Appendix C: Detail on the legislative and Regulatory Framework in Scotland

Human Rights Act 1998

The Human Rights Act 1998 incorporates into UK law the rights contained in the European Convention on Human Rights. 

The use of LFR will invariably engage Article 8 of the Convention (the right to respect for private and family life). 

Article 8 provides:

1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Article 8 is what is known as a “qualified” right, which means that public authorities may lawfully interfere with the right if certain conditions are satisfied. These conditions are as follows:

• The interference must be “in accordance with the law” i.e. it must have some basis in domestic law. The provision in domestic law must be accessible (i.e. published), sufficiently clear, and its effect must be reasonably predictable.
• The interference must pursue a legitimate aim, such as public safety, the prevention of disorder or crime, or the protection of the rights and freedoms of others.
• The interference must be “necessary in a democratic society”, meaning -
• that there must be some “pressing social need” for the interference: is the need sufficiently important to justify limitation of a fundamental right?
• that the intrusion into fundamental rights must be proportionate to achieving the legitimate aim: any interference must not go beyond what is considered necessary to achieve the aim.

The use of LFR may also engage other Convention rights such as Article 2 (the right to life); Article 10 (freedom of expression); and Article 11 (freedom of assembly and association).

Article 2(1) provides that everyone’s right to life shall be protected by law.  This includes a positive obligation on the state to take reasonable steps to protect individuals where there is a real and immediate threat to life.  In the context of LFR, such an obligation may arise where e.g. a person identified is known to pose a real and immediate threat to the lives of those in the vicinity.

Article 10, another qualified right, provides that everyone has the right to freedom of expression.  Article 10 rights may be subject to restrictions which are prescribed by law and are necessary in a democratic society, in the interests of e.g. national security, prevention of disorder or crime and for the protection of the rights of others. 

Article 11, also a qualified right, provides that everyone has the right to freedom of peaceful assembly and to freedom of association with others.  Any restrictions on Article 11 rights must be prescribed by law and necessary in a democratic society, in the interests of e.g. national security or public safety, for the prevention of disorder or crime, or the protection of the rights and freedoms of others.  Article 11 does not prevent the police from imposing lawful restrictions on exercise of these rights.

Articles 10 and 11 may be engaged where e.g. LFR is to be used in policing an assembly or demonstration where there is considered to be a risk to public safety from specific individuals.

Equality Act 2010

Under section 149 of the Equality Act 2010 public authorities (including Police Scotland) must have due regard to the need to:

• eliminate discrimination, harassment, victimisation and any other conduct prohibited by the Act;
• advance equality of opportunity between persons who share a relevant protected characteristic and persons who do not share it; and
• foster good relations between persons who share a relevant protected characteristic and the persons who do not share it.

This is known as the Public Sector Equality Duty (PSED).

In the context of LFR, concerns have been expressed that some facial recognition software can give rise to a greater risk of false identifications among those from black, Asian and other minority ethnic backgrounds, and also women.

Accordingly, before using LFR, a public authority will need to satisfy itself that the particular software does not have a material bias in relation to race or sex. 

Data Protection Act 2018

There are additional requirements for data protection that must be considered in the use of LFR. Part 3 of the Data Protection Act 2018 sets out the data processing requirements for law enforcement purposes (meaning for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security).

LFR collects biometric data. Biometric data relates to: “personal data resulting from specific technical processing [1] relating to the physical, physiological or behavioural characteristics of a natural person [2], which allow or confirm someone’s unique identification of that natural person, such as facial images or dactyloscopic [fingerprint] data [3].”

Processing of biometric data requires additional conditions to be met, as this is considered to be sensitive processing. Sensitive processing must only be completed in “strictly necessary” circumstances or where the data subject consents. “Strictly necessary” requires robust justification for the processing of this information. According to guidance from the Information Commissioner’s Office, this means that consideration should be given to:

• ensure that the processing of sensitive information is specific in nature and dependent on the specified law enforcement purpose;
• clearly demonstrate why there are reasonably no less intrusive means of achieving the same purpose; and
• clearly demonstrate how such processing will be effective in meeting the specified law enforcement purposes.

