Following a landmark High Court ruling in April 2026 confirming that the Metropolitan Police's Live Facial Recognition (LFR) programme is lawful, individuals retain full Subject Access Rights to any biometric data processed about them. This guide explains how to exercise those rights for free — in minutes.
The High Court ruled that the Metropolitan Police Service's use of Live Facial Recognition technology across London is lawful and complies with the European Convention on Human Rights. The ruling settled a legal challenge brought by civil liberties campaigners.
Crucially, the ruling does not remove your data rights. Under UK GDPR Article 15 and the Data Protection Act 2018, you have the right to request confirmation of whether your biometric data has been captured and processed — regardless of whether you were "matched" or not. The Met Police must respond within 30 calendar days, free of charge.
Live Facial Recognition (LFR) is a surveillance technology that scans the faces of people in public spaces in real-time, compares them against a watchlist of individuals, and alerts officers to potential matches. The Met Police has deployed LFR at locations including Croydon, Oxford Street, Waterloo Station and major public events.
Biometric data is classified as special category data under Article 9 of the UK GDPR — the highest level of protection under data protection law.
No. If you were in the vicinity of an LFR deployment — for example, walking past a camera in Oxford Street or attending an event where LFR was in use — your face may have been scanned. The vast majority of people scanned are not on any watchlist. For non-matched individuals, the Met's policy is to delete biometric templates immediately after the non-match result. A SAR will confirm whether this deletion occurred.
Even if your data was deleted immediately, you have the right to confirmation that this happened — and details of the processing that took place before deletion.
A well-constructed SAR to the Met Police about LFR should request:
easySAR generates all of this automatically when you select the Metropolitan Police and include your location details.
Important: The Met Police may ask for a photograph of yourself as proof of identity before processing a biometric SAR. This is lawful under section 52 of the Data Protection Act 2018.
You are not obliged to send a photo upfront. Submit your SAR first and wait to see if they request it. If they do, provide a clear, face-on photograph and include a covering statement explicitly saying:
"This photograph is provided solely for the purpose of verifying my identity in connection with this Subject Access Request. It must not be processed through any facial recognition system or retained beyond the period necessary for identity verification."
It is strongly recommended, though not legally required. Providing specific dates and locations where you may have been present during an LFR deployment gives the Met Police something concrete to search against and significantly strengthens your request.
Examples of useful information to include:
easySAR includes an optional field to add this information, which is then included in your letter automatically.
easySAR generates a tailored LFR Subject Access Request to the Metropolitan Police — free, in under 2 minutes. No account needed. Your data never stored.
Send your Met Police SAR for free →As of April 2026, the following forces use LFR and are all available in easySAR:
easySAR includes all 44 police forces in England and Wales with verified Data Protection Officer contacts.
Under UK GDPR, the Metropolitan Police must respond within 30 calendar days of receiving your SAR. They can extend this to 3 months for complex requests, but must notify you within the first 30 days if they intend to do so.
If they fail to respond, respond inadequately, or refuse without valid legal grounds, you can:
The ICO can compel compliance and issue fines of up to £17.5 million or 4% of global turnover for serious breaches.
easySAR is a free, privacy-first tool for UK residents to send Subject Access Requests to over 314 UK organisations — including all 44 police forces, banks, NHS trusts, retailers, social media companies, data brokers and government bodies.
Your data is never stored. Letters are generated entirely in your browser and transmitted directly to the organisation's Data Protection Officer via encrypted email. No account required.