This page is from APP, the official source of professional practice for policing.
Prioritisation
- Objective: Ensure that the proposal gives the force the best return on investment in terms of outcomes for the public.
- Decision maker: Senior leader, project lead.
- Question to proceed to the next stage: Does the proposal fit with strategic priorities and policing capabilities? Does the proposal make best use of available resources?
- Advice can be sought from: Police and crime commissioners.
This section is about understanding the nature of the problem to be solved. It also sets out how project leaders should seek views about what data-driven technology (DDT) solutions might be available and appropriate to the identified problem.
Project leads should clearly define the problem that they are looking for a DDT to address, or the opportunity to be exploited. They should then scan the environment to understand options available to them.
In assessing options, project leads should consider the HM Treasury Green Book. This provides guidance on how to appraise policies, programmes and projects to ensure that they are developed in a way that delivers social or public value. It sets out approved thinking models and methods to clarify the social or public welfare costs, benefits and trade-offs of alternative implementation options for the delivery of policy objectives.
When preparing a business case for the DDT, project leads should refer to the Five Case Model set out in HM Treasury’s Business case guidance for projects and programmes.
Senior leaders should consider how the proposed DDT fits alongside other demands – for example, whether the technology would support the police force to achieve significant strategic objectives. Senior leaders should also consider whether the DDT use case could be of benefit, bearing in mind the force’s level of digital maturity. Senior leaders should use the NPCC science and technology strategy, which sets out the criteria by which DDTs should be assessed in relation to their desirability, feasibility and viability.
The NPCC’s ‘Policing Problem Book: Problem Statement Weighting and Prioritisation Tool’ has been developed to support officers and staff. It can be used to assess the impact that each problem is having on policing, to aid decision making and prioritisation.
Stakeholder engagement and environmental scanning
- Objective: To help define the problem and secure buy-in for the proposed solution. To best understand how the proposed technology can benefit and affect local communities and key stakeholders.
- Decision maker: Project lead, with input from the data protection officer (DPO) and senior information risk owner or officer (SIRO).
- Question to proceed to the next stage: Do the benefits outweigh the risks regarding moving to the next stage? Is there a clear plan to mitigate any risks and potential harms?
- Advice can be sought from: Relevant internal and external panels, committees, groups and equalities advisors. Advice can also be sought from the Police Science Council, the the Police Digital Service (PDS), BlueLight Commercial, the Home Office Public Safety Group Commissioning Board, and the Office of Police Chief Scientific Adviser (OPCSA).
- Documents to be completed: Community impact assessment (CIA), equality impact assessment (EIA) and Human rights impact assessment (HRIA).
Senior leaders should ensure that evidence, research and advice have been sought and considered in the development of DDTs. They should also ensure that engagement with partners and the public has been undertaken to inform the approach to adopting and embedding the new technology.
Project leads should engage widely with community leaders and interested groups at an early stage, particularly in cases which may be contentious. This will help them to gain the best understanding of how using a DDT could affect their communities, and what solutions may be possible. Public engagement should be meaningful, two-way and fair. It should use as many channels as feasible. Please refer to the College of Policing's Engagement and communication APP and the Cabinet Office’s Consultation principles: guidance.
The Scottish Government’s independent advisory group on emerging technologies in policing identified a number of principles for enabling meaningful engagement, including:
- a bespoke design for each initiative, underpinned by a clear purpose and principles, and using a combination of tools
- different engagement, consultation and deliberative approaches for different communities with different needs
- consideration of the levels of engagement and participation, as well as what is appropriate for different types of inquiry
- application of shared values in engagement, doing things with – rather than to or for – stakeholders and understanding the impacts
Feedback should be given to communities on the outcomes of engagement activity, including:
- what the results of consultation or engagement are
- actions taken as a result of consultation or engagement
- if no action has been taken, the reasons for this
All engagement and consultation processes must be inclusive and accessible for everyone, including protected groups as defined in the Equality Act 2010, and representative of the police force’s communities. In addition, the views of colleagues in the police force should be sought and heard as a significant element of shaping proposals.
A range of individuals and organisations – including regulators, charities, universities and lobby groups – have published opinions and research papers on issues such as AI and biometrics. These are excellent sources of information on the legal and ethical challenges relating to DDTs. Project leads should take a systematic approach to identifying useful sources. The National Police Library may assist with search criteria and access to academic papers.
Senior leaders should work with the Police Science Council (PSC) to identify partners from academia and industry to rapidly explore, develop and test DDT innovations.
The PSC will help senior leaders to access, interpret and apply the best relevant scientific knowledge from all disciplines.
Legal framework
- Objective: To determine whether there is a legal basis for the development and operation of the proposed DDT.
- Decision maker: Project lead.
- Question to proceed to the next stage: Does the proposed DDT comply with current legislation and regulators’ guidance?
- Advice can be sought from: Relevant internal and external panels, committees and groups – in particular, the designated DPO, force lawyers and equalities advisors.
- Documents to be completed: Data protection impact assessments (DPIA) and EIA.
Senior leaders should, at an early stage of the introduction of DDTs, ensure that the procedures, roles and responsibilities of all relevant parties under the legal framework are identified and understood.
Senior leaders should develop force policies to satisfy the legal points covered by this APP, in particular regarding how the operational use of the DDT in their police force area complies with:
- common law policing duties
- Equality Act 2010
- Human Rights Act 1998
- Data Protection Act 2018 (DPA 2018)
- UK General Data Protection Regulation (UK GDPR)
- Protection of Freedoms Act 2012
Project leads should share the legal bases for using policing powers in relation to DDTs with key stakeholders.
Human rights
Where use of DDTs has the potential to interfere with an individual’s human rights under the Human Rights Act 1998, senior leaders must assess that interference is necessary in the interest of crime prevention or public safety, and proportionate in relation to the intended outcomes. If the same outcomes could be achieved through another, less intrusive means, the use of the DDT would not be considered proportionate.
The articles of most relevance to DDTs are likely to be the following.
- Article 2: Right to life
- Article 3: Prohibition of torture and inhuman or degrading treatment
- Article 8: Right to respect for your private and family life
- Article 9: Freedom of thought, conscience and religion
- Article 10: Freedom of expression
- Article 11: Freedom of assembly and association
- Article 14: Protection from discrimination
Articles 8, 9, 10 and 11 are qualified rights, which would allow police to interfere if necessary and proportionate. Senior leaders should take legal advice when these articles are engaged.
The Centre for Emerging Technology and Security (CETaS) has developed a structured framework for assessing proportionality of privacy intrusion of automated analytics methods, which project leads might find useful.
Data protection
Data protection legislation in the UK provides a framework for handling personal data. Chief constables must ensure that all processing of personal data is carried out in accordance with the UK GDPR and the DPA 2018.
In particular, chief constables must take into account the additional protections in these Acts for what is known as sensitive processing data or special category data. Sensitive processing is defined in section 35(8) of the DPA 2018 and special category data is defined in Article 9 of UK GDPR. Sensitive processing and special category data both include biometric data where used for the purpose of uniquely identifying an individual.
Any processing of special category data, which includes biometric data, must be undertaken in compliance with either the UK GDPR or Part 3 of the DPA 2018, according to whether the processing is general processing or law enforcement processing. The processing of biometric data for law enforcement purposes is only permitted under the UK GDPR where one of several conditions apply. These include:
- consent is provided by the data subject
- for the vital interests of the data subject, where the subject is incapable of giving consent
- for the establishment, exercise or defence of legal claims or if courts are acting in their judicial capacity
- for reasons of public interest in the area of public health
However, extensions and/or exemptions to these conditions may apply. Senior leaders should seek legal advice in these circumstances. Further advice can be obtained from the Data protection APP.
The Data ethics APP provides guidance for senior leaders, DPOs and project leads in relation to ethical considerations when managing data.
Data protection impact assessment
If the data processing involved is likely to result in risks to the rights and freedoms of individuals, project leads should complete a DPIA prior to the development of a DDT. Please refer to the Information Commissioner’s Office (ICO)'s guidance on DPIAs. A DPIA is a process to help identify and minimise the data protection risks of a project. This should be regularly reviewed as the DDT progresses from trial to deployment. A review should also take place if there are significant changes to the aims of the project that are likely to produce impacts or risks that were not originally assessed.
A DPIA must be completed for proposals that involve the use of DDTs by competent authorities. Even where a DPIA is not required by law, senior leaders should take advice from their DPO on the need to carry out a DPIA (or similar force process) for all new data processing. An effective DPIA will allow chief constables to identify and address problems at an early stage. Please refer to the Data protection APP for further details.
