The ICO has issued an AI and biometrics strategy. It says that from a data protection perspective, people need to be able to trust that organisations using AI and biometrics tech:
- are transparent about the personal information they use;
- use personal information fairly; and
- take appropriate care, putting in place governance and technical measures to protect people from harm.
ICO cites statistics that show that public concerns are especially strong in high-impact cases:
- In policing, 54% of adults have some concerns that facial recognition technology would affect civil liberties and infringe people’s right to privacy.
- In recruitment, 64% believe employers will rely too heavily on AI, and 61% are concerned it will perform worse than human decision-makers when assessing individual circumstances.
- In public services, concern about the use of AI to determine welfare eligibility has risen from 44% in 2022/23 to 59% in 2024/25.
The strategy sets out how the ICO will:
- set clear expectations for responsible AI through a statutory code of practice for organisations developing or deploying AI and automated decision-making, to enable innovation while safeguarding privacy;
- secure public confidence in generative AI foundation models by working with developers to ensure they use people’s information responsibly and lawfully in training these models;
- ensure that automated decision-making (ADM) systems are governed and used in a way that is fair to people, focusing on how they are used in recruitment and in public services; and
- ensure the fair and proportionate use of facial recognition technology (FRT), working with law enforcement to ensure that the technology is effective and people’s rights are protected.
As these technologies evolve, new risks are emerging. AI systems that are increasingly capable of acting autonomously (agentic AI) raise questions around accountability and redress. Meanwhile, some systems make speculative inferences about people’s intentions or emotions based on their physical or behavioural characteristics. These developments demand careful scrutiny. The ICO says that it will be responsive to new issues that emerge and be transparent when its focus needs to shift.
This strategy supports the ICO’s objectives to promote responsible innovation and sustainable economic growth; and safeguard and empower people, particularly those who need extra support to protect themselves. It also reinforces the ICO’s commitment to supporting economic growth by addressing risks that regulatory uncertainty is a barrier to organisations innovating with, and adopting, new technologies.
