what supporters watch, click, attend and purchase. Biometric technologies potentially offer a more detailed picture, providing insight into supporters’ physiological responses during events. In future, similar approaches could inform sponsorship activations, in-stadium entertainment and broadcast content strategies.”

However, the growing use of biometric technologies is also prompting closer scrutiny from regulators and policymakers. Campaign group Ada Lovelace Institute has welcomed the government’s plans but argued that the private sector code should be mandatory. The organisation has also called for clear legal thresholds governing when facial recognition technologies can be used outside law enforcement settings. 

Meanwhile, industry body techUK said clear and consistent regulation will be important in maintaining public confidence in the technology and supporting its responsible adoption. 

Malcolm Dowden, data protection expert at Pinsent Masons, said: “When used for identification of an individual, facial recognition and other biometric data is highly likely to be ‘special category’ data for the purposes of data protection law, requiring additional protections and compliance measures. Businesses seeking to deploy these technologies often face significant challenges in relation to data protection law, including identification of an appropriate lawful basis and additional conditions for processing, as well as having to meet rigorous tests of necessity and proportionality."

He said: "Clear and practical focused codes of practice would materially help businesses to access the benefits and efficiency gains stemming from these technologies while reducing the risk of breach and regulatory enforcement actions."