Independent review – Independent advisory group on new and emerging technologies in policing: final report

2. Background

Introduction

Policing in Scotland is operating in a complex context where the methods used to commit crimes are changing rapidly, cybercrime is more prevalent and the expectations on policing to keep people safe continue to increase, whilst resourcing pressures also grow. Technology is embedded in our everyday lives and policing must embrace new technology in order to fulfil its statutory duties and improve the safety and wellbeing of individuals and communities. There is a need for evidence-based innovation and technological adoption in policing, but ensuring this is legal, ethical and subject to effective oversight is central to public confidence and upholding people's rights.

When it comes to the adoption of new technologies in policing various challenges have been evident in the Scottish context, although some important steps have been taken recently to learn from this and bring improvements. Policing in Scotland is, by its own admission, behind the curve when it comes to technological adoption but this presents an opportunity to learn from elsewhere, take stock and map out an improved framework.

As Bowling and Iyer argued, in relation to body worn video:

'the introduction of technology is happening before legislators and society at large have had the chance to reflect on the consequences; the mechanisms required to ensure technology is used with appropriate transparency, fairness and accountability are not yet in place' (Bowling and Iyer, 2019: 156).

On 13 June 2019, the then Cabinet Secretary for Justice, Humza Yousaf MSP, appeared before the Scottish Parliament's Justice Sub-Committee on Policing in relation to their report on Police Scotland's use of digital triage devices (also known as 'Cyber Kiosks'). Mr Yousaf indicated that he intended to form an independent advisory group on emerging technologies in policing, stating:

"Because of my commitment to the legal, ethical and proportionate use of new technologies…I plan to form an independently chaired reference group to scope the possible legal and ethical issues arising from emerging technological developments. The overall aim is to ensure that Police Scotland can continue to have not only the power to keep our communities safe but, crucially, the right safeguards to protect the rights of the individual."

This announcement was made in the context of extensive parliamentary scrutiny of police use of technology in Scotland (e.g. JSCoP, 2019). In relation to digital triage devices, for example, the police had not conducted human rights and data protection impact assessments in advance. The extensive scrutiny by parliament in this space at the time was arguably symptomatic of weak oversight from the Scottish Police Authority (SPA) in 2018. However, there was then a significant delay in establishing the Independent Advisory Group (due to a number of factors including the COVID-19 pandemic) and since 2019 significant improvements have been made to both policing processes and oversight by the SPA.

Established in late 2020, ETIAG (henceforth referred to as the IAG) has brought together members from across academia, civil society, regulators and policing to explore, discuss and make recommendations which will further support the enhancement of policy and practice in this space. The IAG believes that Scotland is in a strong position to seize the opportunity to become world leading in adopting a rights based, ethical, evidence-based, consultative approach with a robust oversight framework in relation to the adoption of emerging technologies in policing.

The final report of the IAG is structured as follows. This background section maps out the terms of reference, membership and activity (including evidence gathering) and provides a definition of emerging technologies.

The first substantive chapter focuses on the role of research evidence in decision making and evaluation relating to the adoption and implementation of emerging technologies in policing.

The next chapter covers legal frameworks (human rights, equalities, data protection and law of evidence), impacts on individuals' rights, processes (including impact assessments) and procedures; lessons learned, good practices and legislative gaps.

Chapter five covers ethical considerations, including the use of ethics panels and lessons learned in Scotland, social and ethical implications, and good practices in ethical frameworks from other fields and jurisdictions.

The sixth chapter uses a range of literature, best practice and learning from experiences in Scottish policing and elsewhere to develop an evidence base and framework for consultation and public engagement that sets out proposed principles and practice for clear, meaningful, accessible and appropriate approaches to engage on emerging technologies in policing.

The next chapter on technological innovation and scientific standards looks at barriers and facilitators to adoption; viewpoints of technology providers on the future horizon for technological innovation and requirements in relation to scientific standards. This includes looking at data driven innovation; the place of the needs of victims and other members of the public in technology adoption; data interoperability and standards; and a consideration of what next generation standards for digital evidence management may look like.

Chapter eight on oversight, scrutiny and review provides an overview of existing decision making, oversight and scrutiny framework that is in place to support the assessment of the potential adoption of new technology across the policing system in Scotland, highlights recent steps to bring improvements and proposes further potential routes to enhancement. It follows the consideration and decision making pathway of technology adoption from initial concept assessment, case for change development, decision making, governance approvals, project delivery and into business as usual adoption.

The final chapter of the report draws some conclusions and outlines the final recommendations of the IAG.

2.1 Terms of reference

The remit of the Independent Advisory Group was to investigate and report to the Cabinet Secretary for Justice and Veterans on whether the current legal or ethical frameworks need to be updated in order to ensure Police Scotland's use of emerging technologies in relation to operational policing is compatible with equality and human rights and other applicable legislation. The IAG would also look at current best practice around new technology; and to provide specific recommendations or potential outputs to address any identified issues.