When undertaking a DPIA, the ICO recommends that data controllers refer to its Overview of data protection harms and the ICO's taxonomy to help them identify possible harms that may arise from plans that are being considered.
The ICO recommends that DPIAs and data protection policies should be kept under regular review to ensure that they capture the development and use of DDTs.
As well as identifying risks, DPIAs can act as a ‘thinking tool’, helping project leads to remain focused on outcomes and the data that is necessary for that objective. Development of a DPIA should therefore be treated as an important part of project planning.
Artificial intelligence guidance
The ICO has developed guidance on AI and data protection for data controllers when processing personal data that involves AI. Where chief constables are planning to use AI, they should consider ICO recommendations in its Toolkit for organisations considering using data analytics at the outset to recognise risks to rights and freedoms.
For information on what is appropriate in evaluating AI tools and systems, project leads can contact research specialists at the College of Policing, or the Government’s AI Incubator – a central government team that specialises on testing AI, including in a policing context. Further guidance on the adoption of artificial intelligence can be found in the Science and Technology in Policing Covenant for using artificial intelligence (AI) in policing. The College of Policing is developing further guidance on police forces building AI-enabled tools and systems, which is due to be published in summer 2025.
Automated decision making
When developing a DDT that automates decision making, project leads should take the following legislation into account.
- Under sections 49 and 50, Part 3 of the DPA 2018 and Article 22 of UK GDPR, individuals have the right not to be subject to a decision that is based solely on automated processing that has a legal or similarly significant effect on them, unless the conditions set out in the legislation are met.
- Where the processing is for law enforcement purposes, to comply with section 49 of the DPA 2018, the decision must be required or authorised by law and the safeguards set out in section 50 of the DPA 2018 must be met.
- Article 22(1) of the UK GDPR states that the data subject “shall have the right not to be subject to a decision based solely on automated processing”.
Project leads should ensure that appropriate procedures are in place that give consideration to any ambiguity in the quality, reliability or transparency of how data is being processed by automated means. Project leads may use the ICO guidance on AI and data protection to support them with this.
Public sector equality duty
Chief officers must do what is necessary to eliminate unlawful discrimination, harassment, victimisation and any other conduct that is prohibited under section 149 of the Equality Act 2010.
As was established in Bridges v South Wales Police, the public sector equality duty (PSED) also imposes a positive obligation on forces to take all reasonable steps to ensure that their methods are free from unfair discrimination on the grounds of protected characteristics. In the context of DDTs, this includes testing the technology against different demographic groups to ensure it does not contain unfair bias on the grounds of protected characteristics.
Record-keeping, internal scrutiny and review procedures in relation to a DDT must reflect the need to meet the obligations of the PSED.
Ethical context
- Objective: To secure public trust and ensure fairness in the use of the DDTs by ensuring that the proposed case meets ethical standards.
- Decision maker: Project lead, with input from DPO and ethics advisors and panels.
- Question to proceed to the next stage: Have the governing principles in the ethics framework been considered and have satisfactory answers been agreed?
- Advice can be sought from: Local independent data ethics advisory board, legal department, national data ethics board.
- Documents to be completed: Ethics panel documentation (for example, minutes of meetings, decision logs).
DDTs provide new opportunities and the potential for innovation, but this needs to involve responsible and trustworthy use of data. The Data ethics APP provides guidance on responsible use and the governance required to identify and address ethical challenges posed by the use of data and DDTs.
Senior leaders and project leads should seek advice in determining whether the use of a DDT is ethical from local independent data ethics advisory boards and their legal departments.
Procedural fairness
Project leads should consider how procedural fairness can enhance the legitimacy and fairness of DDTs. Project leads should provide individuals affected by the use of the DDT with the following.
- Access to relevant information and data: Individuals affected by decisions that were informed by DDTs should have access to the specific information and data points used in their case.
- The right to explanation and challenge: Affected individuals should have the right to seek an explanation of how the DDT's decision was reached and the right to challenge its accuracy, relevance or fairness.
- Transparency and communication: Project leads should be transparent about the use of DDTs and should communicate this information clearly to those affected. Individuals should be informed when DDTs are used to inform decisions about them, as well as how they can seek additional information or contest those decisions if necessary.
In addition, project leads should safeguard the rights of individuals by ensuring that any processes for accessing information, seeking explanations or challenging decisions are designed to be fair, non-discriminatory and accessible to all.