Use of biometric data: report of the independent advisory group

8 Retention Periods

8.1 Members of the public and those involved at Police Scotland and the SPA should have greater clarity about retention periods. Subject to anything learned from evidence which becomes available in the future, these periods should be the same for all biometric data even if it is kept in different databases. On present evidence, which is extremely limited, there seems to us to be no justification for different retention periods across different types of biometric data. That raises the question of what is an appropriate retention period. The best answer is probably a period specific to the various factors relating to the particular individual and any offending or alleged offending, taking account of prior criminal history, outstanding allegations and risk assessments. Although appropriate and manageable in relation to children, such a case-specific approach would undoubtedly be unduly burdensome when it comes to the majority of cases.

8.2 Current retention periods, indefinite and specific, are essentially arbitrary – there is little or no evidence to support any particular period. The requirements around transparency and accountability, as discussed in Chapter 4, 5 and 6, should assist in determining if we can better identify appropriate periods. Current retention periods, although contained in primary legislation, should be reviewed and, thereafter, kept under review along with the Code of Practice. This should be done on the basis of consideration of such evidence as is, or becomes, available, in Scotland and elsewhere. It may not be possible to specify a particular period for ongoing review, as it should relate to the availability of suitable evidence. Specifically, we have in mind evidence about the value of biometrics in the investigation of certain offences, re-offending rates relating to different crimes, the escalation of offending, and the value that biometric retention has in the investigation of this escalation. In assessing the value of biometrics in the investigation of certain offences, the experience of police officers, prosecutors and others will be of assistance. Scope for this level of discrimination in retention policies has been recognised, for example, in the 2016 report of the UK Biometrics Commissioner which states:

8.3 ‘For some crimes biometrics are often of importance in identifying the offender (e.g. burglary ^[104] ), for others they may be (e.g. rape) and others rarely (e.g. domestic violence) ^[105] .’

8.4 It occurs to us that the Risk Management Authority may have evidence or insight to offer in relation to matters relevant to determining appropriate retention periods. This could be explored by the Commissioner in due course.

8.5 It is possible also that some evidence of the type we suggest will become available through the work of the UK Biometrics Commissioner. In England and Wales, Chief Officers of Police can apply to the UK Biometrics Commissioner to retain the biometrics of people, with no prior convictions, who have been arrested for a ‘qualifying offence’ ^[106] but neither charged nor convicted. The police must persuade the Commissioner that retaining the biometrics will be useful in the detection, prevention or deterrence of crime. Since the relevant sections of the PoFA came into force on 31 October 2013 to 31 December 2016, 386 such applications to the Commissioner were received. Biometric material held following a successful application to the Commissioner has only recently come to the end of the initial three year retention period. The UK Biometrics Commissioner has mentioned the possibility of relevant evidence from this aspect of his work:

8.6 ‘Since the first applications to the Commissioner…to be approved were in relation to material taken in November 2013, over the coming months and going forward it is my intention to examine the rate of conviction for subjects during the 3-year period that their biometrics are retained ^[107] . ‘

8.7 For the avoidance of doubt, we do not suggest replicating any other existing procedure in England and Wales, merely looking there for relevant evidence or guidance as to an appropriate approach to the retention of biometric data.

8.8 Currently, retention periods vary between two or three years (subject to extension on review) to indefinite retention. Attempts to refine rules on data retention, particularly those which permit indefinite retention, are appropriate, not only on a human rights basis but also because ‘…over time limitless retention of records would inevitably clog the databases with biometrics of no further utility at increasing expense to the tax-payer… ^[108] ’

8.9 There is no evidence enabling us to make any recommendation about the appropriateness or otherwise of current retention periods. Such evidence should be sought and considered as part of ongoing review. In the meantime, it cannot be said that current determinate periods are incorrect or unjustified. They also coincide with equivalent periods in England and Wales.

8.10 The picture can be kept under review by the Commissioner in light of any evidence.

Areas for review

8.11 Indefinite retention: The proportionality of indefinite retention of biometrics of all convicted persons, with no differentiation reflecting the gravity of offence, is to be considered by the ECtHR in the case of Gaughran. Notwithstanding the decision of the UK Supreme Court, discussed in Chapter 4, it is questionable whether such a blanket policy is proportionate, and consideration should be given to amending the current approach. It appears to us that there should at least be a review of the current indefinite retention rules based on a single conviction, taking account of any emerging changes in jurisprudence, whether in Scotland, England and Wales, or at the ECtHR. To whatever extent is currently possible, and certainly in relation to ongoing review, this should be research led and consider not only the gravity of the offending but also the value of biometrics in the investigation of certain offences, re-offending rates relating to different crimes, the escalation of offending, and the value that biometric retention has in the investigation of this escalation.

8.12 Children: Review of retention periods should also extend to those applicable to children’s data. If, however, an individualised approach is adopted for the retention of each child’s data, regardless of whether proceedings are taken at court or through the Children’s Hearings system, as suggested in Chapter 7, this may not arise. Otherwise, there should be a review of retention periods as they relate specifically to children, including the three year retention period where grounds of referral are established (whether through acceptance by the child at such a hearing or a finding at court) in relation to a prescribed sexual or violent offence and the possibility of indefinite retention if a child is convicted of any offence at court.

