Peter A Clarke

We’ve already acted to safeguard people and enable innovation in some of the most significant areas of AI and biometric technologies. Highlights include:

• • on AI and ADM:
    • providing guidance and resources on AI and data protection and automated decision-making and profiling, enabling organisations to comply with confidence;
    • responding swiftly to the rapid emergence of generative AI with clarity on its lawful development and use, including joint positions with the Competition and Markets Authority;
    • intervening directly with developers of generative AI products (eg Snap and Meta) to address emerging risks to people’s information; and
    • auditing developers and providers of AI tools in recruitment to identify risks and strengthen compliance in real-world settings.
  • on biometrics:
    • taking enforcement action where biometric technologies pose risks to people’s rights (including action against Clearview AI and Serco Leisure for unlawful use of facial recognition);
    • publishing guidance on biometric recognition systems to help organisations understand how data protection law applies and what good practice looks like;
    • issuing two Commissioner’s Opinions on the fair and proportionate use of live facial recognition in public spaces, by both law enforcement and private organisations; and
    • undertaking research and engagement to better understand the privacy implications of biometric technologies. This includes joint work with the Ada Lovelace Institute and British Youth Council on public expectations. 

More broadly, our innovation services provide organisations with expertise and advice to help them innovate responsibly, respecting people’s privacy. Current and past participants have included organisations innovating with AI and biometric technologies. 

We will build on this work over the next year (2025/26), promoting high standards of data protection and trust in the use of AI and biometric technologies.

Trust in AI and biometric technologies depends on responsible innovation that safeguards people’s rights. There are two significant challenges to ensuring this is the case: 

Firstly, private and public sector organisations can lack the regulatory certainty and confidence to invest in and use AI and biometric technologies compliantly. 

Secondly, a lack of transparency and confidence about how personal information is used in these technologies can undermine public trust.

These challenges need addressing if the benefits of AI and biometric technologies are to be fully realised. 

We’ve said before, if people don’t trust a technology, then they’re less likely to use it or agree to their own information being used to power it. This will hamper innovation in the process. We will support responsible use of AI and biometric technologies to help ensure this isn’t the case in the UK. Wherever personal information is processed by these technologies, clear, proportionate and robust standards of data protection will apply to prevent harm and promote trust.

AI and biometric technologies are already in use across a wide range of contexts –  from law enforcement, to education, to healthcare. While our regulatory interest spans the full breadth of these developments, this strategy targets three priority situations where: 

• • the stakes for people are high;
  • public concern is clear; and
  • regulatory clarity can have the most immediate impact.

These are high-impact cases with significant potential for public benefit, but they also concentrate many of the risks people care most about:

• • the development of foundation models — large-scale models trained on vast datasets and adaptable to a wide range of downstream tasks;
  • the use of automated decision-making in recruitment and public services; and
  • the use of facial recognition technology by police forces.

By raising standards here, we aim to create clear regulatory expectations and scalable good practice that will influence the wider AI and biometrics landscape.

Within these cases, we consistently see public concern forming around three cross-cutting issues:

• • transparency and explainability;
  • bias and discrimination; and
  • rights and redress.

Transparency and explainability

People expect to understand when and how AI systems affect them. But across generative AI, ADM and FRT, the picture is often unclear.

In recruitment, people want to know when organisations use automated tools and how they make decisions. 

In generative AI, users call for greater clarity on how organisations develop and train tools. 

And in policing, concerns about fairness and privacy are closely linked to how well they can explain and justify FRT decisions.

Bias and discrimination

People are concerned that AI systems can replicate or amplify bias, particularly when trained on flawed, incomplete or unrepresentative information.

In recruitment, people fear that automated tools may reflect and reinforce social inequalities, particularly in how candidates are ranked or filtered. 

In generative AI, users have observed biased outputs and expect developers to take visible action to address them. 

In facial recognition, public trust is shaped by whether systems perform consistently across different demographic groups. Independent testing of facial recognition algorithms demonstrates differential performance according to gender and ethnicity

Risks of bias and discrimination are particularly acute in speculative AI systems that attempt to infer traits, emotions or intentions from physical or behavioural characteristics — such as emotion recognition tools used in recruitment. Research shows that the science underpinning these systems is highly contested and that their use has the potential to lead to harms.

Rights and redress

Public confidence in AI and biometric technologies is shaped most powerfully by what happens when things go wrong.

People are concerned about the serious consequences of inaccurate outputs and unfair outcomes, for example:

• • being wrongly identified by facial recognition;
  • being overlooked for a job due to flawed automation; or
  • losing access to benefits through error-prone ADM. 

