The use of automatic facial recognition (AFR) technology by South Wales Police is unlawful, the Court of Appeal has ruled.
It follows a legal challenge brought by civil rights group Liberty and Ed Bridges, 37, from Cardiff.
Mr Bridges said being identified by AFR had caused him distress.
The court upheld three of the five points raised but also found its use was proportionate interference with human rights.
The ruling said there was no clear guidance on where AFR Locate could be used, and who could be put on a watchlist.
It said as a result a data protection impact assessment was deficient and the force did not take reasonable steps to find out if the software had a racial or gender bias.