Hello, Hello, Hello - what’s all this Biometric Data then?

Back in July 2018, the Scottish Government issued a number of proposals related to the “enhanced oversight of biometric data for justice and community safety purposes” in order to seek input in the formation of a definitive code of practice on the use of such data. The consultation closed in October 2018, and in response to the proposals and the consultation the Scottish Government have proposed the Scottish Biometrics Commissioner Bill (the “Bill”) introducing a new role - the Biometrics Commissioner. The holder of the role will be tasked with the supervision of the use of all biometric data, including DNA, facial images, finger-prints, iris recognition and behavioural biometrics in the context of police and criminal justice. John Scott QC, chairman of the committee responsible for putting together the proposals commented:

“Biometric data, including existing technologies relating to fingerprints and DNA, are used to promote public safety in various ways. The new framework will ensure that this is done while taking full account of the rights of the individual, not least the right to privacy and security when it comes to the most personal information about them such as can be derived from biometric data.

“This Bill, along with related work on the new Ethics Advisory Group for Biometrics recommended by the Independent Advisory Group, will help to place Scotland once more in the vanguard of the ethical development of existing and emerging technologies.”

The move brings Scotland in line with England and Wales in having a dedicated position responsible for the oversight of the uses of these sensitive forms of data. The Commissioner will have a range of functions and responsibilities in this area which will primarily include:

1. support and promotion of the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data by Police Scotland and the Scottish Police Authority (SPA); and
2. preparation of and monitoring compliance with a code of practice which will provide information and guidance regarding the standards and responsibilities of Police Scotland and the SPA in the pursuit of lawful, effective and ethical practice.

The Commissioner will also be required to keep under review the law, policy and practice of Police Scotland and the SPA relating to the acquisition, retention, use and destruction of biometric data.

The introduction of this role with its above responsibilities is welcome, but it does also raise a number of issues.

As drafted, the Commissioner’s remit (under section 2 of the Bill) could be extended by the Scottish Ministers to additional persons, but it is unclear what persons or bodies these might be. A number of private sector bodies deliver services either in the area of law enforcement or otherwise involving biometric data, and local authorities may also process biometric data both in the pursuit of public safety but also for a whole host of other reasons. It is questionable therefore whether it was appropriate to initially limit this oversight to just Police Scotland and the SPA, and it will be interesting to follow how the Scottish Ministers elect – or do not elect – to extend the Commissioner’s duties.

The Bill is light on detail in relation to what “lawful, effective and ethical practice” will look like. For instance, will there be an automatic presumption of deletion? There is a clear desire from several special interest groups that ordinary citizens must not be treated like criminals. Outside of statutory retention periods it seems appropriate that the Commissioner should place some emphasis on return or deletion of data in line with principles set out in the General Data Protection Regulation.

Clearly some of these concerns and many other teething issues may be addressed in the code as it is developed and implemented by the Biometric Commissioner; this will be an area to watch for those with an interest in data protection and the public sector.

Article co-authored by the CMS Trainee Solicitor Calum Humphrey.