Use of biometric data: report of the independent advisory group

1 Definitions – Biometrics and Biometric Data

1.1 The term ‘biometric data’ is not defined in existing criminal justice legislation in Scotland. The terms ‘biometrics’ and ‘forensics’ are sometimes (wrongly) used interchangeably.

1.2 There are different definitions and explanations of biometric data, often derived from the relevant technology or specific use of the data. In a policing and criminal justice context, such data can be used to assist in identification of individuals for a variety of purposes – exclusion, incrimination and simple identification of unknown persons. The reliability of such assistance can vary considerably, depending on different factors, including the type of data, the methodology or technology used and the purpose of data collection.

1.3 Regulation of such data should also apply to samples or material from which data can be obtained. We have heard concerns about this area being overlooked through a focus on processing and data. This is subject to the need to retain evidential samples of biometric material for the purposes of an investigation. Such material, sometimes referred to as ‘crime samples’, and associated profiles, is not kept on a database and is retained for as long as a criminal investigation remains open. Our report does not cover this material.

1.4 Biometric data can be produced from many different sources, whether personal, for example, fingerprints and blood, or technological, for example, CCTV footage or images from body worn cameras.

1.5 It may have been simpler if we had felt able to adopt an existing definition, but we wanted to ensure that we captured the widest extent of police and related activity in biometrics, especially as it is a fast-developing area. As new science and technologies emerge, it seems likely that there will continue to be an increase in sources of biometric data. We were also concerned that some existing definitions appear to exclude even obvious biometric data such as DNA profiles.

1.6 For our purposes, we settled on a brief and simple definition. It is intended to include all known biometric data and should be capable of encompassing existing, emerging and future biometric data ^[15] .

Definition

1.7 ‘Biometric data are any physical, biological, physiological or behavioural data, derived from human subjects, which have the potential to identify an individual.’