Biometric databases make a significant contribution to the prevention and prosecution of crime. However, DNA and fingerprint database samples need to be held in conformity with an overarching legal framework that regulates the inclusion, use and retention, of biometric material and data, held in accordance with overarching human rights obligations. Furthermore, those responsible for maintaining biometric databases must offer a meaningful process for review. In order to meet the requirements for regulation and review, the three legal jurisdictions of the UK have created (or are creating) biometric commissioners to oversee the retention of samples. These commissioners are intended to provide a legal safeguard, ensuring retention and use of biometric data, in compliance with the ECHR. However, research has revealed a population of data subjects that falls outwith the protective measures envisaged by domestic retention frameworks. This class of suspects, composed of individuals from Scotland and Northern Ireland, whose DNA and fingerprints are copied to the UK databases, numbers in excess of one million persons: a substantial population whose data is retained unlawfully, in breach of the clear protections guaranteed by art.8 of the ECHR, and the stipulations laid down by the European Court of Human Rights in a series of cases. This article explores the regulatory lacuna, which has given rise to widespread retention absent of legal oversight and review. It goes on to consider the implications of unlawful retention and concludes by positing a solution that may re-establish the balance between a citizen's art.8 rights, and the public interest in preventing and prosecuting crime, whilst safeguarding national security.