A store can erase the biometric template made from your face and still retain a photograph of you. That distinction is central to Facewatch’s published privacy notice: nonmatching biometric data is deleted instantly, while detected face images can remain for seven days.
The photograph, the matching data and a record of an alleged incident are different things. They can have different retention periods, different uses and different organisations responsible for them. A single promise about deletion cannot answer every question about what survives a store visit.
This guide covers Facewatch’s UK retail service and notices checked in November 2026. Those documents describe the companies’ policies. They do not independently verify what happened to a particular shopper’s data.
A photograph and a faceprint do different jobs
A camera records an image. Facial-recognition software extracts features it can compare with a reference image or watchlist. The resulting mathematical representation is often described as a faceprint or biometric template.
The Information Commissioner’s Office explains that biometric features can look like strings of numbers rather than pictures. Both samples and templates can serve as references in recognition systems. Deleting one representation therefore does not tell you whether another still exists.
There is a legal wrinkle here, too. It would be wrong to assume that a photograph can never be biometric data. Classification depends on the technical processing and its identification purpose. The useful distinction for a shopper is between the records and their uses, rather than a comforting label attached to a file.
And instant deletion comes after processing. A nonmatch still means a comparison took place; it does not mean your face was never scanned.
Facewatch’s records have several clocks
The current Facewatch notice sets out these principal periods:
Nonmatching biometric data: deleted instantly.
Detected face images: retained for seven days, allowing incidents to be reported after the event.
Alert analytics: seven days in a secure environment, excluding biometric data.
SOI alert time and location on the platform: 48 hours.
Subject of Interest records: normally up to 12 months after the last recorded incident; two years for weapons or threatened-weapons incidents. Specified juvenile records have a six-month period.
SOI means someone reasonably suspected of unlawful conduct, not necessarily someone convicted in court.
One detail remains unclear. The notice describes immediate deletion of rejected alerts, but elsewhere distinguishes removal from a subscriber’s view from analytics retention. It does not give a sufficiently clear answer about every surviving field after a rejected alert.
Legal claims can also justify longer, periodically reviewed retention. These are several schedules, not one countdown to complete erasure.
The map also separates Facewatch’s system from records controlled by a retailer. An instant nonmatch decision does not establish what a shop has kept in its own security files. Nor does an alert disappearing from a screen establish that every related record has disappeared.
The shop may have its own copy
Squire’s Garden Centres provides a useful concrete example. Its notice distinguishes the retailer’s ordinary CCTV from Facewatch’s separate cameras and recognition infrastructure.
Squire’s says it can access Facewatch camera images for up to seven days to report incidents discovered later. It also describes retaining its own incident-related facial images, records and CCTV footage for up to 31 days, with longer retention possible for investigations, insurance claims or legal requirements.
The division of responsibility matters. Facewatch is described as the controller for biometric matching. Squire’s identifies itself as a separate controller for its CCTV, decisions to upload someone as a Subject of Interest and actions taken in the store.
In practice, that gives a shopper two possible routes for questions. Facewatch can address its recognition records. The retailer can address what its staff reported, what its own cameras recorded and why somebody was approached or asked to leave. One organisation’s answer may not settle the other’s records.
The 31-day period is Squire’s published position, not a rule for every Facewatch customer.
Retailer notices do not all say the same thing
Sainsbury’s public explanation says that if someone is not recognised, their image is deleted instantly. That wording is broader than Facewatch’s distinction between nonmatching biometric data and retained detected images.
Meanwhile, Cherry Lane’s published notice describes keeping Facewatch CCTV images for up to five days. Its own suspected-incident records have a separate twelve-month period.
Different deployments, different uses of the word “image” or outdated wording could explain the differences. The public documents do not establish which explanation applies.
For readers, the useful response is specific: ask which notice governs that store, which record it describes and whether the stated period is current. These discrepancies warrant clarification. They do not, by themselves, prove deliberate deception or establish that every unmatched image at Sainsbury’s remains for seven days.
Why retain anything after a nonmatch?
A suspected theft may be discovered after someone has left. An image buffer gives a retailer time to review what happened and submit an incident. That is a practical reason for retaining photographs even when the matching data is short-lived.
Retailers also cite staff safety. Sainsbury’s describes facial recognition as one measure alongside security staff, barriers and other protections, and says trained colleagues review alerts before action.
Those are relevant safeguards and a serious rationale. They do not establish that every incident report is accurate or every intervention justified. A wrong allegation entered into a watchlist, an incorrect facial match and a staff member approaching the wrong customer are different problems. Asking only whether the algorithm was accurate can miss the decision that actually affected the shopper.
What the ICO’s 2023 decision established
The ICO’s March 2023 closure letter is more qualified than a simple approval badge.
It records earlier findings of data-protection breaches, welcomes remedial steps and concludes that regulatory action was not required on the information supplied at that time. It recommends continuing reviews and says further information or incidents could lead it to revisit the matter. Some details are redacted.
That is a historical regulatory outcome, not certification of every present-day installation, deletion process or staff decision. Travers Smith’s analysis likewise cautions against treating the closure as blanket endorsement.
There has also been a legal change since then. Current ICO guidance on recognised legitimate interests includes qualifying crime-prevention uses without the ordinary balancing test. Necessity, additional conditions for biometric and criminal-offence data, transparency and other obligations still matter. The new basis does not remove every privacy right.
How to ask a more useful privacy question
If you want to understand a scan or challenge an incident, start with the store, date and approximate time. Keep receipts and any correspondence that help identify the visit.
Then separate the questions:
What information do you hold about me? Ask about photographs, biometric templates, alerts, incident reports and relevant CCTV. A subject access request concerns your personal information, rather than every technical document the company possesses.
Where did it come from? If there is an alleged incident, ask what was recorded, which organisation supplied it and who received your information.
How long will each record remain? Ask about the applicable schedule and any investigation or legal reason for longer retention.
What do I want changed? Access, correction, restriction, objection and erasure serve different purposes. Identify an inaccurate allegation or the particular processing you are challenging.
Use the organisations’ verified privacy contacts and keep a copy of your request. ICO access guidance explains why identity checks or further information may be needed. Do not send identity documents to an unverified address.
An objection is not an automatic veto. Depending on the grounds and circumstances, an organisation may justify continuing or rely on an applicable exception. It should explain its response.
Act promptly if relevant footage might be overwritten. But keep the central question precise: which record, held by whom, for what purpose, until when? That gets much closer to an answer than asking whether your “face” has been deleted.
