The Home Office has been told it "urgently" needs to deliver guidance for the next generation of policing technologies.
The police use of biometric technologies is "running ahead of the law", according to an independent commissioner.
Biometrics are any measurable biological feature which can be used to identity individuals, including the shape of people's fingerprints and the code of their DNA.
Scientific advancements mean that computers can now also differentiate the unique qualities in people's voices, their irises, their faces and even their gait.
There is a "worrying vacuum" of regulation covering how police are using new technologies to identify members of the public, biometrics commissioner Professor Paul Wiles has warned.
There is currently no legal guidance covering the police use of automated facial recognition to identify people in crowds and from CCTV footage, despite fears that this amounts to illegal mass surveillance.
The activities "urgently" need a legislative framework, says Professor Wiles, noting a four-year delay (by some measures five years) in the Home Office delivering guidance.
"Technical development and deployment is running ahead of legislation, which is why the Home Office's promised biometric strategy is urgently needed," Professor Wiles said.
A spokesperson for the Home Office said the department is committed to publishing its biometrics strategy this month.
Home Secretary Sajid Javid published the commissioner's annual report for 2017 today.
It states that although police are "largely compliant" with the laws governing the retention of DNA and fingerprints, the quality of this legislation is lacking.
There have been a number of scandals which have hit police handling of forensic evidence, although these fall within the remit of the forensics commissioner.
In 2012, the government was told by the High Court that it was illegal to permanently hold on to the facial images of Britons who had never been charged or convicted of a crime.
Despite this, there are millions of custody images on the Police National Database, hundreds of thousands of which are of innocent people.
The commissioner also warned about the Ministry of Defence searching through the police fingerprint database, as they are not regulated by the Protection of Freedoms Act which guarantees people's rights once their biometric details are taken.
This has "wider implications when considered against the background of the Home Office Biometrics Programme (HOB)", which will soon offer new databases which the government will use to centralise the data it holds on the public.
The commissioner also warned that his department, which should normally have three people to assist him with casework functions and inspections, has never been fully staffed - up until the last few weeks.
He warned that because of his priority in producing the report for the home secretary, he had been unable to investigate whether police were storing biometrics appropriately and look into new, emerging problems.
Part of the investigations he was unable to carry out involve checking whether police were manipulating IT systems to illegally store biometric details when they should be automatically deleted.
In the 2015 report of the previous commissioner, Alastair MacGregor QC, police were found to be breaking the law so they could hold on to suspects' details for longer than they were legally allowed
Renate Samson, data and privacy consultant, told Sky News: "Biometrics are beginning to play an integral role in our day to day lives, as a method of keeping our identity and data secure and as a way of law enforcement picking us out of a crowd.
"The move towards biometrics being used as a social norm is happening rapidly, but Professor Wiles' report highlights yet again that the government's failure to publish a biometric strategy has enabled use of new technologies such as facial biometrics by law enforcement has been allowed to proceed for years without the necessary laws, transparency and oversight in place.
"As we become increasingly digital citizens by default the attitudes towards security of our identity, particularly our biometric identity, must be paramount."