Police forces are pushing ahead with the use of facial recognition systems in the absence of clear laws on whether, when or how the technology should be employed, a watchdog has said.

Prof Paul Wiles, the biometrics commissioner, said in his annual report that police deployment of the technology, which can be used to scan crowds or CCTV recordings for people of interest, was chaotic and had run ahead of laws that could prevent its misuse.

With no legal framework in place it was left to the police to decide when the public benefit outweighed the “significant intrusion into an individual’s privacy” arising from facial recognition and other types of biometric identification, the report said.

It said guidance from the National Police Chiefs’ Council would help, but it noted that the Met commissioner, Cressida Dick, said last year that the police should never be the ones to judge where the balance should lie between security and privacy.

Wiles told the Guardian: “When you are deciding what’s in the public interest, you are deciding what kind of world you want to live in. That is a rather important decision and if that isn’t for government then I don’t know what government is for.”

The Metropolitan and South Wales police forces have both run trials of live facial recognition systems, which use mobile video cameras hooked up to facial recognition software to scan crowds for faces on a watchlist. The trials were conducted at football and rugby matches, music festivals and on city streets.

The report said the police were right to want to explore new technologies and that trials would help to determine whether claims of a public benefit stood up. But Wiles was critical of the police trials so far.

He said trials were meant to be for assessing a technology before it was used operationally, but the police had blurred the line by questioning and in some cases arresting individuals their cameras spotted. The police also neglected to set out what counted as success before the trials began, he said.

“The trials have not, in my view, been properly scientifically carried out,” Wiles said.

Beyond the effectiveness of the technology, there are questions about what is done with facial images that are scanned, how long they are kept for and whether the police intend to capture fresh images during surveillance.

Last month the campaign group Liberty brought a landmark legal case against South Wales police after a Cardiff resident, Ed Bridges, claimed the force had invaded his privacy by capturing and processing his facial features.

Wiles’s report anticipated more cases to come. “Actual deployment of new biometric technologies may lead to more legal challenges unless parliament provides a clear, specific legal framework for the police use of new biometrics as they did in the case of DNA and fingerprints,” he said.

A Cardiff University review of the South Wales police trials found that the system flagged up 2,900 possible suspects, but 2,755 were false matches.

While the police had only used the system to find people for questioning, the technology could still affect innocent people’s lives, Wiles said. “There is a risk of wrongful arrest. What people have to remember is that if they’re arrested and then checks show it’s not them, the arrest stays on the police system. If they later need to get clearance, to teach children for example, that arrest will show up.”

Hannah Couchman, of Liberty, said: “It’s absolutely right that the rollout of facial recognition by individual forces has been chaotic and lawless. Invasive facial recognition goes light years beyond traditional CCTV. It snatches our unique personal data, violates our privacy and pressures us to self-police where we go and who we go with.

“The technology also discriminates. It’s more likely to misidentify people of colour and women and subject them to a police stop due to a false match. This technology has no place on the streets of any rights-respecting democracy.”

The annual report also took issue with the Ministry of Defence over its searches of the police national fingerprint database. Military police are allowed to use the database to check fingerprints found in operations abroad, but the MoD searches are carried out by DSTL, the ministry’s research and development arm, which is not a law enforcement agency.

“It is effectively getting round what parliament intended and this is a department of state, this isn’t Cambridge Analytica,” Wiles said. The MoD did not respond to a request for comment.

A Home Office spokesperson said: “We support police use of biometrics and other new technologies to help protect the public and bring criminals to justice, but it is essential that they do so to high standards and maintain public trust.

“We welcome the biometrics commissioner’s annual report on the work he has done over the last year to promote compliance with the rules on the use of fingerprints and DNA, which we have published in full. The Home Office has established a new board to oversee the police use of facial images and other new biometrics, and the minister for policing and fire will shortly provide an update on options to simplify and extend biometrics governance, aimed at maintaining the right balance between public protection and privacy.”