Scottish Justice Committee wants extra powers for biometrics commissioner

The Scottish Parliament’s Justice Committee has backed the general principles of a bill that would create a dedicated biometrics commissioner for Scotland, but is calling for stronger provisions to grant the new commissioner greater enforcement powers.

Under the proposed Scottish Biometrics Commissioner Bill, the new commissioner would look after all personal biometric information – including physical, biological or behavioural identifiers – and maintain oversight of biometric policing techniques.

This includes finger printing and DNA profiling, as well as newer, “second-generation” biometric methods such as automatic facial recognition and voice analysis, something which the UK biometrics commissioner has no explicit remit to cover.

The bill would also establish a statutory Code of Practice for the use of biometric data by Scottish police, which the commissioner must prepare and “periodically revise”.

The Information Commissioner’s Office (ICO) – which has separate offices in England, Wales, Scotland and Northern Ireland – called for a statutory code of practice in November 2019 to govern how UK police deploy facial-recognition technology.

It said that the absence of a statutory code or national guidelines contributes to inconsistent practice, increases the risk of compliance failures, and damages public confidence in the technology.

“As technology advances at lightening pace and ever more information becomes available to the police, the need for this commissioner to ensure that public and human rights concerns are kept to the fore becomes more pressing,” said justice committee convener Margaret Mitchell MSP.

“While members welcome the creation of a biometrics commissioner, the committee has identified some important areas where the legislation needs to be strengthened.

“To ensure the commissioner has the necessary teeth and oversight to protect privacy effectively, the committee wants to see stronger enforcement powers and other policing bodies added to commissioner’s remit before their office is created.”

As the lead committee scrutinizing the bill, which was introduced by cabinet secretary for justice Humza Yousaf MSP at the end of May 2019, the Justice Committee published a report on 9 December to inform the Scottish Parliament on its general principles.

“The committee views the establishment of an independent Scottish biometrics commissioner as both timely and necessary,” said the report, adding that “public confidence and trust in the use of biometrics by the police and criminal justice system is essential”.

However, the committee made clear that any new biometrics commissioner must have enough power to deal with any compliance issues that should arise.

As it stands, the bill would only provide the commissioner with two powers: the power to request information on the use of biometrics, and the power to make recommendations in terms of the Code of Practice.

“In light of the evidence received, the committee believes that the enforcement powers provided to the Commissioner in the Bill are insufficient as currently drafted,” said the report.

It points out that UK biometrics commissioner Paul Wiles has the ability to “name and shame” any of England and Wales’s 43 police forces so that, in effect, compliance is ensured by benchmarking them against one another for good and poor practice.

“As there is only one police force in Scotland, this will not be an option open to the Scottish biometrics commissioner under the Code of Practice. The commissioner should have the powers to enforce any compliance which may be needed, as circumstances dictate,” it said, adding that a lack of these powers could significantly undermine public trust in the use of biometric technologies.

The committee also voiced support for flexibility in the commissioner’s role, so that they can adapt to, and provide oversight for, the use of new and developing biometric technologies that police may start using in the future.

On top of this, it is calling for oversight of all biometric data used and held by other policing bodies operating in Scotland, such as the British Transport Police and the National Crime Agency.

Giving oral evidence to the Committee on 24 September 2019, Wiles said that further consideration is needed over whether the Scottish commissioner’s oversight functions should extend to law enforcement entities that operate in Scotland and across the UK.

“Samples that have been taken in Scotland should, in my view, be subject to the legislation that is in place here”

“When the British Transport Police in Scotland arrests someone and takes biometrics, it uses Police Scotland to take them, but then ships the biometrics down to London. That is an issue, because those biometrics are currently kept according to England and Wales legislation,” said Wiles.

“If a commissioner is appointed, that is perhaps something that they will need to take up. Samples that have been taken in Scotland should, in my view, be subject to the legislation that is in place here.”

As the bill stands, the commissioner would only have oversight of Police Scotland and the Scottish Police Authority.

In his 2019 annual report, Wiles noted the lack of a legislative framework and clear laws governing the development of biometric databases in the UK as a whole.

“There is nothing inherently wrong with hosting a number of databases on a common data platform with logical separation to control and audit access, but unless the governance rules underlying these separations are developed soon then there are clear risks of abuse,” he said.

The UK biometrics strategy was launched by the Home Office in 2018, but has been criticised for not providing a detailed and coherent strategy or governance framework.

However, in response to the criticisms, the UK’s immigration minister Caroline Nokes told Westminster Parliament that the Home Office was reviewing “other measures that can be taken to improve governance and use of biometrics in advance of possible legislation”.

Stage one scrutiny of the Scottish bill is due to end on 10 January 2020, after which the general principles will be debated and decided on by the Scottish Parliament. A Parliamentary committee will then consider the bill in detail at stage two, before voting to pass or reject it at stage three.

The stated purpose of the bill is “to address a range of ethical and human rights considerations in Scotland relating to the collection, use, retention and disposal of biometric data in the context of policing and criminal justice”.