The "rapid" growth of a police facial recognition database could lead to innocent people being unfairly targeted, a watchdog has warned.
Biometrics Commissioner Paul Wiles said the Police National Database (PND) now had at least 19 million custody photographs on it.
But it is thought that hundreds of thousands are of innocent people.
The Home Office said police should delete images of unconvicted people if asked to do so.
Prof Wiles said that police have taken "mug shots" of people upon arresting them since Victorian times, but technical developments today - which allow digital pictures to be uploaded to a searchable national database - have moved "much faster" than the legislation.
Pictures of people who are entitled to the presumption of innocence - that is those who have not been convicted - are being kept on a national file for up to six years, he said.
He told BBC Radio 4's Today programme: "I think it's very worrying because if we're not careful the public will lose confidence in the police."
In a government review published in February, the Home Office concluded that those who are not convicted have the right to request that their custody image is deleted from all police databases.
A High Court ruling in 2012 said retaining the custody images of unconvicted people amounted to a breach of human rights.
The PND contains custody images, taken at police stations after someone is arrested.
Of these, more than 16 million have been enrolled in a gallery which can be searched using facial recognition software, including pictures of individuals who are released without charge or later cleared.
Prof Wiles told the BBC that new biometrics - such as voice and facial recognition - can be "equally useful" to the police as DNA and fingerprinting, adding that the police "are quite right to be experimenting with this".
But he warned that there was a "legislative deficit" around them which needs to be addressed first.
He pointed out in his annual report that facial imaging was also being used in public places, including to check Notting Hill carnival-goers against a watch list.
"The use of facial images by the police has gone far beyond using them for custody purposes," he said.
Prof Wiles, who has held the post since last year, warned wrongful allegations could occur from the "very rapid growth" of the database.
Currently, different forces use their own systems to upload images to the central database, with "varying degrees of image quality", the report said.
"This situation could easily produce differential decision making and potentially runs the risk of false intelligence or wrongful allegations," it added.
Prof Wiles, whose job is to scrutinise how police and other authorities retain information including DNA samples, profiles and fingerprints, said hundreds of thousands of innocent people were on the PND.
This is because they were later released or cleared in court, but never deleted from the database.
But Prof Wiles pointed out that police have the discretion to refuse such a request and warned that the "complex" proposals could result in a "postcode lottery".
He said: "I have said that to the government [that] I think what they've put in place is a much more complicated process - that would be much simpler if deletion was simply automatic."
Renate Samson, chief executive of Big Brother Watch, welcomed the watchdog's warnings, saying: "It is of very serious concern that the Home Office appear to be so unwaveringly set on embedding facial biometric recognition technology into policing without debate, regulation, legislation or independent scrutiny."