Updates

SBC Annual Report and Accounts for 2023/24

On 26 September 2024, the Scottish Biometrics Commissioner laid his third annual report and accounts before the Parliament. On 13 November 2024, the Commissioner and SBC Director gave evidence to the Parliament’s Criminal Justice Committee in relation to his annual report and took questions from members. The Commissioner’s evidence session may be viewed on the Commissioners website.

The key highlights from the ARA include:
The Commissioner having laid his third Assurance Review on the use of images and recordings by Police Scotland, the SPA Forensic Services and the Police Investigations and Review Commissioner in March 2024.
Having conducted compliance assessments on the statutory Code of Practice and finding Police Scotland, the SPA and PIRC compliant in January 2024.
Having received no complaints from data subjects relative to non-compliance with the Code since it was brought into legal effect in November 2022.

Co-hosting the first ever ‘Biometrics in Criminal Justice Conference’ in Edinburgh in partnership with the Authority and Police Scotland.
Delivering a low-cost operating model through a shared-services arrangement with the Scottish Public Sector Ombudsman to deliver value for the public purse.

The Commissioner will be happy to take questions from members in relation to his audited Annual Report and Accounts.

Joint SG/SBC Review of the Laws of Retention

On 31 October 2024, the Commissioner laid a joint review conducted in partnership with Scottish Government and with the assistance of Police Scotland in relation to the laws of retention of biometric data contained within sections 18 to 19 C of the Criminal Procedure (Scotland) Act 1995.

The review finds that the current research and evidence base on biometric retention in Scotland, the UK, EU, and wider is not sufficiently developed to enable a robust proposal to be made around alternatives to current Scottish law.

The report makes six recommendations:
The existing retention periods for the biometric data of non-convicted persons should remain as set out in the 1995 Act.
For now, the current legislative silence in the 1995 Act should be retained with regard to the retention period for the biometric data of convicted persons, subject to the outcome of Police Scotland reviewing its retention policies and the findings of a robust evidence base once this has been assembled by Police Scotland.
Police Scotland to set up a Short Life Working Group to develop an options appraisal for their retention policies for the biometric data of convicted persons, which is evidence-based; observes the need for proportionality and necessity; and complies with the law and relevant legal rulings of the European Court of Human Rights (ECtHR), particularly Article 8 ECHR. The options must expressly prohibit indefinite retention without periodic review. The options should be consulted on, and new policies should be put in place by 31 October 2025.
Police Scotland should, as matter of routine, collect and retain accurate and robust management information in respect of the retention of biometric data going forward. This information should provide a solid and transparent evidence base to support future assurances that such retention policies are lawful, ethical, effective, and proportionate.
Police Scotland should accelerate their current review of retention periods for volunteer data and put changes into place by 31 October 2025.
Police Scotland should collect management information to ascertain whether the one-month period under Section 19 has caused any operational difficulty. If such evidence exists to support the need for change, the SG should consider bringing forward primary legislation, subject to consultation.

The Commissioner will be happy to take questions from members in relation to the joint review conducted in partnership with Scottish Government.

Progress on previous recommendations

In March 2023, the Commissioner laid two Assurance Reviews before the Scottish Parliament. The first was conducted in Partnership with the Scottish Police Authority and examined the acquisition of biometric data from vulnerable adults arrested by Police Scotland. The second was also conducted in partnership with the Scottish Police Authority and the Children’s Centre for Youth Justice and examined the acquisition of biometric data from children (persons under 18 years of age) arrested by Police Scotland.

Both reviews resulted in four recommendations at Police Scotland:
Recommendation 1 Police Scotland should improve the information given to all persons who have their biometric data acquired and retained in police custody settings because of being arrested and deprived of their liberty. As a minimum, this should include an explanation of the legal basis under which the subject’s biometric data (fingerprints, image, DNA swab) is to be acquired, and an explanation that such data may be speculatively searched against UK policing databases. Such information and how it is presented and delivered should be tailored to the needs of the recipient, for example children or vulnerable people.
Recommendation 2 When acquiring biometric data in police custody settings from all persons deprived of their liberty through arrest, and whose biometric data is acquired, Police Scotland should provide basic information to data subjects about the applicability of the Scottish Biometrics Commissioner’s statutory Code of Practice, including the legislative provision for the Commissioner to consider complaints about failure to comply with the Code by Police Scotland. Such information and how it is presented and delivered should be tailored to the needs of the recipient, for example children or vulnerable people.
Recommendation 3 Police Scotland should improve the collection of management information in relation to all biometric data types to better inform its strategic decision-making. Police Scotland should then determine what information it could safely place in the public domain to improve the public understanding of its value. This could be in a similar manner to the Scottish DNA database statistics that are already published. This should as a minimum include information on fingerprint volumes and match rates and volumes of images held within the Scottish Criminal History System (CHS) and the Police National Database (PND).
Recommendation 4 Police Scotland should develop, consult on, and then publish operational policies, procedures, and practices for the acquisition of biometric data from children under 18 years of age that are consistent with the Justice Vision for Scotland and relevant standards for working with children in conflict with the law. There should be no general policy, which otherwise sanctions the blanket capture of biometric data from children. Any decision to take biometric data from a child should be taken on a case by-case basis and authorised by a senior police officer not beneath the rank of Inspector. In reaching a decision, the senior officer should have regard to factors such as the best interest of the child and the gravity of the offence.

In July 2024, the Commissioner wrote to Police Scotland indicating that all four recommendations had been satisfactorily discharged. The improvements put in place by Police Scotland include the provision of a biometrics information leaflet to arrested persons who have biometric data captured, a distinct policy in relation to children and better management information being published.

The Commissioner will be happy to take questions from members on the discharged recommendations.

Commissioner’s winter work programme

Over the winter of 2024/25 the Commissioner will be conducting two parallel Assurance Reviews. The first is being conducted in partnership with the Authority and the Leverhulme Institute of Forensic Science and will explore the use of DNA by Police Scotland and the SPA Forensic Services. The second is being conducted in partnership with HM Chief Inspector of Constabulary in Scotland and will explore the use of retrospective image search (RIS) tools by Police Scotland within the UK Police National Database (PND) and the UK Child Abuse Image Database (CAID).

SBC Director Ross Macdonald will give a verbal update to the authority on progress and reporting timescales. At this stage it is envisaged that the DNA report will be laid in Parliament in late February and the RIS report in late March. In both cases, the objective is to provide assurance to the Parliament around lawful, effective, and ethical use.

The SBC Director will also update the Authority on plans to update the existing SBC Strategic Plan towards the end of winter and to start the process of consultation on the shape and form on the next 4-year strategic plan which must be laid in Parliament no later than 30 November 2025.

The Director will be happy to take questions on the current work programme.