Scottish Biometrics Commissioner - review of functions: consultation

Purpose of the consultation

Section 6 of the 2020 Act^[1] requires the Scottish Ministers to prepare and publish, at periodic intervals, a report assessing whether the SBC’s^[2] functions remain appropriate, and whether any changes should be made to the list of bodies which are subject to the SBC’s oversight. In accordance with this duty, the inaugural report must be laid before the Scottish Parliament no later than 30 November 2026. This is because the 2020 Act requires that such a report be laid within one year of the expiry of the SBC’s first strategic plan, which expired on 30 November 2025^[3].

The report will assess whether it is necessary

• to amend the list of bodies subject to the SBC’s general function and code of practice; and
• to amend the SBC’s functions. “Functions” is a defined term under schedule 1 of the Interpretation and Legislative Reform (Scotland) Act 2010 and includes both powers and duties. This is the definition that will be used in the report.

To determine whether any amendments are required to the functions of the SBC or the list of bodies subject to his oversight, we are conducting a formal review. This review will consider, amongst other things, relevant publications issued by the SBC (see Annex A to this consultation paper), and will involve stakeholder engagement conducted in two stages.

Stage one comprised initial discussions undertaken by Scottish Government (SG) officials with key stakeholders (see Annex B to this consultation paper) between September 2025 to January 2026, to gather views on the impact of the SBC’s work, and on whether the bodies subject to the SBC’s functions under the 2020 Act remained appropriate or otherwise.

Stage two is this formal public consultation paper, which includes a summary of matters raised by or with stakeholders during stage one. This review will also consider any relevant findings from activities taking place in other jurisdictions – such as the United Kingdom (UK) Government consultation on the governance around law enforcement use of biometrics, facial recognition and similar technologies^[4].

Why are SG consulting?

To assist the review in determining whether any amendments should be made to the functions of the SBC or to the list of bodies subject to his oversight, we are asking you to reflect on the impact of the SBC’s work during the period from 12 April 2021 (the date of the SBC’s appointment) to 30 November 2025 (the date on which his first Strategic Plan expired). You are also asked to consider the future landscape for the use of biometric data by law enforcement bodies, with a view to future-proofing for the SBC’s functions and list of bodies which are subject to the SBC’s oversight, over the period up to the next review which is scheduled for 2031.

To inform these considerations, this consultation paper provides links to information concerning the activities undertaken, and the outcomes achieved, by the SBC. The consultation paper also provides a summary of key issues raised by stakeholders at the initial meetings during stage one (without these being necessarily endorsed by the SG) in order to encourage further reflection and comment.

Therefore, your response to this consultation paper will be important in shaping future proposals for any amendments to the SBC’s functions and the list of bodies subject to the SBC’s oversight.

Context

In 2017, the SG tasked an Independent Advisory Group (IAG) with considering the taking, use and retention of biometric data in policing. In 2018^[5], the IAG recommended that an independent Scottish Biometrics Commissioner and a code of practice be established to ensure that the policing approach to biometric data was lawful, ethical, effective and proportionate. In 2020 the Scottish Parliament passed the Scottish Biometrics Commissioner Act 2020 (the 2020 Act)^[6].

The SBC is appointed by the Monarch on the nomination of the Scottish Parliament. The SBC is a parliamentary officeholder accountable to the Scottish Parliament and independent from Scottish Ministers. The current SBC is Dr Brian Plastow^[7] who took up office in April 2021.

The 2020 Act established the office of the SBC to support and promote the adoption of lawful, effective and ethical practices in relation to biometric data by specified bodies, these being the Police Service of Scotland, (Police Scotland), the Scottish Police Authority (SPA) and the Police Investigations and Review Commissioner (PIRC). The SBC remit also included the preparation of a statutory Code of Practice^[8] to apply to the specified bodies, and this took effect from 16 November 2022 following parliamentary approval.

The SBC has a general function to keep the law, policies and practices relating to the acquisition, retention, use and destruction of biometric data by these specified bodies under review as well as promoting public awareness and understanding of the powers and duties that these specified bodies have in relation to the acquisition, retention, use and destruction of biometric data; how those powers and duties are exercised; and how the exercise of those powers and duties can be monitored or challenged. The SBC must also promote, and monitor the impact of, the code of practice.

The SBC also has a number of additional functions, duties and powers in the 2020 Act, such as producing a strategic plan; gathering information and remedying any failure to provide such information; producing reports and making recommendations; and preparing annual accounts.

