Independent review – Independent advisory group on new and emerging technologies in policing: final report

9. Conclusion and recommendations

Conclusion

Reflecting on the remit and terms of reference of the IAG, emerging technologies have an important role to play in supporting policing bodies to work collaboratively with partners to fulfil their statutory duties and the purpose of policing enshrined in the Police and Fire Reform Scotland Act (2012). Various technologies can play a key role in the investigation and detection of crime and efforts to prevent crime and harm and improve wellbeing and safety. For example, Ariel et al. (2015) found a link between BWV and reduced police use of force against citizens. However, technologies may not achieve their intended aims and indeed may have unintended consequences, for example, Koper et al. (2015) found that police use of mobile technology in hot spot policing was not effective in reducing crime, and rather was primarily used for surveillance and enforcement rather than strategic problem-solving. Whilst the potential for emerging technologies to assist with the detection and prevention of crime should be considered, a range of potential social and ethical implications (Connon et al., 2023) must also be explored. This highlights the value of a range of approaches: horizon scanning; drawing on the existing evidence base (from research and lessons learned from policing in other jurisdictions); and of conducting pilots and research evaluations of technological adoption in policing.

In relation to compliance with equality and human rights and data protection obligations our review suggests that EQHRIAs, DPIAs and other impact assessments are standard practice for policing bodies in Scotland, highlighting that improvements have been made over the last few years and learning has been taken on board since the issues with Cyber Kiosks. For example, proactive consultation and the formulation of operational guidance occurred in the buildup to the introduction of Body Worn Video in armed policing in late 2021. Nonetheless, although the legal basis specified in DPIAs appears to be more likely to be shared with key stakeholders for input now, given the potential for differing interpretation it would be good practice to share the legal basis (and opinions being drawn on) with a variety of external stakeholders as a matter of course in order that they may be questioned, tested and reviewed.

Further to policing legislation, key domestic and international legislation and relevant case law relating to emerging technologies in policing including Human Rights, Equalities, Data Protection, Biometrics and Law of Evidence were reviewed and found to form a decent basis for Police Scotland to exercise their powers. However, global research and best practice in relation to legislative and ethical frameworks suggests that legal frameworks or binding codes of practice (as opposed to guidelines) provide more clarity and are preferable when dealing with certain applications of technology in policing, e.g. automated decision making and AI (particularly in predictive policing) and live facial recognition, given the legal, social and ethical issues identified. In relation to the regulation of biometric data by the police however, Scotland is set to become a forerunner as a result of the Scottish Biometrics Commission's Code of Practice.

With regards to ethical frameworks, Police Scotland has Ethics Advisory Panels in place, though suggestions have been made to enhance independence and transparency. A significant positive development will be the planned introduction of the new Data Ethics Framework and associated proposed sixth ethics and human rights case, which will likely be of interest to other police forces. Oversight by SPA and partners has been substantially enhanced in recent years, together with the signing of the Memorandum of Understanding between Police Scotland and SPA. This represents a positive step, for example the focus on external challenge and advice fits with the importance of consultation and independent input as a key accountability principle.

Beyond the key areas above outlined in the terms of reference, i.e. legal and ethical frameworks and oversight, the IAG's review emphasises some other crucial areas: the centrality of research evidence and evaluation, consultation and public engagement, innovation and tests of change, and the importance of scientific standards. Furthermore, we highlight the importance of training, partnerships, ongoing knowledge exchange and how crucial the routine collection, publication and accessibility of data is to ongoing review and evaluation, particularly in relation to the equality and human rights impacts of police use of emerging technologies.

In conclusion, significant steps have been taken by policing bodies in Scotland to bring improvements to the approach taken in adopting emerging technologies in policing. The recommendations below will serve to position Scotland as world leading in adopting a rights based, ethical, evidence-based, consultative and robust approach to innovation and adoption of emerging technologies in policing. The key will be ensuring that innovation and technological adoption is fostered in order to enable police to fulfil their statutory duties and enhance public safety. Therefore, the level of scrutiny and evaluation required should vary depending on the existing evidence base and level of risk.

