Legal frameworks and ethical standards workstream report: Final Report

6. Looking to a fair future

6.1 Especially since the Cyber Kiosks scenario in 2018-2019, Police Scotland are more mindful of the ways in which Article 6 ECHR (right to a fair trial) is engaged in the carrying out of their functions. However, there may be consequences of police activities with digital technologies that are unintended and unknown, and which may also impact Art 8 (right to private life) and/or have specific impacts for the protected groups in EA 2010. There is limited analysis or evidence of how policing activities may engage Art 8 or EA 2010 provisions when police use new technologies.

6.2 In addition, there are also distinct and emerging risks that widespread use of surveillance tools and AI-enabled technologies is undermining citizens' digital rights and hindering their willingness to meaningfully participate in democratic processes. The UN Special Rapporteur on the freedom of peaceful assembly and association has raised concerns about the increased use of digital surveillance tools in the context of peaceful assembly.

6.3 Scottish Ministers, Police Scotland, and other relevant decision makers must adopt and implement an approach that embeds and mainstreams equality and human rights into the use of new technology in policing. This includes incorporating equality and human rights legal frameworks and principles into new legislation, codes of practice and guidance.

6.4 These governance issues have been raised by previous reports and groups in Scotland, including the Fraser Report, HMICS and the Biometrics IAG. The lengthy Justice Committee scrutiny of Biometrics raised these issues as well. Notwithstanding the current work of the IAG, the Cabinet Secretary's position that this issue of the legal basis for cyber kiosks should ultimately be settled by litigation is not consistent with a best practice philosophy, transparency or accountability.

6.5 The three milestones on Police Scotland's recent engagement with biometrics and emerging technology echo this. While the appointment of the Biometrics Commissioner for Scotland is further movement towards fulfilment of these ideals, the effectiveness of the role remains to be seen. In the meantime Police Scotland as the bearers of specific equality and human rights duties, must ensure non-discrimination, advances equality and fosters good relations.

6.6 The Scottish Police Authority established a working group to consider options for the future delivery, accreditation, oversight and governance of digital forensics in Scotland. This working group focused on operational structures and human rights within frameworks external to Police Scotland. However notable absences were recommendations that Police Scotland take operational steps to incorporate human rights within its internal ethical and operational frameworks, for example by adopting a human rights based approach.

6.7 As set out in Section 3 of this report, Police Scotland have been establishing ethics panels at local, national and overarching levels. However, this process has been delayed by the COVID pandemic.

6.8 The Biometrics IAG provided both a human rights analysis and a draft Code of Practice arising out of this. Their analysis incorporated the Scottish Human Rights Commission PANEL principles, and the Code therefore functionally reflects these. As the group set out, their consideration included technologies associated with biometrics which are many of the technologies that are emerging for policing purposes. The code therefore has use beyond DNA, fingerprints and photographs. Indeed, digital forensics such as facial recognition and cyber kiosks have been specifically identified as being within the remit of the report because of the extent to which they engage with identifiable personal data. The EHRC's submission to the consultation on the draft Code of Practice welcomed the references to the PSED and recommended that this should be strengthened by:

a) Making specific reference to the duty to assess and review the equality impact of proposed new or revised policies and practices when they are at their developmental stage;

b) Clearly setting out the different forms of prohibited conduct defined in EA 2010; and

c) Ensuring the associated complaints procedure is accessible and inclusive, with both on and offline means of engaging, and reasonable adjustments made where appropriate.

6.9 In ECtHR jurisprudence, in particular the Weber case from 2006, the Court has set out minimum standards for use in legislation governing the interception of communications on the basis that Art 8 is engaged. This included detailing the procedure to be followed for examining, using and storing the data obtained and the legislation should also include the precautions to be taken when communicating the data to other parties (Weber (2006) E.C.H.R. 1173 at [95].). Earlier decisions had been strikingly specific in setting out these standards for police including a rubric of 6 minimum criteria (Valenzuela Contreras (1999) 28 E.H.R.R. 483 at [46].).

6.10 Drawing on the jurisprudence across common law jurisdictions it appears that there would be an advantage to Police Scotland in considering that Article 8 is engaged wherever their technology is used to collect data that could on its own, or in conjunction with other data, identify people or personal characteristics. This includes any type of surveillance whether general or targeted. The engagement of Article 8 introduces a body of jurisprudence that has a strong basis in international law and parallels with common law jurisdictions such as Canada. ECHR makes it of fundamental importance to the legality of any action taken by Police Scotland.

