The Home Office updated its Immigration Enforcement live facial recognition legal mandate on 29 October 2026, reflecting the move from proof of concept to a pilot; the document states it creates no new enforcement powers.
Replaces version 2.0 of the legal mandate; the previous version is held at the National Archives.
The Home Office policy paper, Immigration Enforcement: live facial recognition legal mandate, sets out the legal basis on which Immigration Enforcement (IE) uses overt live facial recognition (LFR). It says LFR is primarily used as a precision tactic to locate people attempting to return in breach of an extant Deportation Order. The page was updated on 29 October 2026. The document history lists version 2.2 with an issue date of September 2026.
The update reflects the move from proof of concept to a pilot exercise. It adds detail on legal powers, watchlist controls, data protection, human rights, equality duties, human oversight, retention and deletion, transparency, joint deployments and accountability. It states that LFR does not create any new enforcement powers (section 3).
How the system works. LFR compares faces captured by cameras during an authorised deployment against a pre-approved watchlist. A possible match generates an alert, which trained staff must review. No enforcement action may be taken solely on the basis of an alert, and any action must be supported by an existing legal power (section 22).
Watchlists (section 10). A watchlist is specific to a deployment, purpose-specific and time-limited. A person may be included only if they fall within an authorised, objectively defined category, there is a current lawful purpose, inclusion is necessary and proportionate, the image and information are accurate and current, and less intrusive means are not sufficient. Intelligence alone must not be used to create eligibility for inclusion. Section 9 names Regulation 4 of the Immigration (Collection, Use and Retention of Biometric Information and Related Amendments) Regulations 2021 as the basis for compiling and using watchlists.
Data protection (sections 11 to 15). The applicable regime depends on the primary purpose of a deployment. Administrative immigration purposes fall under UK GDPR and Part 2 of the Data Protection Act 2018. Criminal law enforcement purposes fall under Part 3. IE must record the regime, lawful basis and safeguards for each deployment.
Retention (section 23). Biometric data of anyone who passes through the zone of recognition without generating an alert is automatically, immediately and permanently deleted. Where an alert is generated, only the minimum information necessary is retained for lawful purposes.
Oversight (section 25). The document names scrutiny by the Information Commissioner's Office and the Biometrics and Surveillance Camera Commissioner, and consultation with the Science and Technology Ethics Advisory Committee. Joint deployments with policing partners are covered in section 24, with IE acting as controller, joint controller or processor, recorded before processing begins.
What this means for applicants
The source describes LFR as an identification tool, not a free-standing power (section 6). It says any arrest, detention or other action must be justified by the relevant statutory power (section 7). Section 28A of the Immigration Act 1971 allows an Immigration Officer to arrest without a warrant where a person has committed, attempted to commit, or is reasonably suspected of having committed, a listed immigration offence.
Sources
- Immigration Enforcement: live facial recognition legal mandate, Home Office, updated 29 October 2026