Schedule 8 of the Act has the following provisions sensitive processing:

• Judicial and statutory purposes ‑ for reasons of substantial public interest
• Administration of justice
• Protecting the vital interests of the data subject or another individual
• Safeguarding of children and of individuals at risk
• Personal data already in the public domain (manifestly made public)
• Legal claims
• When a court acts in its judicial capacity
• The purpose of preventing fraud
• Archiving, research or statistical purposes

Data (Use and Access) Bill

The Data (Use and Access) Bill, introduced to the House of Lords in October 2024, includes provisions related to AI and is applicable in Scotland. Specifically, the Bill addresses automated decision-making systems which often use AI. Under this Bill, automated decision making is generally permitted, provided safeguards are implemented. The safeguards must allow individuals affected by such decisions to make representations, obtain meaningful human intervention and challenge solely automated decisions.

This is likely most relevant in areas similar to Automatic Number Plate Recognition, where there is the potential for this to be expanded to check if drivers are using phones or are distracted, for example. There would most likely need to be a human check of the image before a fixed penalty notice is sent.

At time of writing, the Bill is at the Committee Stage in the House of Parliament.

Bridges v Chief Constable of South Wales Police

In August 2020, the Court of Appeal in England and Wales ruled that the use of LFR by South Wales Police (SWP) was unlawful. The judgment overturned an earlier decision by the High Court in which the use of the technology had been considered lawful. 

Below is a summary of the key points in the Court of Appeal’s judgment.

• The use of LFR breached Article 8 of the Convention because the interference was not in accordance with the law. Specifically, SWP’s policies were not sufficiently clear on who might be placed on the watchlist, or on the criteria for deciding where LFRR can be deployed.  The court considered that a crucial part of the legal framework was the instantaneous and automatic deletion of images that do not match images on the watchlist.  However, the policies did not make clear that this feature of the software was essential.
• The High Court did not make an error in deciding that SWP’s use of LFR on the occasions in question was a proportionate interference with Article 8 rights. The High Court found that SWP had used LFR in an open and transparent way, for a limited time, and for a specific and limited purpose. In the High Court’s view, neither of the LFR deployments it considered had resulted in a disproportionate interference with Article 8 rights. 
• SWP had not taken reasonable steps to satisfy the PSED. Specifically, SWP had never sought to satisfy itself that the particular software did not have an unacceptable bias in relation to race or sex. While no evidence was presented to the court that the software used by SWP had these deficiencies, the court referred to evidence that some LFR software can have such a bias. 

Scottish Biometrics Commissioner Code of Practice

The Scottish Biometric Commissioner’s Code of Practice also sets out guiding principles on the use of biometric data. Referencing the Scottish Biometrics Commissioner Act 2020, biometric data is defined as:

“… information about an individual’s physical, biological, physiological, or behavioural characteristics which is capable of being used, on its own or in combination with other information (whether or not biometric data), to establish the identity of an individual.

For the purposes of subsection (1), “biometric data” may include:

1. Physical data comprising or derived from a print or impression of or taken from an individual’s body,
2. A photograph or other recording of an individual’s body or any part of an individual’s body,
3. Samples of or taken from any part of an individual’s body from which information can be derived, and
4. Information derived from such samples.”

The Code of Practice applies to the acquisition, retention, use and destruction of biometric data by Police Scotland, the Scottish Police Authority and the Police Investigation and Review Commissioner.

In addition to referencing the applicable legislation noted in this paper, the Code of Practice is informed by 12 principles and ethical considerations:

• Lawful authority and legal basis
• Necessity
• Proportionality
• Enhance public safety and public good
• Ethical behaviour
• Respect for the human rights of individuals and groups
• Justice and accountability
• Encourage scientific and technological advance
• Protection of children, young people and vulnerable adults
• Promoting privacy enhancing technology
• Promote equality
• Retention periods authorised by law

Information Commissioner’s Office ‑ Data Protection Reminders

To support the use of LFR in law enforcement, the Information Commissioner’s Office (ICO) has published an summary of considerations that must be made prior to its implementation.

Firstly, it must be strictly necessary with regards to the Data Protection Act 2018, as noted above. There must also be a clear purpose for the use of LFR under this legislation.

Law enforcement must also complete appropriate documentation, including a Data Protection Impact Assessment, an Appropriate Policy Document and should develop local policies and procedures to support the use of LFR.

The effectiveness of LFR must also be demonstrated to support the proportionality and strict necessity of LFR use. The ICO emphasises that the use of LFR to meet specific law enforcement purposes must be clearly explained. The inclusion of any images on watchlists must be subject to enhanced considerations and care with regards to processing, and any watchlists should adhere to data protection principles.

The ICO also suggests that information on deployments and the contact details of the controller should be available to the public. Law enforcement agencies should also consider how the public can be provided with information as to how they exercise their rights.

Finally, any technology should be reviewed and tested on a periodic basis to assess its accuracy and effectiveness.