Policing emerging technologies report: Scottish Government response

Recommendations for appropriate policing bodies

The following recommendations are not addressed to the Scottish Government and therefore it is for the appropriate policing body to comment/address:

Recommendation 1 - policing bodies (Police Scotland and SPA FS) should continue to adhere to HM Treasury Green book guidance for the Strategic Case, ensuring an assessment of the available evidence base (benefits and dis-benefits) across jurisdictions and published research is included in the Case for Change section in the Business Case.

Recommendation 2 - the assessment of the Ethical and Human Rights Impact of emerging technologies should be evidenced and a proportionate judgement for the implementation of technology should be included in Business Cases. This could take the form of a 6th Ethical and Human Rights Case, which should make full use of EQHRIA, (incorporating the legal requirement to pay due regard to the three needs of the Public Sector Equality Duty), DPIA, CRWIA, Fairer Scotland Duty and other Impact Assessments, independent expert advice, Ethics Advisory Panels, and the results from the new Data Ethics Governance Framework.

Recommendation 3 - policing bodies introducing emerging technologies, applied in a context which impacts how the public are policed, should develop (with external input) a clear and publicly accessible Operational Practice Code, ensuring compliance with relevant statutes or codes of practice.

Recommendation 4 - Police Scotland should seek to implement their Data Ethics Governance Framework. Key stakeholders should be involved in internal review prior to implementation and an effectiveness review should be undertaken 12 months after roll-out to ascertain the benefits realised and lessons learned.

Recommendation 5 - project implementation should ensure appropriate training for officers who will be utilising or monitoring emerging technology (particularly AI enabled technologies), with a particular focus on equality, human rights and data protection obligations.

Recommendation 6 - when developing future proposals for technology use, policing bodies should consider, where appropriate, utilising small tests of change/pilots which could be externally evaluated to inform Business Cases and shape wider scale implementation.

Recommendation 7 - when adopting emerging technology, policing bodies should ensure standards are designed to meet the needs of users and enable interoperability, compliance with data protection, equalities and human rights law, adherence to ISO, scientific and other relevant standards and codes. They could consider establishing a national technology clearing house to ensure robust scientific standards for AI technologies and an Algorithmic Impact Assessment policy.

Recommendation 8 - Police Scotland should continue to enhance its approach to ensuring effective and mature risk management processes by scoping, mapping, identifying and addressing any risk (particularly risks to rights and freedoms of individuals), opportunity or issue which may become associated with the adoption of an emerging technology and continuing to re-assess and evaluate risks throughout the lifecycle.

Recommendation 9 - Police Scotland should continue to develop and implement the Consultation and Engagement Framework described in this report when considering the adoption of emerging technology.

Recommendation 10 - Police Scotland should clearly specify the legal basis for using emerging technology, share it with key stakeholders for input and publicly share it.

Recommendation 11 - as part of the lifetime management of a new technology/project, policing bodies should have a clear evaluation plan which seeks to gather data (including baseline measurements) so that the emerging risks and efficacy can be assessed.

Recommendation 14 - policing bodies’ (Police Scotland, SPA and PIRC) complaints processes must be clearly communicated prior to the start of new technology initiatives in policing and be accessible to all members of the public including those with disabilities. Where an adverse human rights impact to a person is the direct result of implementation of a new technology, those responsible for its implementation should provide an effective remedy.

Recommendation 15 - policing bodies should, at an early stage of the introduction of technology, ensure that data flows and the roles and responsibilities of all relevant parties under data protection law are mapped and understood.

Recommendation 16 - the SPA (and other oversight bodies) should continue to require assurance that external evidence, research and advice has been sought and considered in the development of cases and that engagement with partners and the public has been undertaken to inform the approach to embedding specific technologies in policing.

Recommendation 17 - the SPA (and other oversight bodies) should continue to implement a system to regularly review the assessment of the public benefit, any risks, harms, positive or negative impacts of the introduction and use of emerging technology projects.

Recommendation 18 - policing and oversight bodies should consider the routine collection, publication and accessibility of data on the equality and human rights impacts of police use of emerging technologies in order to facilitate ongoing scrutiny and review.