8.13 Fiscal offer/Fixed penalty: There should be consideration of differentiation in the length of data retention when someone has chosen to accept a disposal e.g. a fiscal offer or police fixed penalty, as opposed to those who do not and who are then not convicted. It is important to recognise that such offers/penalties do not operate on the basis of a requirement for formal acceptance. They operate by way of presumption that they are accepted unless challenged. If disputed, the individual must therefore take formal steps to challenge the penalty. There is a disparity here, and it is unlikely that all of those who ‘choose’ to accept such an offer or penalty are aware that they are doing so, or of the full implications of inaction. Retention of biometric data in such circumstances should be reviewed, and public awareness raised around the issue. To whatever extent possible, this review should also be research led and consider the matters referred to above in relation to indefinite retention.

8.14 In summary, the Government should consider reviewing sections 18 to 19C (excluding section 18G which relates to reserved matters) of the Criminal Procedure (Scotland) Act 1995 in relation to:

• Potential indefinite retention of biometric data following conviction
• Retention of biometric data of children (see Chapter 7)
• Retention of biometric data subsequent to a fiscal offer or fixed penalty.

8.15 To complete the review of these sections, the definition of ‘relevant physical data’ in section 18(7A) of the 1995 Act should be expanded so that it is wide enough to include all existing, emerging and future biometric technologies. While DNA, fingerprints and photographic images involve familiar technologies, such a new definition would allow for others, including some which have not yet been developed. Expanding the statutory definition is consistent with the idea of establishing a legislative and ethical framework for regulation and oversight in this area which will be able to adapt to new technologies in a way which improves public protection while safeguarding human rights. The expanded definition should not be used to allow the capture, storage, retention, use and disposal of biometric data using emerging and future technologies in regular policing practice until they have addressed the matters referred to in our section on validation in Chapter 5. One means of addressing this would be to stipulate that, before any other type of biometric samples could be taken, there would require to be legislative approval following consultation. To avoid unnecessary delay, such approval could be given by way of statutory instrument rather than amending the 1995 Act. Secondary legislation made under a new delegated power in the 1995 Act could be subject to the affirmative procedure in Parliament, which would mean the legislation would have to be approved by Parliament before it came into force. Provision might also be made for the Commissioner to trigger an ad hoc investigation and report that would be laid before, and considered, by Parliament. That way any statutory instrument would still be subject to broader consideration. This would help to ensure proper oversight, scrutiny and flexibility, without blocking technological progress of benefit to the public.

Presumption in favour of deletion

8.16 In view of the fact that data retention is an interference with the right to privacy, the obvious approach is to have a presumption in favour of deletion following the expiry of any minimum retention period. On this point, see also paragraph 2.8 of the submission to the IAG by No2 ID Scotland and pages 14/15 of the submission by the Open Rights Group.

8.17 We acknowledge that public protection is a relevant factor to be considered in looking at the question of a presumption.

8.18 We recognise, also, that a presumption for deletion may have practical and resource implications. It has not been possible to ascertain, or even estimate, the likely greater costs associated with our recommendation of a presumption in favour of deletion. No doubt, the Government will wish to obtain accurate costings of the two alternatives. It may be that some of these costs will be addressed more easily with the new National Custody System.

8.19 If the presumption is for deletion, there would still have to be a procedure to allow individuals to apply for deletion where a decision was made to retain their data notwithstanding the presumption. Likewise, in the event of a presumption in favour of retention, there would need to be a procedure to allow individuals to seek the deletion of their biometric data.

8.20 Any such procedures would involve a level of bureaucracy and expense, as well as requiring far greater public awareness of this area, including any rights to apply for deletion. It may be worth consulting on this aspect, including views on assistance for individuals to navigate the process, especially for children and vulnerable individuals. There may also be a question as to whether fees should be payable. If there is to be such a system, it should be arranged to ensure maximum opportunities for individuals to use it, undeterred by complexity or cost.

8.21 There needs to be greater public awareness of the position regarding retention. Police officers should explain the relevant retention periods to individuals when biometric data is being captured. Consideration should be given to the best means of doing so effectively, whether by handing over brief information sheets, direction to a website, or some combination of such methods. The Commissioner should carry out work to ascertain the best means of increasing public awareness in this area as well as more generally.

Recommendation 5

There should be a review of the rules on retention of biometric data in sections 18 to 19C of the Criminal Procedure (Scotland) Act 1995, considering all questions of proportionality and necessity. The review should be research led and consider not only the gravity of the offending but also the value of biometrics in the investigation of certain offences, re-offending rates relating to different crimes, the escalation of offending, and the value that biometric retention has in the investigation of this escalation. It should be informed by any developments in the law in Scotland, England and the European Court of Human Rights.

Recommendation 6

There should be a presumption of deletion of biometric data after the expiry of prescribed minimum retention periods.

Recommendation 7

Evidence should be gathered from which continuing assessment can be made about appropriate periods of retention of biometric data. Public consultation should include specific questions on retention periods.