Biometric data retention: review report

Introduction

1. Following the 2018 report of the Independent Advisory Group (IAG) on the use of biometric data in Scotland^[1], the Scottish Government (SG) committed to reviewing the retention of biometric data provided for under sections 18 to 19C of the Criminal Procedure (Scotland) Act 1995^[2] ("the 1995 Act") as recommended by the IAG. The 1995 Act is the primary Scottish legislation allowing the collection and retention of fingerprints and other biometric samples (including hair samples and nail clippings) from a person arrested by the police. Although the 1995 Act does not include reference to facial images, the IAG did include these in its review.

2. Since 2018, it is recognised that many of the IAG's findings relevant to the laws of retention have been at least partly addressed or mitigated by subsequent developments in the intervening period such as the:

• commencement of United Kingdom (UK) -wide Data Protection Act 2018 ("the 2018 Act")^[3] and in particular the provision for data controllers to ensure that retention is subject to periodical review;
• the European Court of Human Rights' judgement on 'Gaughran v UK^[4] ("the Gaughran judgement) in 2020;
• commencement of the Scottish Biometrics Commissioner (SBC) Act 2020^[5] ("the 2020 Act") and the appointment of the SBC in 2021 which provides oversight of the collection, use, retention and destruction of biometric data by Police Scotland, the Scottish Police Authority (SPA) and the Police Investigations and Review Commissioner (PIRC);
• implementation of the SBC's Code of Practice^[6]("the Code") and public complaints mechanism^[7] in 2022;
• planned rolling programme of annual compliance assessments with the Code undertaken by the SBC which began from late 2022;
• annual thematic assurance reviews already undertaken/proposed by the SBC on particular subject themes;
• establishment of the Police Scotland Biometrics Oversight Board (which meets every 6 months and has the following areas of business: Biometric Data; Forensic Biometrics; Biometrics Technology; Ethics).

3. In the course of 2023, the SG and the SBC (the review team) therefore considered whether a review of retention periods as recommended by the IAG was still required. Such considerations also included consultation with the SBC's own independent advisory group. The review team concluded that such a review could still be beneficial.

4. The purpose of this review is therefore to generate findings in respect of the retention of biometric data for policing purposes at this current time. The review makes recommendations as considered necessary – with a view to ensuring that the approach taken to the retention of biometric data is lawful, ethical, effective and proportionate. Further background to the scope of the review is set out at Annex A of this report.

5. It is recognised that biometric retention in Scotland is informed by a combination of legislative requirements and police retention policies. The review therefore considers three distinct areas - the legal provision concerning the retention of biometric data; the current policy and procedures adopted by Police Scotland; and the current available evidence base in order to support its findings. The review also recognises the importance of ethical and human rights considerations on such matters. It is expected that the findings from this review may inform the policies and procedures of the SG, the SBC and policing partners going forward.

6. For the avoidance of doubt, the scope of biometric data considered in this report are fingerprints, deoxyribonucleic acid (DNA) profiles and custody images. Although images do not feature in the 1995 Act, the review team have included them in the course of their work for completeness. This reflects their longstanding use by police in the detection and prevention of crime and their inclusion in the 2018 IAG report, from which this review originates.

7. The review team also wish to highlight that they were unable to ascertain a legal definition of what constitutes indefinite retention of data. As such, the review team interpreted it as meaning of long duration with no end date specified.

8. While the review has been progressed on a collaborative basis between the SG and the SBC, the review team wishes to acknowledge the input and expertise of Police Scotland which supported the review as a strategic partner, attended the regular progress meetings of the review team and advised on operational matters relating to the retention of biometric data. Particular thanks are offered to Gillian Jones, Head of Biometrics and Diana Dundas, Biometric Data Lead in this regard.

9. The review team would like to thank Professor Carole McCartney, Dr Aaron Amankwaa and Dr Genevieve Lennon who met with the review team and provided helpful insight and advice on the available evidence base.

10. The review team is also grateful to members of the SBC's advisory group for their support in considering an earlier draft of this report. That advisory group consisted of independent academics, the SPA, His Majesty's Inspectorate of Constabulary in Scotland, Police Investigations & Review Commissioner, Crown Office and Procurator Fiscal Service (COPFS), Scottish Human Rights Commission, Children and Young Peoples Commissioner for Scotland and the Information Commissioners Office. The review team is also grateful to other bodies who, whilst not part of the advisory group, responded to an invitation from the review team to provide feedback on an earlier draft of this report. An anonymised summary of feedback received is attached at Annex C to this report.