In generative AI, models can reproduce sensitive personal information, including medical details or child sexual abuse material. These are not abstract risks — they affect lives and livelihoods.

People want to know that:

• • systems are accurate;
  • safeguards are in place; and
  • there are clear ways to challenge and correct outcomes when harm occurs.

As AI systems become more agentic, the ability to trace decisions back to a human controller becomes harder — and people may struggle to understand how decisions were made or how to challenge them. This creates real risks around accountability and redress. 

Over the next year (2025/26), we will take targeted action across the types of cases we have prioritised. We will ensure that organisations can develop and deploy AI and biometric technologies with confidence and that people are safeguarded from harm.

Give organisations certainty on how they can use AI and ADM responsibly under data protection law

We will:

• • consult on an update to our ADM and profiling guidance by autumn 2025, reflecting proposed reforms in the Data (Use and Access) Bill; and
  • develop a  statutory code of practice on AI and ADM, providing clear and practical guidance on transparency and explainability, bias and discrimination and rights and redress, so organisations have certainty on how to deploy AI in ways that uphold people’s rights and build public confidence.

Ensure high standards of automated decision-making in central government, ensuring decisions that affect people are fair and accountable

We will:

• • learn from early adopters of ADM, such as the Department for Work and Pensions and others, and communicate our findings across central government to support the scaling of responsible use; and
  • set out regulatory expectations, securing assurance that departments are using ADM responsibly and with appropriate safeguards. 

Set clear expectations for the responsible use of automated decision-making in recruitment

We will:

• • scrutinise the use of ADM in recruitment by major employers and recruitment platforms, identifying risks related to transparency, discrimination and redress; and
  • publish findings and regulatory expectations, holding employers to account if they fail to respect people’s information rights.

Scrutinise foundation model developers to ensure they are protecting people’s information and preventing harm

We will:

• • secure assurances from developers that personal information used in model training is safeguarded, with appropriate controls to prevent misuse or reproduction of sensitive information, including child sexual abuse material; and
  • set clear regulatory expectations, where needed, to strengthen compliance (including for the use of special category data), and take action if unlawful model training creates risks or harm.

Support and ensure the proportionate and rights-respecting use of facial recognition technology by the police

We will:

• • publish guidance clarifying how police forces can govern and use FRT in line with data protection law, with advice on organisational and technical measures to minimise risks;
  • audit police forces using FRT and publish our findings, securing assurance that deployments are well-governed and people’s rights are protected; and
  • provide expert advice to government on proposed changes to the law, ensuring any future use of FRT remains proportionate and publicly trusted. 

Anticipate and act on emerging AI risks

We will:

• • engage with industry to assess the data protection implications of agentic AI, publishing a Tech Futures report examining issues such as accountability and redress, before consulting on emerging data protection challenges; and
  • set a high bar for the lawful use of AI systems that infer subjective traits, intentions or emotions based on physical or behavioural characteristics, conducting ongoing surveillance of use cases and taking action where such systems cause harm or infringe people’s rights.

  • Agentic AI refers to AI systems composed of agents that can behave and interact autonomously in order to achieve their objectives. These agents are small, specialised pieces of software that can make decisions and operate cooperatively or independently to achieve system objectives. Advances in agentic AI are driven by the integration of large language models (LLMs) with agent-based systems. By providing reasoning and discovery abilities, LLMs enhance an agent’s autonomy. This enables the agent to determine the most appropriate course of action to meet system objectives.

Artificial intelligence (AI) refers to a broad range of algorithm-based technologies that solve complex tasks by carrying out functions that previously required human thinking. This processing falls within the scope of data protection law if personal information is used to train, test or deploy an AI system.

Automated decision-making (ADM) is the process of making a decision by automated means without any human involvement. Data protection law provides people with specific rights and protections if organisations are carrying out solely ADM that has legal or similarly significant effects on them. For example, automated decisions to award a financial loan or benefit or evaluations within recruitment tests.

Biometric technology refers to systems that use biometric data to recognise or identify a person’s identity. For example, facial recognition, fingerprint scanning and voice recognition systems.

Facial recognition technology (FRT) refers to the technologies that enable the automated recognition of people based on facial features extracted from digital facial images.

Foundation models are base models for AI systems that are trained on large amounts of data. They can generate outputs such as text, images and audio and be adapted to a range of tasks.

Generative AI refers to a type of AI that can generate outputs that resemble human-created content. Most of the current generative AI systems are based on the transformer architecture. This architecture is a type of deep learning model designed to process sequences of data, eg text, by focusing on the relationship between different parts of the input.

Large language models (LLMs) are a type of generative AI with the ability to produce human-like text, code and translations.