We hope that the associated learning and developments relating to the introduction of emerging technologies in policing in Scotland will be useful to other areas of policing, and will be of interest internationally. It is our ambition that the work of the group will support the embedding of technology in policing in a manner that upholds public confidence and supports efficient and effective policing that is rights based, transparent, ethical and socially responsible and delivers, rather than erodes, social justice.

Recommendations

Theme 1: Business case development, implementation and processes

1. Policing bodies (Police Scotland and SPA Forensic Services) should continue to adhere to the guidance set out in the HM Treasury Green book for the Strategic Case. This includes ensuring an assessment of the current available evidence base (including benefits and dis-benefits) across jurisdictions and other police and public services and relevant published research is included in the Case for Change section within the Business Case. (for more details see Appendix C, key consideration 3.1)

2. The assessment of the Ethical and Human Rights Impact of emerging technologies should be evidenced and a proportionate judgement for the implementation or otherwise of technology should be included in Business Cases. This could take the form of a 6th Ethical and Human Rights Case, which would be a first for the UK and should make full use of EQHRIA, DPIA, CRWIA, Community and Islands Impact Assessments, Fairer Scotland Duty Impact Assessment, independent expert advice, Ethics Advisory Panels (EAPs), other relevant impact assessments and the results from the new Data Ethics Governance Framework within Police Scotland. The 6th case should draw a proportionate judgement using all of the evidence, research and advice available on if and how the technology should be adopted by policing. The SPA and PS should continue to develop the creation of a framework of guidance on the development of a 6th case. This is in addition to Police Scotland ensuring that all new technology introduced is compliant with the Equality Act 2010 and associated Codes of Practice and meets the requirements of the Equality Act 2010 (Specific Duties) (Scotland) Regulations 2012, including the duty to assess and review policies and practices.

3. Policing bodies introducing emerging technologies, applied in a context which impacts how the public are policed, should publish a clear and publicly accessible Operational Practice Code, ensuring compliance with relevant statutes or codes of practice. This document should be developed with external input and set out the conditions and limitations of use of the technology, safeguards in place and the methods by which compliant application for a policing purpose is maintained and overseen.

4. Police Scotland should seek to implement, as soon as possible, their Data Ethics Governance Framework. Key stakeholders (e.g. DPO) should be involved in internal review and scrutiny prior to implementation and an effectiveness review should be undertaken 12 months after the roll-out to ascertain the benefits realised and lessons learned during implementation.

5. Project implementation and lifetime management should ensure appropriate training for officers who will be utilising or monitoring emerging technology (particularly AI enabled technologies), with a particular focus on equality, human rights and data protection obligations.

6. When developing future proposals for technology use, policing bodies should consider, where appropriate, utilising small tests of change/pilots which could be externally evaluated to inform Business Cases and shape wider scale implementation within the Policing System. A system or process should be developed to ensure a standardised approach to this and should include using service design principles and data protection by design and default from development through to implementation.

7. When adopting emerging technology policing bodies should ensure standards are designed to meet the needs of users and enable interoperability within and between public agencies and compliance with data protection, equalities and human rights law. More broadly adherence to ISO, scientific and other relevant standards and codes (such as the ICO Data Sharing Code and Children's Code) should be designed at the outset of any new technology implementation. Policing bodies could consider establishing a national technology clearing house to ensure robust scientific standards for AI technologies. Internal standards, policies and procedures around the development and use of AI should that draw on the ICO's AI and Data Protection Guidance. An Algorithmic impact assessment policy should be considered and algorithms should be published via the UK's Algorithmic Transparency Standard.

8. Police Scotland should continue to enhance its approach to ensuring effective and mature risk management processes by scoping, mapping, identifying and addressing any risk (particularly risks to rights and freedoms of individuals), opportunity or issue which may become associated with the adoption of a new technology and continuing to re-assess and evaluate risks throughout the lifecycle of any new technology. This includes the requirement to regularly review, update and implement data protection and equality impact assessments.

