Scottish Biometrics Commissioner - functions review: consultation responses summary

5. Analysis by consultation question

Question 1 – Do you consider that the SBC's functions under the 2020 Act are appropriate? In this context, functions include the SBC’s powers and duties.

5.1 This closed question asked respondents to consider whether the SBC’s functions under the 2020 Act were appropriate and required the respondent to answer ‘Yes’ or ‘No’.

5.2 This question received a total of 12 responses, of which seven (58%) were from organisational respondents, while the remaining five (42%) were from individuals. Responses to this question were largely positive, with eight respondents (67%) answering ‘Yes’, and four (33%) answering ‘No’.

5.3 From the respondents who answered ‘Yes’, six (75%) came from organisations, the remainder from individual respondents. Of the respondents who answered ‘No’, three (75%) were individual responses and the remainder came from organisations.

Percentages may not total 100% due to rounding.

Summary of views – Yes

5.4 For those respondents who considered that the SBC’s functions were appropriate, a summary of the supplementary views expressed were as follows:

• The 2020 Act provides a balanced framework that protects individual rights and supports legitimate policing and law enforcement needs
• The functions are appropriate, proportionate, well-defined and aligned with policing realities
• Independent oversight of biometric data in criminal justice is essential;
• Oversight was key to strengthening public confidence and trust, transparency, and accountability and ensuring lawful, effective and proportionate use of biometric data
• The functions should remain supervisory focusing on monitoring compliance and providing assurance
• The SBC Code of Practice had improved governance, compliance and delivered practical benefits
• Thematic Assurance Reviews undertaken by the SBC was also considered as an effective tool
• The discharge of the functions has initially focused on outputs and future focus should cover the measurement of outcomes and their impact
• The functions should be focused on criminal justice and policing. Extending the functions into other areas would need parliamentary scrutiny. Caution should be observed on evolving such functions without an explicit statutory mandate.

Summary of views – No

5.5 For those respondents who considered that the SBC’s functions were not appropriate, a summary of the supplementary views expressed were as follows:

• The functions could be refined or clarified to be kept relevant. For example, adapting to or keeping pace with technological change given the prevalence of artificial intelligence, digital forensic data and the sharing of biometric data both domestically and internationally
• Consideration should be given to ensuring that the functions are strengthened to align to the principle of promoting human rights – particularly the rights of children and young people
• Consideration should be given to expanding the functions to provide oversight of other bodies^[1]
• The benefits of the SBC may not justify the cost at a time of budgetary pressures within the public sector.

Question 2 - Do you consider that the list of bodies subject to the SBC's oversight and code of practice under the 2020 Act are appropriate? Currently, the list consists of Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner.

5.6 This closed question asked respondents to consider whether the list of bodies subject to the SBC’s oversight and code of practice under the 2020 Act are appropriate and required the respondent to answer ‘Yes’ or ‘No’.

5.7 This question received a total of 11 responses, of which six (55%) were from organisational respondents, while the remaining five (45%) were from individuals. Responses to this question were largely negative, with seven respondents (64%) answering ‘No’, and four (36%) answering ‘Yes’.

5.8 From the respondents who answered ‘Yes’, two (50%) came from organisations, the remainder from individual respondents. Of the respondents who answered ‘No’, four (57%) of these were organisational responses and the remainder came from individuals.

Percentages may not total 100% due to rounding.

Summary of views – Yes

5.9 For those respondents who considered that the list of bodies subject to the SBC’s oversight and code of practice were appropriate, a summary of the supplementary views expressed were as follows

• The current bodies listed were the key actors in the use, governance, and oversight of biometric data in policing – and this aligned with the original intent of the legislation which focussed the scope of the functions
• The current bodies listed enabled the discharge of functions by the SBC to target the areas where the use of biometric data and technologies are most operationally significant
• The current bodies listed enabled the capacity to discharge such functions to be more effective and allowed for more manageable oversight

Summary of views – No

5.10 For those respondents who considered that the list of bodies subject to the SBC’s oversight and code of practice were not appropriate, a summary of the supplementary views expressed were as follows. These are respondents’ views and not Government conclusions:

