The purpose of the bill is to put in place new oversight arrangements for collection, use, retention and disposal of biometric data in the context of policing and criminal justice. By “biometric data”, I mean fingerprints, DNA, other data that are currently being developed, such as facial recognition software, and any other forms of data that might emerge in the future that we cannot even imagine just now.
The oversight arrangements will focus on the creation of a new biometrics commissioner, who will have a range of functions. The oversight arrangements will apply to Police Scotland and the Scottish Police Authority. The bill allows a power for Scottish ministers to insert additional bodies, if that should be required in the future.
To ensure the impartiality of the postholder, the commissioner will be appointed by the Crown on the recommendation of Parliament. The commissioner will be accountable to Parliament for the performance of his or her functions and expenditure.
The need for independent oversight arises from the ethical, legal and human rights considerations that are associated with the use of biometric data. It is vital that the public have confidence in police use of biometric data. Given that biometric data and samples that are captured by Police Scotland may be taken without an individual’s consent, it is all the more important to ensure that there is adequate protection of rights and independent oversight of the police’s powers in that respect. The need for independent oversight has been identified in a number of independent reports—most recently, in the 2018 report, “Use of biometric data: report of the independent advisory group”. The Scottish Government consultation that followed the group’s report also indicated broad support for those arrangements.
I turn first to the commissioner’s general function, which is to support and promote the adoption of lawful, ethical and effective practices in relation to collection, use, retention and disposal of biometric data. That means that the commissioner will keep under review the law, policy and practice relating to biometric data in the context of policing and criminal justice.
The commissioner will also promote public awareness and understanding of biometric data, and of how police powers and duties are exercised, as well as how the powers and duties can be monitored and challenged.
The commissioner will prepare and promote a code of practice. In addition, his or her functions will include carrying out research and making recommendations in relation to any matter relevant to the Commissioner’s function.
In carrying out those functions, the commissioner will be required to promote in particular the interests of children, young people and vulnerable adults.
I will say a bit more about the code of practice. The commissioner is to prepare a code of practice in consultation with a list of prescribed stakeholders including Police Scotland, the Scottish Police Authority, the Police Investigations and Review Commissioner, HM inspectorate of constabulary in Scotland and anyone else whom the commissioner considers to be appropriate. The code must then be approved by Scottish ministers and laid before Parliament. The content of the code can be reviewed at any time, but there must be a report on it every four years.
The bill requires that there be a code, but it does not specify what its content should be. That is important, because it will allow the commissioner to use his or her own judgment and the input of stakeholders to shape the code. We anticipate that the code will provide information and guidance that sets out the standards and responsibilities of Police Scotland and the SPA, with the aims of ensuring good practice, driving continuous improvement and enhancing accountability. The SPA and Police Scotland will be legally obliged to have regard to the code.
To enable the commissioner to perform his or her functions, the commissioner will have the power to request information. Should that information be refused, concealed or destroyed, the commissioner has a remedy to the Court of Session, which would consider the matter. If an order were to be made by the court, it would be contempt of court to ignore it.
Having considered information about collection, use, retention and disposal of biometric data, the commissioner may wish to make a recommendation. Should no response to the recommendation be forthcoming, the commissioner would reference that in a report to Parliament, which would be made public. Therefore, the sanction is to name and shame, so to speak.
In conclusion, we will have a commissioner who will encourage and support the fulfilment by Police Scotland and the SPA of their functions in a manner that respects fundamental rights, the law and ethics. That support will include promoting good practice, identifying systemic deficiencies and providing a measure of transparency, which together will promote public confidence in policing and in the criminal justice system.