Use of biometric data: report of the independent advisory group

3 Public Awareness and Confidence: Perceived Benefits and Concerns

3.1 In general, there appears to be a lack of knowledge of, and relative lack of interest in, biometrics and biometric data on the part of the public. This is consistent with evidence about public awareness of new technologies more generally.

3.2 There is occasional political and media interest in the subject, with concerns having been expressed, for example, at the Scottish Parliament ^[47] .

3.3 Public views on the use of biometric data in policing, insofar as known, appear to range from supportive to concerned. Much depends on the particular headline which attracts attention: for example, the use of facial recognition technology proved controversial at the Notting Hill Carnival in 2017, with stories of mistaken and unreliable identifications ^[48] . This is in contrast to the effective and apparently welcome use of such technology in South Wales at the Champions League Final and an Elvis Convention ^[49] .

3.4 Public reaction depends often on the framing and context of any stories and the amount of accompanying information. As well as taking into account the written submissions and other views we received, we have surveyed newspaper reports, social media and articles from which we have compiled these short lists of publicly perceived strengths/benefits and concerns/risks regarding the use of biometric data:

Perceived strengths/benefits

• Biometric data are a common resource in the criminal investigation process and often provide vital evidence for the purposes of identification or confirmation of a key individual (for example, a suspect or victim) in a police inquiry.
• Biometric data can be used to exclude or eliminate an individual from suspicion in a police inquiry.
• Non-criminal police inquiries use biometric data, such as those that involve tracing a missing person or identifying accident or fire victims.
• The benefits listed above contribute to general protection of life and other human rights.
• The hereditary nature of DNA means that it can be used not only for individual identification but also for the identification of family members (e.g. identifying a body through the DNA of a close relative).
• Routine security of personal data on electronic devices such as phones, laptops.
• The use of biometric data is now a core aspect of modern financial transactions, providing a service that is more secure than prior banking technology (thus preventing fraud and criminality) while at the same time improving accessibility and convenience to the public.
• As a means of maintaining border security.
• There are many legitimate research purposes for biometric data, and new advances in the use and governance of information sharing and data linkage can ensure that the data have wider benefits beyond that of the data itself.

Perceived concerns/risks

• Concerns about security and the ability to steal identity to facilitate fraud/spoofing.
• Concerns about where the biometrics data are stored and who has access.
• Concerns over possible state control and the loss of a right to anonymity.
• DNA phenotyping – the prediction of a particular trait, such as skin colour, according to the individual’s genetic makeup.
• Discrimination/prejudice – there is evidence of unconscious bias even in algorithms.
• Lack of transparency in algorithms due to commercial confidentiality.
• Linkage and sharing of different databases with development of a detailed picture of individuals without informed consent.
• Use of data for other than intended purposes.
• Length of retention periods.
• Sharing of data.
• Impact on privacy and other human rights.
• Familial identification – without knowledge/consent.
• Ethical considerations.
• Potential for misidentification or misuse.
• Incorrect assumptions about the effectiveness of biometrics, including the perception that some are infallible.
• Increased securitisation (through security agendas dominating social policy debates) and increase in intrusive measures.
• Stigmatisation.
• Members of the public leave private information about their lives and activities across a wide range of public and private databases, and in public spaces. This allows for multiple ways of checking identity, modelling patterns of social behaviour, collecting or inferring attitudes and recording activities, movements and decisions. Therefore, behavioural or biographic sociometrics (which includes aspects of such modelling and recording) is an area of possible concern. This is a possible development, for example, in the analysis of CCTV footage. There is already some familiarity with simple versions of such analytics, for example when websites offer goods or services tailored to predictions of preferences or needs.

3.5 It will be observed that there is some overlap between perceived benefits and risks, for example, in relation to familial identification. Much depends on context. Well-informed debate should engage with these perceptions which are all valid, at least to some extent. Indeed, this is an area in which the benefits and risks co-exist, with greater public awareness being the key to justified levels of confidence and trust which recognise the advantages as well as the costs. From greater awareness should come an appreciation of some of the ethical considerations, with public support based on reality rather than the latest headline.

3.6 Biometric technologies continue to become an increasing part of everyday life for many, with apparent benefits in terms of fraud prevention, security and maintaining privacy. Think, for example, of mobile phones, passports, banking, schools, shopping, migration, terrorism and CCTV. There is increasing familiarity with such use of biometric data, albeit without much technical understanding, discussion or debate. This limited familiarity can lead to assumptions about reliability of biometric technologies, perhaps even extending to assumptions of certainty or infallibility. Such assumptions are misplaced.

3.7 None of the advances in such technologies leads to absolute certainty. The reliability of any technology will derive from a variety of factors such as its design, including the algorithms involved in processing data, and the context in which the technology is deployed. As such, the reliability of different biometric technologies may differ, sometimes significantly. Such subtleties tend not to inform the more basic use of biometrics which seems to the public to be reliable or at least unproblematic much of the time. In simple terms, the fact that a smartphone seems to work reliably by use of a thumbprint tells one little about the reliability of related technologies deployed in the criminal justice field to identify or exclude possible suspects.