• Biometric data operates across a multi-agency ecosystem in Scotland and is not just limited to the listed policing bodies
• Biometric data is often collected, processed, or stored by multiple agencies and shared across jurisdictional and organisational boundaries
• Consideration should be given to expanding the list of bodies to include other policing bodies operating in Scotland such as the British Transport Police, the National Crime Agency and the Ministry of Defence Police and the Civil Nuclear Constabulary
• Consideration should also be given to expanding the list of bodies to include Border Force, Immigration Enforcement and His Majesty’s Revenue and Customs. This would be helpful to ensure clarity on oversight jurisdiction, particularly for UK-wide bodies which conduct criminal investigations in Scotland
• There could be value of closer working between the SBC and the Biometrics Commissioner for England and Wales and with the UK Information Commissioner respectively – for example via statutory memorandums of understanding. This could help to manage oversight of bodies operating across borders
• Consideration should be given to expanding the functions beyond policing and into the wider justice system in Scotland. For example, the Scottish Prison Service where biometrics are extensively used and shared within prisons and offender management systems. A further example was the Crown Office and Procurator Fiscal Service in terms of prosecuting cases which involved the handling of biometric data concerning the accused and/or witnesses
• Consideration should be given to expanding the functions to include Local authorities and private organisations which operate CCTV and surveillance technologies which may also generate biometric data relevant to policing and criminal justice purposes
• The use of outsourcing and partnerships with the private sector was highlighted in terms of considering whether the functions should be expanded to cover contractors which process biometric data on behalf of specified bodies such as private sector forensic labs and technology vendors
• Consideration should be given to expanding the functions beyond policing and criminal justice in Scotland. For example, NHS Scotland where biometrics are used for identification and security
• Any expansion of functions should be matched by adequate resources and capability to deliver.

Question 3 - Do you wish to make any other comments in relation to the matters raised by this consultation and which you feel have not been covered by any of the earlier questions?

5.11 This open question provided an opportunity for respondents to make any other comments in relation to the matters raised by this consultation and which they felt had not been covered by any of the earlier questions.

5.12 From the nine respondents who specifically answered this question, five (56%) of these came from organisations, and four (44%) came from individual respondents.

Percentages may not total 100% due to rounding.

Summary of views

5.13 Some of the comments provided to this aspect of the consultation simply repeated or expanded upon the points made in response to previous questions. There were however several other points that emerged as a result of providing respondents with an opportunity for respondents to provide further comments which had not been covered by any of the previous questions. The summary of views provided below therefore only includes comments that have not been specifically highlighted in this report under the analysis for question 1 and 2 respectively. It does however also include a summary of views raised in the two free text responses received:

• The role of the SBC must remain clearly independent from the bodies it regulates. The function to promote the adoption of lawful, effective and ethical practices carries risk of compromising the SBC’s independence if their primary function is perceived to be supporting initiatives led by the bodies it provides oversight of
• The SBC has limited capacity and resources, which may restrict effective oversight. This could be enhanced with stronger powers for inspection, compliance and public engagement
• There is a need to improve public awareness and understanding of biometrics
• Consideration should be given to ensuring that the functions are clear in respect of the oversight of digital forensics and biometrics held across various UK databases
• Concerns regarding the use of biometrics for mass identification, surveillance, and other high-risk purposes, alongside calls to consider prior authorisation mechanisms for certain technologies, such as live facial recognition, behavioural biometrics and advanced analytics
• The importance of joined up and clearly articulated regulatory arrangements across Scotland and the wider UK, particularly in light of changes to the UK regulatory landscape and overlaps in regulatory responsibilities
• Consideration should be given to review the definition of biometric data under the 2020 Act and whether this should be updated to cover emerging technologies which supported the use of behavioural and inferential biometrics
• Calls for consideration of data governance issues, including retention periods for biometric data of non-convicted individual and the storage of biometric data in overseas cloud systems
• Suggestions that the Scottish framework should take account of relevant international developments, be assessed against EU data transfer standards as opposed to UK standards and achieve better alignment with the EU Artificial Intelligence Act and EU regulatory data standards
• The future landscape of biometrics in policing and beyond is evolving and it is important that the office of the SBC evolves to match this ecosystem. This requires careful consideration of the legislative powers of the office, changes in technological capability and deployment, and the necessary interaction with other policing and regulatory bodies in Scotland and the UK
• Calls for the SBC Code of Practice to provide clearer and more directive guidance on the use of biometric technologies.