Biometric data retention: review report

Annex C

Summary of stakeholder feedback in relation to a targeted consultation on the first draft of this report.

Overview

1. The review team produced a first draft of its report including its draft findings and recommendations. The review team circulated this draft to a targeted list of stakeholders in July 2024. Such stakeholders came from criminal justice, privacy & human rights, academic & research and legal fields. They were consulted on the draft as it was considered by the review team that they would have a substantive interest in the draft report's findings and recommendations from either a policy or operational interest.

2. The list of stakeholders was as follows:

• Ada Lovelace Institute
• Big Brother Watch
• Biometrics and Surveillance Camera Commissioner for England & Wales
• Children and Young People's Commissioner Scotland
• Crown Office and Procurator Fiscal Service
• Dr Aaron Amankwaa, Northumbria University
• Dr Genevieve Lennon, University of Strathclyde
• Faculty of Advocates Scotland
• Genewatch UK
• Home Office Biometrics & Forensics Ethics Group
• His Majesty's Inspectorate of Constabulary Scotland
• Information Commissioner's Office
• Leverhulme Research Centre for Forensic Science
• Lord Advocate
• Lord Justice General
• No 2 ID Scotland
• Nuffield Foundation
• Open Rights Group Scotland
• Police Investigations and Review Commissioner
• Police Scotland
• Professor Carole McCartney, University of Northumbria
• Professor Pete Fussey, University of Essex
• Professor Shannon Vallor, Edinburgh Futures Institute
• Professor William Webster, University of Stirling
• Scottish Human Rights Commission
• Scottish Parliament Criminal Justice Committee
• Scottish Police Authority
• Scottish Police Authority Forensic Services
• The Lord Justice General
• The Law Society of Scotland
• UK Biobank

We asked -

3. The review team therefore invited general comments on the content of the draft report. Not all stakeholders who were invited to provide comments submitted a response to the review team.

4. An anonymised summary of the feedback received by the review team on the draft report is set out below. It is intended to highlight the common themes raised by those who responded.

You said -

5. The responses received indicated that there was broad support for the

recommendations made by the review with some further suggestions made to the review team on either to expand on such recommendations or how to best enhance implementation of such recommendations.

6. Those who responded either provided general comments on the content of the report or offered suggested amendments on specific sections of the report.

7. A summary of key points raised by respondents is set out below. These points have been broken down under the themes identified for consideration in the report itself – Legal, Procedural, Research and Ethical considerations.

Legal Considerations

• Although some respondents recognised the limitations and challenges of bringing forward legislation, concerns were raised around the sufficiency of the existing law The reasons given for this were:
  • certain types of biometric data (such as custody images) not been specifically provided for – including a suggestion that such matters had been left to take their own course;
  • the complexity and accessibility of the current legislation - how understandable this currently is to an individual and whether this could currently be considered as representing best practice.
• The anticipated trajectory in new and emerging biometric enabled technologies being used for policing purposes builds to the case for legislation to be reviewed.
• A review of the Scottish legislation also requires to be cognisant of the interplay with retaining biometric data in accordance with wider data protection laws.
• The importance of setting a clear timetable for existing Scottish legislation to be reviewed was a theme raised by some respondents.
• There were mixed views on the law relating to volunteer data as some stakeholders felt that the current indefinite retention provision was not proportionate, while others felt that the power of the volunteer to withdraw their consent at any time was sufficient to over cover any disproportionality issue.

Procedural Considerations

• The absence of challenge to current retention policies should not be read as equating to these policies being considered as sufficient.
• Retention periods set in legislation for example should serve only as an indicator of the maximum time that retention can take place – they should not be the default position.
• Biometric data must always be subject to periodical review during such retention and reviews should be undertaken in accordance with data protection principles.
• The continuous retention of volunteer biometric data needs to be assessed as a priority to ensure such retention is still providing value and to mitigate any risks that such data is being used for purposes beyond what was originally intended.
• The consideration of retaining biometric data from those convicted requires a balance to be struck between rehabilitation (including relevant laws) and the risks of recidivism.
• In devising retention policies, it is important to strike a balance that takes into account both the needs and outcomes desired by the criminal justice system and addresses the impact that such policies have on the individual concerned and society as a whole.
• Any options appraisal undertaken in due course to revise retention policies requires to be subject to an appropriate level of public scrutiny and consultation.
• Clear guidance should also be provided on any changes proposed to retention policies as to enhance public understanding.

Research Considerations

• The evidence provided in the report on volumes of data held internationally and the different approaches taken to retention of biometric data in other jurisdictions was welcomed by some stakeholders.
• The evidence base around the value of retaining biometrics should be developed. Further research and analysis of existing practices in other jurisdictions may be beneficial in assisting and enhancing future reviews.
• The potential scope and methodology to be employed in future research should therefore be carefully considered.
• Further evidence is required to inform considerations around amending re-sampling timeframes given that the existing legislative timeframe appears to be arbitrary.
• A further suggestion indicated that such a timeframe should not form part of the law but be managed by a policy based on case by case basis.

Ethical Considerations

• It is important that the review recognises the types of actual harms to individuals and groups that can result from the failure to ethically use biometric data.

We did -

8. All feedback received from stakeholders on the draft report was acknowledged and carefully considered by the review team. Amendments were made to the draft report by the review team where this was considered by the team to be appropriate.

9. A final report was subsequently published by the review team following ministerial approval. A copy of the final report was also laid in the Scottish parliament.