It was anticipated that the review would:

• Consider what potential impact emerging technologies or analytical techniques - either currently available or in development, but not presently deployed - could have on Police Scotland's detection and prevention of crime.
• Consider the extent to which the use of such emerging technologies or analytical techniques by Police Scotland is compliant both in application and in spirit with equality and human rights obligations, including those set out in the Human Rights Act 1988, the Scotland Act 1998 and the Equality Act 2010.
• Determine whether the current legislative framework used by Police Scotland to exercise their powers is sufficiently robust to allow for the proportionate and justifiable deployment of such technologies or techniques. This will be considered within the context of the Police and Fire Reform (Scotland) Act 2012 which focuses on public safety and wellbeing as well as the prevention of crime. Human rights, equality, data protection and other relevant legislation will be considered in this area.
• Draw on a wide range of evidence from Scotland and other jurisdictions in order to ensure that, as far as possible, any possible recommendations are forward and outward looking and future proofed.
• Determine whether the range of ethical frameworks used by Police Scotland and other policing and public sector bodies are sufficiently robust to allow for the proportionate and justifiable deployment of such technologies or techniques.
• Explore whether there are suitable institutional oversight functions to oversee the introduction of new technologies and consider in what circumstances policing bodies should seek to engage, consult and bring in independent bodies regarding the use of new technology.
• Ensure that the Group's focus, and any associated recommendations, take cognisance of the existing and planned landscape of advisory and regulatory bodies, including but not limited to the Investigatory Powers Commission and the Biometrics and Forensics Ethics Group.

2.2 The advisory group

The Independent Advisory Group consisted of the following members:

• Professor Elizabeth Aston, Edinburgh Napier University (Chair)
• Professor Angela Daly, University of Dundee
• Jenny Brotchie, Information Commissioner's Office (advisory role)
• Professor Bill Buchanan, Edinburgh Napier University
• Diego Quiroz, Scottish Biometrics Commissioner's Office
• Bill Stevenson, Equality and Human Rights Commission
• Barry Sillers, Scottish Police Authority
• Professor Burkhard Schafer, University of Edinburgh
• Georgie Henley, techUK
• Andrew Hendry, Chief Digital Information Officer for Police Scotland
• Elaine Galbraith/Craig Naylor, His Majesty's Inspectorate of Constabulary in Scotland
• Ken Dalling, Past President of the Law Society of Scotland
• Stephen Ferguson, The Crown Office and Procurator Fiscal Service

In addition, earlier on in the process we had other organisations who contributed to the work of the IAG e.g.: Scottish Human Rights Commission and Open Rights Group, Scotland. Other invited organisations (Convention of Scottish Local Authorities, Amnesty International, Empowering Scotland's Ethnic and Cultural Minorities etc.) were unfortunately unable to contribute to the work of the group for various reasons.

The secretariat consisted of officials from the Scottish Government.

Advisory group workstreams

Four separate workstreams were established to assist with the work of the Advisory Group. For a full list of workstream members please see Appendix B. Each workstream developed their own work programme and produced a report based on the following remits:

• Legal framework & ethical standards - to consider existing legal frameworks, ethical panels etc. and explore good practices and gaps in relation to both legal frameworks and ethical standards.
• Evidence and scientific standards - to consider the role of research evidence in the consideration, adoption and implementation of emerging technologies, to explore barriers and facilitators to research and innovation and consider best practice in scientific standards relating to adoption of technology in policing.
• Consultation and public engagement - to consider the role of consultation and public engagement in supporting police legitimacy, consent and public confidence as new and emerging technologies are considered which change operational policing in Scotland.
• Oversight, scrutiny and review - to identify and/or document existing oversight, scrutiny and review mechanism and map any gaps in this area.

2.3 Interim report

We produced an interim report which was submitted on 24th June 2022. In it, we explained the work undertaken to find evidence to assist us to produce our final report, with conclusions and recommendations based on this evidence.

In addition to providing an update on the progress of the workstreams and key emergent themes, we described the two key ways in which we gathered evidence –a formal Call for Evidence and Commissioned Research. The delay in securing appropriate research on this topic was, along with the pandemic, the main reason for seeking an extension of time from the current Cabinet Secretary for Justice and Veterans, Keith Brown MSP, to allow the research team to fully complete their work and for the group to make the most of the important evidence which has been provided to help us to identify conclusions and recommendations. With that extension, the final report is being submitted to the Cabinet Secretary by the end of November 2022. Obviously, we appreciate that the Cabinet Secretary will require some time to consider our report and the underlying evidence before issuing a response on behalf of the Scottish Government.

2.4 Evidence

Call for evidence

A Call for Evidence was launched by the IAG and was open between 5^th July and 4^th October 2021, with 13 responses being submitted during this period. These responses included technology companies and academics who have extensive experience in this field. We are grateful to all of those who took the time to respond and these have been analysed and used to inform the work of the group.

