Police who have stockpiled more than 19 million custody images of people suspected of a crime in England and Wales should "generally" delete data on innocent Brits—but there's a caveat. It is up to one-time suspects to request the removal of photos and videos of them that are stored on the massive database and, in some cases, the authorities have the power to refuse to scrub custody images of innocent people.

However, any active "weeding out" of custody images by police "would not be practical," the home office said in a report released on Friday afternoon.

Five years on from a High Court ruling in 2012, which concluded that the storing of images featuring innocent folk was unlawful, the home office has finally reviewed the procedure for the ballooning and automatically searchable Police National Database (PND)—which allows forces to share information across boundaries.

In its long-awaited review, the home office said that a Brit "not convicted of the offence in relation to which their custody image was taken may apply for it to be deleted."

Amber Rudd's department added:

There should be a presumption that police will remove it from their databases unless retention is necessary for a policing purpose, and there is an exceptional reason for it to be retained. For those under the age of 18 when the image was taken, the review sets out there should be a strong presumption that police will remove it unless there is a highly exceptional reason to retain it.

On top of that, police forces have been told to "automatically review all custody images held after specified periods to ensure they are only retaining those they need to keep—without the need for the individual to apply for them to be deleted." Images of innocent people should "generally" be nixed, it said. Some ex-offenders can also apply to have their custody images deleted.

But getting cops to sift through all the custody images to identify innocent folk "would be extremely lengthy and resource intensive," the home office claimed, adding that it would "cost a very considerable amount of taxpayers' money."

A gaping regulatory hole around the use of facial recognition technology means that the PND isn't currently subject to the same level of scrutiny as police databases holding suspects' DNA and fingerprints.

Critics, however, said that the review didn't go far enough to address the concerns about individuals' privacy.

"Whilst the opportunity for people to have their custody photo deleted from the database is welcome, we believe they shouldn’t have to ask, it should be an automatic process," said Big Brother Watch chief exec Renate Samson.

"The explanation as to why this can’t be done reveals a poorly designed IT system which is impacting innocent people’s right to privacy," she added. "Going forward a system should be created whereby those who are found to be innocent have their images deleted automatically, as is the case with DNA and fingerprints."

Under the Data Protection Act, any Brit can pay £10 to make a so-called subject access request to find out what personal information is held on them within the UK criminal justice system—including the data stored by cop shops. There are exemptions in place, however, which means the police can refuse to release the info in some circumstances—for example, if doing so might jeopardise an ongoing investigation.

As of July 2016, the PND contained 19 million custody images—of which 16 million of them were "enrolled in the facial recognition gallery." Meanwhile, the top reason for carrying out "facial searching" on the database was to apparently aid cops in the "potential for cross-border crime."