According to an official investigation, photos of people who were arrested but had no criminal charges are still kept in a police database that might be used for facial recognition.

The high court declared in 2012 that it was illegal to retain photos of people who were either charged and later found not guilty or who were not prosecuted.

All UK police forces and a few other law enforcement organisations have access to the Police national database, which still has custodial photos of innocent persons in spite of the verdict. Potential suspects can have their faces recognised using the photos.

The annual report of the ­biometrics and surveillance camera commissioner stated: “Forces continue to retain and use images of people who, while having been arrested, have never subsequently been charged or summonsed.

“The use of these custody images of unconvicted individuals may include for facial recognition purposes.” The report said work was “under way” to ensure the retention of images was proportionate and lawful.

Charlie Whelton, policy and campaigns officer at Liberty, said: “It is deeply concerning that people who have never been charged with a crime are finding their sensitive biometric data not only unlawfully retained by police, but used to fuel the unregulated and deeply invasive use of facial recognition technology as well.

“The police need to answer as to why they are still holding this highly personal data more than 10 years after the courts said this is against the law. This is even more concerning as police forge ahead with dangerous facial recognition technology that makes our photos as sensitive as our fingerprints.” He called on parliament to “urgently act to regulate the use of this technology”.

In 2012, it was revealed that police might be compelled to delete custody images of innocent individuals after the High Court found the Metropolitan Police had violated the human rights of a woman and a boy by retaining their photographs following their arrests.

Despite the ruling, police forces failed to comply, and a government review in 2017 revealed over 19 million custody images were stored in the database, with more than 16 million accessible through a searchable facial recognition gallery.

The review recommended that individuals not convicted of crimes should be able to request the deletion of their images. However, campaigners are calling for stricter regulations to prevent such images from being included in facial recognition databases.

In Scotland, custody images are uploaded to the Police National Database only if an individual has been charged. Police Scotland also regularly reviews and deletes images not linked to ongoing prosecutions or convictions.

The previous government encouraged police forces to expand the use of facial recognition technology with the national database. However, Big Brother Watch, a civil liberties group, criticized the practice, labeling it as “dangerously authoritarian surveillance.”

Jake Hurfurt, head of research and investigations at Big Brother Watch, said: “Police and the Home Office have no idea how many people’s photographs they hold unlawfully, and more than a decade after the high court demanded these be deleted, look to have made next to no effort to comply with the law.

“Removing these images is not impossible, as Police Scotland have shown, and other forces must do the same rather than remain complicit in a decade-old breach of privacy rights on an industrial scale. Facial recognition searches must not be conducted against images that are held outside of the law.”

A Home Office spokesperson said: “Rules for the retention of custody images are set by the police. We continually work with police and key stakeholders to ensure best practice is maintained.

“If individuals who have not been convicted want their images deleted they can request this.”