Cases › operational mistake › LR-2026-0327
Facial recognition watchlist error leads to wrongful shoplifting accusation at a Cardiff retail park
Preliminary Why: 1 report: BBC · subject to change · 1 independent report
Status: fix reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: Test: data of others touched with a bounded scope stated. The source states one individual's data was deleted after the retailer informed the company.
A B&M store at Cardiff Bay Retail Park used the Facewatch facial recognition system, which matches faces entering a premises against known offenders and sends an alert to staff to review. Byron Long, 66, was added to a watchlist and told to leave the store, accused of stealing £75 of goods on a previous visit. The accusation was wrong. Facewatch said the case was human error and not a failure of the technology, and B&M also called it human error. The accusation was overturned when a review of CCTV footage showed Mr Long had paid for his shopping and taken nothing. B&M apologised and offered a £25 voucher, which Mr Long rejected. Big Brother Watch made a complaint to the Information Commissioner's Office on his behalf, and B&M confirmed his data had been removed. Mr Long said his mental health worsened after the incident.
What happened
What was done
“Mr Long's data removed”
Same developer, same risk, after the fix: LR-2026-0560 · LR-2026-0432
Risks
Primary63 incidents
Rising: 5 vs 2.2 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessTool allow-list · Fail-closed defaults · Stop control
ApplicationHuman approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment
Infrastructure / targetSimilar incidents
Evidence
No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 5 items from the primary sources
What happened, in order
- 29 April Incident at the B&M store at Cardiff Bay Retail Park, after which Mr Long was told to leave.
Not dated in the sources:
- Mr Long was accused of stealing £75 of goods on a previous visit to the store.
- After the retailer informed Facewatch, the individual's data was deleted.
- B&M confirmed Mr Long's data had been removed.
- Big Brother Watch made a formal complaint to the Information Commissioner's Office on Mr Long's behalf.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
Facewatch's claim that its system worked as it should is reported as the company's position, not verified. Mr Long's CCTV was due to be deleted in three days, which was not stated as a fact about the retailer's policy beyond his account.
LR-2026-0327 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON