Police forces in England and Wales have uploaded up to 18 million "mugshots" to a facial recognition database - despite a court ruling it could be unlawful.
They include photos of people never charged, or others cleared of an offence, and were uploaded without Home Office approval, Newsnight has learned.
Photos of "hundreds of thousands" of innocent people may be on the database, an independent commissioner said.
The database complies with the Data Protection Act, police insisted.
Biometrics Commissioner Alastair MacGregor QC said he was concerned about the implications of the system for privacy and civil liberties.
Speaking in his first interview, he told Newsnight that police forces had begun setting up a searchable database of police mugshots last year, without telling either him or the Home Office.
Almost every police force in England and Wales had now supplied photographs, he said.
It comes despite a ruling in 2012, when two people went to the High Court to force the Metropolitan Police to delete their photos from databases.
The judge warned forces should revise their policies in "months, not years".
Met Police Commissioner Sir Bernard Hogan-Howe told the BBC that since the court case, his force had stopped putting images on the national database until the law had been clarified.
"So the broad concern is - are we keeping images of people who aren't convicted, and are we using them?" he said. "I don't think this is against the law but of course we always want to catch criminals."
He added that he would look into the matter.
Mr MacGregor said police had been warned to put rules in place regarding the use of police mugshots - but had not done so.
He said he recognised the potential value of the database to the police, but warned senior officers had rushed in without considering all the implications.
"These are important issues and it does seem to me surprising that they have not been addressed more carefully," he said.
"I think there is always a danger that if you can do something then you will do it, the technology takes over... without giving the attention to the other issues that arise in relation to it as one should."
Mr MacGregor said he also had concerns about the reliability of facial recognition technology.
"If the facial recognition software throws up a false match, one of the consequences of that could easily send an investigation off into the completely wrong direction," he added.
A number of police forces have begun to use facial recognition technology - including the Metropolitan Police and Leicestershire Police.
It is already used by Britain's spy agencies and by Border Force at UK airports and ports.
Leicestershire Police said the facial recognition system it had begun using last year had proved invaluable.
Andy Ramsay, identification manager at Leicestershire Police, told Newsnight the force now had a database with 100,000 custody photos.
He said searches of the database using facial recognition were 100% reliable in cases where there were clear images, and could be completed in seconds.
Mr Ramsay said facial recognition could soon become even more important than DNA or fingerprints for the police.
"All three have a place. This is developing. This is going to be, I think, the most cost-effective way of finding criminals."
Ch Con Mike Barton, of the Association of Chief Police Officers, said forces had to stay up-to-date with new technology.
"Everybody is very keen that the police enter the cyber world," he said.
"I hear much criticism of policing that we're not up to speed and it does come as a surprise to me that we're now being admonished for being ahead of the game."
He added: "If Parliament chooses to... regulate our use of photographs over and above that which we already have, then I'm more than happy."
However, the use of the system has been criticised by some MPs.
Liberal Democrat Cabinet Office minister, David Laws, has written to the Home Office saying he is "alarmed" by the development, Newsnight has learned.
He has demanded urgent action to regulate the use of the database.
"I share the commissioner's concerns that this database will include images of individuals who have never been convicted of a recordable offence," he said.
David Davis, the former Tory shadow home secretary, said that police forces should not "misuse the data in this way".
"There is a mind-set here, which is flawed.
"It's quite understandable, police always want more powers, but I'm afraid the courts and parliament say there are limits," he said.
"You cannot treat innocent people the same way you treat guilty people."
Norman Baker, the Liberal Democrat former Home Office minister, said police "ought to have stopped and asked themselves what they were doing and if it had public support".