Research

The Independent Advisory Group also supplemented their own investigatory work by commissioning independent research through the Scottish Institute for Policing Research (SIPR). The project was awarded to a research team based in the University of Stirling - Dr Niall Hamilton-Smith (lead), Prof William Webster, Dr Mo Egan, Dr Diana Miranda, Dr Irena Connon and Niamh MacKay.

The research planned to support the IAG by:

• Detailing the relevant legal frameworks, processes and practices in Scotland
• Looking outward and exploring good practice from other jurisdictions and other fields, including a comparative look at legal frameworks and ethical standards
• What impacts on rights do individuals (including witnesses, victims, suspects and members of the public) experience as a result of the use of new and emerging technologies. Also, whether any groups are particularly affected and if the existing legislation provides sufficient safeguards against risks.
• Ascertain whether there are there any legislative gaps which need to be filled.

2.5 Definition of emerging technologies

As outlined in the IAG commissioned research report (Connon et al., 2023: 9-12) emerging technologies as a term may be used to describe a new technology, the evolution of an existing technology, planned implementation of a recently developed technology or potential implementation of technologies that are currently developing or are expected to be introduced in the next five to ten years.

The adoption of emerging digital technologies by public services can present both opportunities and risks to rights and freedoms, including through their innovative use of personal data. For public services involved in policing, legal, ethical and social challenges posed by digital technologies have implications for relations between the public and the state.

Connon et al. (2023) suggest that four key features of emerging technologies should be considered: the nature of the technology, the technological components, applicational elements and the point of emergence. Firstly, although in theory any physical object could be considered a technology, in the contemporary context emerging technologies are usually assumed to have digital components (but they do not have to be exclusively digital and are often comprised of other elements) that support information flows involving data (including personal data). Secondly, it is important to note that an emergent technology is not usually a single technology but rather an assemblage combining a range of technological components or developments integrated into a new 'technology' or application. Thirdly, technologies may be considered emergent if they are being combined into a new application, a new service area or are facilitating emerging new informational relationships and ways of working. Finally, emerging technologies may have been recently introduced into a specific setting, be at point of implementation, trial, in development or envisioned but not yet in existence.

We also acknowledge that in order to ensure proper use of technology is facilitated, rather than inadvertently prohibited, it is important to be as clear as possible on the intended specific use cases of various technologies in policing. For example, Artificial Intelligence could be used in number of different ways in various policing contexts. However, sometimes the literature is not specific, and it may not be possible to envisage and therefore consider all potential intended use cases in policing.

Finally, we would like to highlight that our focus was on the application of new technologies on areas of policing that are within devolved competence of the Scottish Parliament (i.e. not covert policing technologies, Counter Terrorism applications etc.), since such devices and technologies, and their authority for use, and independent oversight, stems from legislation reserved to Westminster. Furthermore, where our recommendations refer to policing bodies we are focused on the Scottish context, i.e. Police Scotland, SPA Forensic Services and on policing oversight bodies such as SPA, Police Investigations and Review Commissioner (PIRC), His Majesty's Inspectorate of Constabulary (HMICS) and the Scottish Biometrics Commissioner (SBC).

2.6 Limitations and disclaimer

This final report reflects the work of the Chair, IAG members, workstream members and research team who have done their best given the time and resources available to them. Clearly, emerging technologies in policing is a vast topic so there were limits to the amount that could be covered by the group and in this report. For example, it is noted that given the remit of the group much of the analysis focuses on identifying issues (legislative gaps, social and ethical implications) to drive improvement, rather than highlighting the benefits of technology. However, we acknowledge that there is a balance to be sought in ensuring appropriate safeguards are in place, whilst also enabling policing to embrace new technologies in order that it may fulfil its statutory duties. Also, in places some of our commentary is quite general in mentioning technologies instead of considering their various specific use cases in policing, which we acknowledge would have been preferable but was not always possible.

Furthermore, we have generally analysed and commented on current legislative frameworks in force at the time of writing. This has excluded consideration of UK Government proposals to reform data protection and human rights in the forms of the Data Protection and Digital Information Bill and the Bill of Rights Bill. For data protection matters, we consider standards under the European Union General Data Protection Regulation and Law Enforcement Directive (which are currently implemented in UK law) to be best practice and should continue to be followed by authorities in Scotland even if the Data Protection Act 2018 is repealed or reformed.

It is worth noting that this group was established during the COVID-19 pandemic, which put additional work and personal pressures (illness, childcare etc.) on individual members and organisations and impacted the work of the group and its timescales. Furthermore, some members were not in a position to contribute as much as hoped, some organisations had to withdraw and others declined invitations to join the group due to resourcing constraints. For example, this meant that the input from third sector and civil society organisations was not as strong hoped.

As the Chair of the IAG I have endeavoured to facilitate critical and constructive dialogue between members on this topic and I am pleased that we have managed to work together in an open, honest and respectful manner. This report represents the final output of the IAG. The recommendations do not necessarily reflect the views of the individual members, or of the individual organisations represented on the IAG, which may vary on certain issues.