Biometric data retention: review report

Executive Summary

11. Biometric data is important to the detection of crime - bringing perpetrators to justice and exonerating the innocent. How biometric data is managed following acquisition continues to raise questions for society as a whole in ensuring that this is undertaken by the police in a lawful, effective, ethical and proportionate way.

12. This review has therefore focused on the current legislative landscape around retention; the retention policies and procedures currently adopted by Police Scotland; and the current research and evidence base available on biometric retention in the UK, European Union (EU) and beyond.

Key Findings and Recommendations

13. The review finds that the current research and evidence base on biometric retention in the UK, EU, and wider is not sufficiently developed to enable a robust proposal to be made around alternatives to current Scottish law and operational rules. It is considered, at this time, that there is not a gold standard of retention that Scotland should seek to follow, as a variety of approaches are being taken by different countries in regard to the retention of biometric data.

14. The review finds that the law on the retention of biometric data as set out under Section 18 of the 1995 Act^[8] complies with human rights and recent legal judgments, based on the available evidence. In terms of future-proofing the legislation, the review found that a more robust evidence base was required in order to determine whether and how Scotland should change its existing legislation for biometric retention. The review does however acknowledge that (although not included in the scope of the review), issues around the acquisition and use of biometric data - particularly images - would benefit from further exploration going forward.

15. The review finds that Police Scotland does not currently have a bespoke policy on the retention of biometric data taken for policing purposes. The retention of biometrics is instead aligned to a separate retention policy for retaining a person's criminal record and retaining productions as part of evidence in criminal proceedings.

16. The review finds that Police Scotland and the SPA do not hold sufficient management information on biometric data to determine a suitably overarching policy on retention. However, the review team acknowledges that as a result of self-assessment activity relating to the SBC's Code of Practice, Police Scotland and the SPA Forensic Services are currently developing distinct biometric strategies as part of strengthening their internal governance.

17. The review finds, in principle that the one-month timeframe for the taking of samples and prints under section 19 of the 1995 Act (where previous acquisition proved unsuitable/inadequate) could benefit from further review – subject to further evidence being provided by Police Scotland to support a case for change to that timeframe.

The following recommendations aim to assist these findings:

1. The existing retention periods for the biometric data of non-convicted persons should remain as set out in the 1995 Act.

2. For now, the current legislative silence in the 1995 Act should be retained with regard to the retention period for the biometric data of convicted persons, subject to

• the outcome of Police Scotland reviewing its retention policies.
• the findings of a robust evidence base once this has been assembled by Police Scotland.

3. Police Scotland to set up a Short Life Working Group to develop an options appraisal for their retention policies for the biometric data of convicted persons, which is evidence-based; observes the need for proportionality and necessity; and complies with the law and relevant legal rulings of the European Court of Human Rights (ECtHR), particularly Article 8 ECHR. The options must expressly prohibit indefinite retention without periodic review. The options should be consulted on, and new policies should be put in place by 31 October 2025.

4. Police Scotland should, as matter of routine, collect and retain accurate and robust management information in respect of the retention of biometric data going forward. This information should provide a solid and transparent evidence base to support future assurances that such retention policies are lawful, ethical, effective and proportionate.

5. Police Scotland should accelerate their current review of retention periods for volunteer data and put changes into place by 31 October 2025.

6. Police Scotland should collect management information to ascertain whether the one-month timeframe under Section 19 has caused any operational difficulty. If such evidence exists to support the need for change, the SG should consider bringing forward primary legislation, subject to consultation.