In order to meet the requirement under section 6, we do not consider it necessary to scrutinise each individual function in detail. While the review does not wish to discourage stakeholders from commenting on what might appear to be less important functions, it will not focus on standard public office matters concerning the SBC such as setting a budget or preparing an annual report. Instead, the review will focus on the functions under the 2020 Act which are directly concerned with biometric data.

The key outputs delivered by the SBC during the first strategic plan period 2021-25 include (though are not limited to) the preparation and publication of the statutory code of practice, a joint review with the SG on retention periods, and the publication of thematic reviews (covering the acquisition of biometric data from vulnerable persons and persons under the age of 18; the acquisition of photographs and images; the use of deoxyribonucleic acid (DNA) and retrospective facial search technology). Links to these documents and many others can be found at Annex A to the consultation paper.

The impact of these key outputs and others is an important consideration in determining whether the functions and list of bodies which are subject to the SBC’s oversight, remain appropriate. So too is a consideration of the future landscape given that the next review is not scheduled to take place until 2031. Over the course of September 2025 to January 2026, SG officials met with several key stakeholders to hear initial views on these issues. Points raised in discussion have been categorised by theme and included:

General:

• The overall package of measures and compliance procedures introduced by the SBC appear to have made a positive difference in terms of strengthening public assurance;
• Clarity is needed on the SBC’s role in relation to the digital forensics space and new biometric technologies such as Live Facial Recognition (LFR) being potentially used in future; and
• The regulation of biometrics within the policing and criminal justice space in Scotland and across the UK is fragmented – and this could be confusing for the public.

Code of Practice:

• The self-assessment process for the Code of Practice has been impactful – leading the bodies which are subject to the SBC’s oversight to make improvements, learn lessons (in collaboration with other specified bodies) and collect a broader range of management data; and
• Consideration might be given by the SBC to making the Code of Practice more directive.

SBC Recommendations:

• The custody suites leaflet^[9] recommended by the SBC now confirms the rights of people who have their biometric data taken and where complaints can be directed;
• The recommendations by the SBC for the collection of management information to be improved will help to improve public transparency over how biometric data is being used – for example the publication of statistical information^[10] on the volumes of biometric data held by Police Scotland; and
• The SBC thematic reports are valuable as they cover the end to end process and encourage collaboration - the SBC recommendations are followed up.

Awareness Raising:

• Public attitudes surveys^[11] previously undertaken by the SBC or in partnership have assisted with generating findings to measure public acceptance around police use of biometric data and for what purposes – and in turn assisting with increasing public transparency on such matters;
• The SBC was instrumental in organising Scotland’s first ever Biometrics Conference^[12] held in 2024, bringing key partners across Scotland and wider UK jurisdictions together; and
• The SBC’s appearances in public - such as at the Scottish parliament and SPA Board – have also raised a degree of public awareness of his functions and what law enforcement agencies are doing in the biometrics space.

Collaboration:

• The SBC’s own advisory group is well-represented and brings together operational, academic and technology expertise in the Biometrics space; and
• The SBC also has had an interface into wider UK Government policy and advisory boards operating within the biometrics in policing space.

Bodies which are subject to the SBC’s oversight:

• Consideration should be given to extending the list of bodies which are subject to the SBC’s oversight under the 2020 Act to include other UK-wide police forces or specialist law enforcement agencies operating in Scotland where biometric data is acquired in Scotland and then used, retained or destroyed in Scotland or in another UK jurisdiction^[13] - for example the British Transport Police, the National Crime Agency, the Ministry of Defence Police and the Civil Nuclear Constabulary;
• Consideration should be given to extending the list of bodies which are subject to the SBC’s oversight under the 2020 Act to include other organisations who acquire and manage biometric data that could be used for policing and criminal justice purposes in Scotland such as the Scottish Prison Service, and those who operate public space surveillance cameras/CCTV (for example local authorities and private individuals and businesses).

These points are offered to prompt your thinking for the purposes of this consultation and again do not necessarily reflect the SG’s position. You may of course hold other views which you want to share as part of your consultation response.

In order to answer the questions around whether the functions and the list of bodies which are subject to the SBC’s oversight remain appropriate, it is important to consider both the impact which the exercising of the functions has had to date in terms of supporting and promoting the adoption of lawful, effective and ethical practices – and also the future landscape for law enforcement use of biometric data, in order to determine whether any changes are required for future-proofing purposes.