6.11 An additional potentially useful endeavour would be for Police Scotland to formally commit to taking, and further embedding and enhancing, a human rights-based approach, particularly in evaluating any use of emerging technology or change of use of existing technology. PANEL is not a new approach for Police Scotland. They have had this tool recommended to them numerous times by the Scottish Human Rights Commission and others. Through collaboration and capacity building, senior officers in Police Scotland and the SPA have been introduced to PANEL in contexts specific to Policing. In 2014 Police Scotland was heavily involved in compiling Scotland's National Action Plan for Human Rights and in that context, committed to identify[ing] opportunities to further embed human rights within the structures and culture of policing, including strengthening accountability for the respect of human rights as well as training on human rights for the police. It would, for example, help ensure legality and proportionality in the use of force and stop and search by Police Scotland through adequate training and monitoring, including the collection of disaggregated statistics.

6.12 Police Scotland practices already embody elements of a human rights based approach, such as public consultation, accountability to SPA and HMICS. However this could be further embedded and enhanced. Knowledge and understanding have been disparate and unsystematic. Much of the critique of the handling of Cyber kiosks was about the lack of a systemic approach to an area that clearly engaged equality and human rights. While individual officers were accounting for Police Scotland's performance, it became clear that there was no central understanding of the equality and human rights issues involved, nor did Police Scotland retain the resource to build human rights capacity. As noted above, there is no evidence that the SPA did either. What the PSED and PANEL offers are two authoritative frameworks for decision-making in relation to operations and behaviours. SHRC recommends that Policing should further embed human rights standards within five broad areas:

• Policy and strategic decision making;
• Operational planning and deployment;
• Training and guidance;
• Use and control; and
• Investigation, monitoring and scrutiny.

6.13 As part of meeting the requirements of the PSED equality should also be embedded in these areas.

6.14 This includes, by implication procurement of technology and the resourcing of its continuous use by Police Scotland. There is no aspect of these five areas that does not incorporate emerging technologies. Rather than consider them a niche or bespoke area, Police Scotland has an opportunity to centralise the issue while demonstrating its commitment to human rights. Police Scotland have been responsive to human rights concerns over issues such as the creation of a single police force, Stop and Search practices, Taser use, Scottish Biometrics Commissioners Bill, Facial Recognition and Cyber kiosks. The common thread here is a lack of human rights-based decision-making which has necessitated corrective action in response to external pressure. This fails to embody best practices in policing and is contrary to the wider duty to respect protect and fulfil human rights.

6.15 A formal commitment to adopting, implementing and enhancing an equality and human rights based approach in this area would ideally be accomplished through internalising human rights knowledge and capacity. For example Police Scotland could employ equality and human rights experts in order to assist in policy design, analysis and assessment. By delivering equality and human rights knowledge, training and support to senior officers these experts would be embedding and mainstreaming such knowledge at every rank and in every aspect of policing. An organisation that places equality and human rights as a fundamental element of its function ought to be considerably well versed in equality and human rights based practices, to the extent that a complete equality and human rights impact assessment including a legal basis should be immediately available in a way that has been lacking.

6.16 Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner must comply with the SBC's code of practice when exercising functions related to biometrics. A court or tribunal in civil or criminal proceedings must take the code of practice into account when determining any question to which the code is relevant. That a clear set of principles for the management of biometric data is required is unanimously agreed. The Draft code meets the approval of a broad spectrum of experts including some within Police Scotland and the Scottish Police Authority and is therefore authoritative and of a high standard. The code was included in the public consultation on the Scottish Biometrics Commissioner Bill and the evaluation of the consultation reported good engagement with the code.

6.17 It has been pointed out that public trust and confidence would be damaged without considered consultation and debate where there were complex legal, ethical and societal challenges to be resolved. It must be acknowledged that policing through intrusive technologies is a departure from the core democratic value of policing by consent. What Cyber kiosks, facial recognition, algorithmic policing all have in common is that these are privacy intrusive technologies that require careful use. Deployment is only lawful where the processing is fair, necessary and proportionate response to a pressing social need and where a robust risk assessment with sufficient mitigations have been completed. These assessments should be completed prior to any decisions about whether to deploy or not for any given purpose. Police Scotland must seek ever stronger safeguards to preserve the public trust that they rely upon in all of their functions when considering the use of emerging technologies such as these.