Merseyside Police unlawfully holds at least 300,000 mugshots that are overdue for deletion, according to an internal data protection impact assessment. The force estimated that at least 300,000 people logged on the police database could have multiple custody images that have yet to be deleted in Niche, the police system used by a number of law enforcement agencies in England and Wales.
Facial recognition tool never adopted
The disclosure comes from an assessment carried out into the viability of officer initiated facial recognition (OIFR), a mobile-based policing tool that allows officers to upload a photograph of an individual during an in-person encounter and cross-reference it against databases in real time. The ECHO understands the facial recognition technology was never adopted by Merseyside Police due to concerns surrounding the unlawfully held images.
The assessment document, seen by the ECHO, said: "There is a real risk the force could use and compare against an unlawful image whilst undertaking an OIFR." A spokesperson for Merseyside Police told the ECHO: "OIFR is not currently in operational use by Merseyside Police and the retention of custody images is a longstanding national issue affecting police forces across England and Wales and is not unique [to the force]."
Campaigners call for deletion
Jake Hurfurt, head of research and investigation at Big Brother Watch, the civil liberties campaign group which provided the assessment document to the ECHO, said: "It is alarming to see Merseyside Police seemingly acknowledge it unlawfully holds more than 300,000 mugshots but take no action to delete them.
"Almost 15 years have passed since the High Court ruling but it appears that police across the country view complying with millions of people's data rights as an irrelevant afterthought. Instead of trialling tools that run biometric searches on hundreds of thousands of unlawfully retained images Merseyside Police needs to get their house in order and delete data they should not be holding."
National retention issue
The High Court ruled in 2012 that keeping images of people who faced no action or who were charged and then acquitted for more than six years was unlawful. But 15 years on, most police forces in England and Wales continue to keep hold of arrest photographs. A 2017 Home Office review following the landmark High Court case found police forces had access to nearly 20 million images that had been enrolled in the facial recognition gallery on the police national database.
The Home Office said it was impractical to insist police forces go through all images and delete people not convicted of an offence because it would be "resource intensive [and] cost a very considerable amount of taxpayers' money." Instead, anyone convicted of a non-serious offence could apply for their image to be deleted.
Comparison with Scotland
In Scotland, custody images are only uploaded to the national database if a person has been charged with an offence. It has been reported that Police Scotland also reviews custody images to delete those not linked to a live prosecution or conviction. Big Brother Watch's Mr Hurfurt added: "Police Scotland have shown removing these images is possible and Merseyside Police should follow suit rather than remain complicit in a decade-old breach of privacy rights on an industrial scale."
The National Police Chiefs' Council (NPCC) was approached for comment. OIFR technology differs from the live facial recognition technology (LFR) adopted and deployed by Merseyside Police in late 2025. LFR deploys cameras in public areas like city centres or sports events to capture real-time images of people's faces and compare them against a "watchlist" of persons of interest. The Metropolitan Police announced earlier this year that it would trial the handheld facial recognition technology, sparking concerns from campaigners who labelled it a "disaster for civil liberties".
In the Merseyside Police assessment document, it said OIFR uses a lawfully acquired captured image and "matches against those stored in the integrated database". The assessment added the source of the data would be custody images stored on Niche. In the assessment section looking at how lawful the personal data was, the report said: "As an organisation we are aware that there are potentially 300,000 nominals who could have multiple images overdue for deletion." Acknowledging campaigners' concerns, the assessment added: "Civil liberties groups have expressed concerns regarding the use of biometric facial matching within law enforcement practices. While some of these concerns have been addressed, the organisation needs to remain mindful of the concern."