Public Awareness

3.8 Increased use of biometrics appears to be technology driven, i.e. simply because the technology is available. Consideration of the risks that these technologies present ^[50] and their human rights implications have not received the public attention they deserve, despite the efforts of some politicians and journalists, and the UK Biometrics Commissioner in his annual reports and other statements. Of course, the UK Commissioner’s role in Scotland is confined to reserved matters which means he receives less publicity here than in England. In addition, the limitations of the technologies are not well understood. All biometrics technologies are subject to measurement uncertainty and their accuracy (false positives, i.e. mistaken identifications, and false negatives, i.e. mistaken exclusions) are rarely fully understood. This can affect public confidence in such technologies.

3.9 Some biometric data are captured with consent, for example, DNA (the Guthrie new-born test), airport security images. However, much biometric data can now be captured without consent or the awareness of the individual concerned, for example, images obtained from public space CCTV.

3.10 More specialist use of biometric technologies is also developing. One recent example is facial recognition technology which has attracted publicity in terms of both effectiveness and unreliability, with evidence and arguments supporting each opposing view.

3.11 There needs to be a wider debate about the various implications of the capture or surrender of biometric data, especially in terms of the implications for privacy. Privacy is not an infinite commodity. Bit by bit, especially in the capture or surrender of biometric data, a detailed profile of individuals can be assembled. The current reality is of increasing capture of biometric data by public bodies and private companies. Whether, and, if so, how, such data can also be accessed by the police is another area deserving of publicity, discussion and debate.

3.12 There are two different public discussions that we wish to see: first, discussion and debate of the specific proposals in this report, and, second, discussion and debate of broader issues such as whether regulation should extend beyond policing or beyond the public sector. It is important that both areas start to form part of the discourse which starts before public consultation.

3.13 It is important to improve levels of awareness, including awareness of any relevant minimum retention periods and opportunities to apply for deletion. While this does happen at present, it is not something which is publicised or widely known. No special steps are taken to assist the understanding of those with vulnerabilities which might affect the question of consent, and the extent to which it is fully informed.

3.14 We need clarity of purpose for all use of biometric data, with discussion about the extent to which the public is prepared to accept data linkage. There is likely to be increased movement towards convergence of different databases, for example, certain information on UK border control databases being linked to broader criminal justice databases. Sometimes such linkage may bring improvements and advantages, but it may also bring increased risks. Such data linkage should be subject to regulation and oversight and adhere to human rights and ethical principles.

3.15 Debate and discussion should address gaps in knowledge and understanding. This will assist in preparation for emerging technologies as the public, as well as police and others, become increasingly dependent on biometrics in their daily personal and working lives.

3.16 The extent of public knowledge and concern, or otherwise, should be gauged to inform possible public awareness campaigns. Consideration should be given to including suitable questions in the Scottish Social Attitudes Survey. While answers from the fuller survey could not be provided in time to inform the public consultation to follow our recommendations, it may be possible, in the shorter term, to use Scot/Cen’s smaller panel survey ^[51] . This could gauge public awareness, knowledge and confidence in relation to existing and developing biometric technologies, especially with regard to privacy and other ethical and human rights aspects. Information from these surveys can inform the development of policies and rules in the future, as well as offering some guidance to the Commissioner about areas of concern.

3.17 There are courses available in schools to teach online safety. It may be appropriate to expand these to include greater information about awareness of sharing personal data, including biometric data.

3.18 We envisage increased media engagement by biometrics experts (e.g. Professor Sue Black, Professor Jim Fraser). 2017 saw an increased public interface between crime writers and the legal profession, with discussions about the authenticity of crime fiction leading some writers to engage also with experts in forensic science. Other opportunities are being explored, as film-makers and TV companies seek to use authentic technology and real-life knowledge in presenting their stories ^[52] .

3.19 We see the website of the Commissioner as a valuable resource for disseminating information about biometric technologies and the use of biometric data. The Commissioner can arrange for work to be done to evaluate the effectiveness of biometric databases, something not done so far. The Commissioner can also work with public and other bodies in the field to seek to establish better reporting of their procedures and outcomes for the purposes of offering reassurance to the public and thereby providing confidence at an appropriate and justified level, managing expectations against greater awareness of the limits of reliability.

3.20 From our work, it is apparent that a number of individuals and organisations, academic and other, take an interest in developments in this area, including the ethical aspects of such developments. Many of them contributed written and other submissions to our Group. The Commissioner should be able to use some of that experience and expertise in seeking to increase awareness.

3.21 Lessons can be learned from similar work in England and Wales. In particular, it seems to assist public awareness when fairly specific and detailed case studies are provided on such websites.

3.22 The issues are of sufficient importance to require well-informed discussion and debate at the Scottish Parliament, both in the Chamber and by consideration at various committees whose work touches on the subject-matter, for example, Justice, Equalities and Human Rights, Health and Sport, Education and Skills. We have already engaged with members of the Scottish Youth Parliament who have agreed to discuss how best to engage with the subject there, with the likelihood of a full debate in the Youth Parliament at some point in 2018.

3.23 There is a role too for Government. Useful lessons might be learned from the experience of the UK Government in its response to the various Public Attitudes to Science surveys.

3.24 While our recommendation in this area may be more aspirational than in other Chapters, we consider the issue of public awareness to be of sufficient importance to be highlighted in this way.

Recommendation 1

There should be national debate to improve public understanding of, and confidence in, the retention and use of biometric data in Scotland for policing, law enforcement and other public protection purposes. Ideally, this should start before and continue during the Scottish Government’s public consultation, as well as featuring in ongoing discussion after consultation.