Millions of photos of innocent people in England, Wales and Northern Ireland are being stored "illegally" in a giant police database, MPs have been told.
Lib Dem MP Norman Lamb said suspects who had been released without charge were not aware they could ask for their mugshots to be destroyed.
The National Police Database has 12.5 million "searchable images" on it, according to the Home Office.
A Home Office minister said safeguards existed to ensure images were deleted.
Despite a high court ruling in 2012 that it was unlawful, police forces continued to build up an image database, without the privacy safeguards that apply to DNA or fingerprint databases,
The database can be searched using facial recognition technology.
In March 2017, ministers announced that someone who was not convicted of the offence in relation to which their image was taken had the right to request deletion from all police databases.
The custody image review said police should comply with deletion requests unless they were from people regarded as a danger to the public or some other "exceptional reason".
In the case of children under 18 chief constables have to have a "highly exceptional reason" to refuse deletion.
Home Office minister Baroness Williams said the government was complying with the law and there was "no evidence" the new procedures were not working well.
"The rules are very clear if someone is not convicted of an offence, they have the right to request that their custody image is removed from all police databases," she told the Commons science committee
However, that did not mean the images would "necessarily" be deleted because the technology did not exist to automatically erase them once criminal proceedings had ended, she said.
But she insisted there were other safeguards in place, with the decision to retain images having to be signed off by a senior officer in the relevant force and the decision to retain being reviewed every six or ten years depending on the nature of the offence.
The police, she added, should treat each case on its merits with regard to public safety issues.
But Norman Lamb, the ex-Lib Dem minister who chairs the committee, said he did not understand why images should be kept once a case was dropped or when someone was found not guilty of an offence.
"I'm told that routinely images are kept still and it would require a citizen to make a request for it to be deleted," he said. "That amounts, surely, to an unlawful policy.
"If the vast majority of people do not know of their right to request, actually images continue to be retained and it seems to me under the 2012 case law to be unlawful."
Conservative MP Vicky Ford, who is also a member of the committee, said it was clear the police could only respond to an individual request and there was no contradiction in what ministers were saying.
But Labour MP Graham Stringer questioned why DNA and fingerprint samples were capable of being destroyed if someone was not charged with an offence and yet custody images were still retained.
"They are two different systems," Baroness Williams replied.
A Home Office report last year found all but nine forces uploaded custody images to the database and about 50 agencies searched it, including forces in Northern Ireland, Scotland, England and Wales and organisations such as the Ministry of Defence and the National Crime Agency.
In Scotland, custody photographs are not uploaded to the system unless an individual is charged with a crime.
And the image is deleted from the Criminal History System within six months of an investigation concluding, if there is no conviction.