However, one of the U.K.’s pioneering deployments of automated facial recognition has been ruled unlawful by an appeals court on three separate grounds: privacy, data protection, and equality.

South Wales Police, which was behind the 2017–18 technological trials, will not appeal against the ruling.

The ruling could have major implications for the guidelines police must follow when using such technology, as the country’s surveillance-camera watchdog has now criticized the government for failing to keep those guidelines up to date.

The case was brought by a civil liberties campaigner named Ed Bridges, whose image was captured at least twice by police cameras in the Welsh capital, Cardiff—once when he was shopping for Christmas presents in 2017, and once when attending a protest outside an arms fair in 2018.

With backing from the civil liberties group Liberty, Bridges complained to the High Court about violations of his rights. He lost in September 2019, but won his appeal on Tuesday.

The automated facial recognition (AFR) system involved in the case is known as AFR Locate. It captures images of people’s faces and compares them with a watchlist, then throws away the images if there is no match. The watchlist includes people for whom there is an outstanding arrest warrant, people suspected of committing crimes, vulnerable people, and so on.

On Tuesday, the Court of Appeal upheld three of the five grounds for Bridges’ appeal.

Human rights

The first was about the privacy rights in Article 8 of the European Convention on Human Rights. To comply with this rule, public authorities can only interfere with someone’s privacy if they have sufficient backing from their country’s laws in doing so, and if it’s necessary for reasons such as national security or the prevention of crime.

The court said there was “no clear guidance on where AFR Locate could be used and who could be put on a watchlist,” so it upheld this part of Bridges’ appeal.

The failure of South Wales Police to comply with Article 8 also meant the police force failed to conduct a proper data-protection impact assessment before deploying the system; its impact assessment assumed the force wasn’t infringing on people’s privacy rights, which made it inadequate.

The third successful part of Bridges’ appeal was about the question of bias.

It is by now well known in tech and policy circles that the artificial intelligence algorithms underpinning facial recognition systems are often inherently biased, because they are more likely to incorrectly identify women and dark-skinned people. The racial-profiling implications are so severe that IBM pulled out of the facial-recognition space a couple of months back.

Under the U.K.’s Equality Act of 2010, public authorities are supposed to consider the potentially discriminatory implications of their policies. According to the court, South Wales Police “erred by not taking reasonable steps to make enquiries about whether the AFR Locate software had bias on racial or sex grounds.”

‘Major victory’

Bridges tweeted that he was “incredibly, ecstatically pleased” by the ruling.

Liberty, the group that supported him in the case, said in a statement that the ruling was “a major victory in the fight against discriminatory and oppressive facial recognition,” and called for the technology to be banned.

“The Court has agreed that this dystopian surveillance tool violates our rights and threatens our liberties,” said Liberty lawyer Megan Goulding in a statement. “Facial recognition discriminates against people of color, and it is absolutely right that the Court found that South Wales Police had failed in their duty to investigate and avoid discrimination.”

It should be noted that the court did not say there was any evidence that the system was discriminatory—it just said the police force failed to check whether it was or not. Separately, London’s Metropolitan Police claimed earlier this year that the algorithms it uses only generate false positives 0.1% of the time, but news reports have suggested inaccuracy rates as high as 81%.

South Wales Police said it would not appeal against Tuesday’s ruling. Indeed, chief constable Matt Jukes described it as “a judgment that we can work with.”

“Our policies have already evolved since the trials in 2017 and 2018 were considered by the courts, and we are now in discussions with the Home Office and surveillance camera commissioner about the further adjustments we should make and any other interventions that are required,” Jukes said.

The chief constable, who said the use of automated facial recognition had resulted in 61 arrests so far, singled out the bias issue as one his force was working particularly hard to address.

“In 2019 we commissioned academic analysis of this question, and although the current pandemic has disrupted its progress, this work has restarted and will inform our response to the Court of Appeal’s conclusions,” Jukes said.

‘Asleep on watch’

Tony Porter, the U.K.’s surveillance camera commissioner, responded to the ruling with an attack on the Home Office, the government department responsible for overseeing police activity.

Porter said he had been trying “fruitlessly” to get the Home Office to update its code of practice around facial recognition’s use by the authorities. He accused the department of being “asleep on watch” and called on it to act in the public interest and update those guidelines.

“I do not believe the judgment is fatal to the use of this technology, indeed, I believe adoption of new and advancing technologies is an important element of keeping citizens safe. It does however set clear parameters as to use, regulation, and legal oversight,” Porter said.

“Maybe the regulators at the sharp end of this subject matter really do understand things a little more than those advising ministers sometimes purport to.”

Fortune has asked the Home Office for a response to Porter’s criticism, but has received no reply at the time of writing.