The opportunity, and where the risk sits
The case for action is real. The Metropolitan Police’s town-centre facial recognition trial in Croydon (October 2025 to March 2026) reported 173 arrests and a 10.5% fall in crime. [Verify figures and add source link before launch.] BIDs and Business Crime Reduction Partnerships are increasingly sharing offender intelligence among their members.
That sharing is exactly where the legal risk builds up. A watchlist shared across dozens of businesses raises data protection questions before it raises security ones. Who decides who goes on it? On what evidence? For how long? Who is responsible when someone is wrongly included, and how do they get themselves removed?
“A shared watchlist is a data protection question long before it is a security one.”
How we help
- A partnership-level DPIA that covers the scheme as a whole, not each member separately
- Clear roles and agreements. Controller and joint controller mapping, information-sharing agreements and member terms
- The right legal conditions for crime data, which carries its own rules under Article 10 UK GDPR and the Data Protection Act 2018
- Watchlist governance. Evidence thresholds, review dates, removal and audit, based on our Subjects of Interest taxonomy
- Proportionality. Who is scanned, where, when and why, decided deliberately and recorded
- Redress. A clear, accessible route for anyone who believes they have been wrongly listed
- Member onboarding and training, so that fifty businesses follow one standard
- An outsourced DPO for the partnership itself
We act as the bridge between a BID’s legitimate wish to make its streets safer and the rights of everyone who walks them.