Theme 2: Transparency, engagement and evaluation

9. Police Scotland should continue to develop and implement the Consultation and Engagement Framework described in this report when considering the adoption of emerging technology. Engagement should align with legal and governance frameworks, occur as early as possible, have clarity of purpose, draw on the evidence base, be inclusive and accessible (including vulnerable groups and those who may have greatest risk of adverse impacts), include an element of formal consultation, enable colleague voice, promote ongoing dialogue, provide clear public facing communication, be transparent about how insights will be and are used and consider involving the public and stakeholders in formulating guidelines (see Appendix C key considerations 3.2, 6.1-6.12). Summaries of EAP meetings should be made public to aid transparency.

10. Police Scotland should clearly specify the legal basis for using emerging technology, share it with key stakeholders for input and publicly share it.

11. As part of the lifetime management of a new technology/project, policing bodies should have a clear evaluation plan which seeks to gather data (including baseline measurements) so that the emerging risks and efficacy can be assessed and DPIAs reviewed and updated throughout the lifecycle. The decision about whether a research evaluation is needed should be taken early on and informed by the level of risk and existing evidence base. A communication plan should seek to inform and regularly update scrutiny bodies and the public on operational usage and the delivery of the intended public benefit (or any dis-benefits) of the technology.

Theme 3: Legislation and policy

12. Whilst significant legislative gaps were not found, Scottish Government (and where appropriate SBC) should seek to keep the legislative landscape under review and consider whether future technological deployments would benefit from the introduction of statutory codes of practice in order to provide greater clarity and safeguards on the application of emerging technologies in policing (such as Live Facial Recognition and certain applications of AI, e.g. in predictive policing). In future if there were plans to consider the deployment of autonomous security robotic devices in policing for enforcement purposes new legislation should be introduced in advance. However, the possibility that certain applications of some technologies in policing should be categorically prohibited from use, either because they are unacceptably risky even with mitigation in place, or because they are intrinsically incompatible with human rights, should be considered in this context by Government.

13. The Scottish Government should take the learning from the 'Draft Proposals for Oversight of Ethical Considerations in Policing' and consider endorsing a similar approach to enhancement of the Scottish Public Finance Manual as good practice across all public bodies in Scotland.

14. Policing bodies' (Police Scotland, SPA and PIRC) complaints processes must be clearly communicated prior to the start of new technology initiatives in policing and be accessible to all members of the public including those with disabilities. Where an adverse human rights impact to a person is the direct result of implementation of a new technology, those responsible for its implementation should provide an effective remedy.

15. Policing bodies should, at an early stage, ensure that data flows and the roles and responsibilities of all relevant parties under data protection law are mapped and understood. This is critical to ensuring that data can flow as intended, in compliance with data protection law and that the introduction of technology and subsequent collection of data does not result in increased victimisation, inequalities and inefficiencies or unjustly adversely impact on individuals' rights and freedoms. Where data sharing takes place, appropriate data sharing agreements should be in place and the ICO's Statutory Data Sharing Code of Practice should be complied with.

Theme 4: Oversight

16. The SPA (and other oversight bodies) should continue to require assurance that external evidence, research and advice has been sought and considered in the development of cases and that engagement with partners and the public has been undertaken to inform the approach to embedding specific technologies in policing. This should include evidence of early engagement in accordance with the Joint MoU and the use of subject matter experts to advise and inform scrutiny bodies' oversight of emerging technology initiatives.

17. The SPA (and other oversight bodies) should continue to implement a system to regularly review (and consider how Independent EAPs might feed in) the assessment of the public benefit, any risks, harms, positive or negative impacts of the introduction and use of emerging technology projects.

18. Policing and scrutiny bodies should consider theroutine collection, publication and accessibility of data on the equality and human rights impacts of police use of emerging technologies,at least for high-risk projects,in order to facilitate ongoing scrutiny and review.