Biometric data retention: review report

Human Rights Analysis

Introduction

125. In a democratic society, the state has a fundamental obligation to protect the public from criminal activities and the police has a duty to investigate crime. However, this duty must be carried out in accordance with the protection and promotion of human rights, including non-discrimination and the safeguarding of personal data.

126. This section focuses on the impact of biometric retention on human rights, including references to judicial proceedings from national and international courts.

127. As a starting point, the retention (and use) of biometric data should take full account of, and not contravene, the framework detailed below. While compliance with the human rights law is essential for legal accountability, human rights also serve as a driver of a human rights culture, particularly for the design and delivery of public services. There are a number of public bodies which take such an approach in Scotland, including the SBC Code of Practice, which requires human rights compliance for the retention, use and acquisition of biometric data for criminal and policing purposes in Scotland.

Legal Framework

128. The relevant legal provisions include the following :

• Human Rights Act 1998^[45], which implements the European Convention on Human Rights^[46](ECHR) into UK law
• Equality Act^[47] and the Public Sector Equality Duty^[48] in Scotland
• UK GDPR ^[49] and the 2018 Act.

Human Rights Engaged

129. Biometric data can reveal extensive sensitive information about an individual's identity, such as photographs, and their unique genetic code, like DNA. Therefore, use of biometric data engages human rights, particularly the right to respect for private and family life.

130. Any interference with human rights is permissible only if it is lawful, proportionate and necessary on a targeted basis where reasonable suspicion can be demonstrated.

131. The retention of biometric data by law enforcement is inherently intrusive and raises significant privacy and security concerns. The concerns are habitually framed in terms of Article 8 of the ECHR, which protects the right to respect for private and family life, home and correspondence.

Judicial Proceedings

132. Both international and national courts have found that the blanket retention of biometric data (DNA, fingerprints and custody photographs) on an indefinite basis without periodic review is unlawful and constitutes an unjustified interference with the right to respect for private life.

133. Since the early 2000's, the ECtHR has specified that the protection of personal data is of 'fundamental importance to a person's enjoyment of his or her right to respect for private and family life,' furthermore, the Court has explained that 'the mere retention and storing of personal data by public authorities, however obtained, are to be regarded as having direct impact on the private-life interest of an individual concerned, irrespective of whether subsequent use is made of the data.'

134. In S. and Marper v the UK, the ECtHR observed that the interests of data subjects in protecting personal data may be outweighed by the legitimate interest in the prevention of crime. However, such interference – which led to indefinite retention - was not compliant with Article 8.

135. Importantly, the Court noted that independent review of the justification for retention according to defined criteria such as the seriousness of the offence, the strength of the suspicion against the person, previous convictions and any other special circumstances, is a major safeguard for ensuring the proportionality of data retention periods of personal data.

136. In several cases the ECtHR has called into question the broad scope of the data storage system used, which fails to draw a distinction according to the nature or degree of seriousness of the offence leading to conviction. Examples can be found in M.K. v. France, 2013^[50], Aycaguer v. France, 2017 and Gaughran v. the UK, 2020.

137. The same criticism has been applied when authorities do not draw a distinction on whether the data subject had been convicted, acquitted, discharged or merely cautioned, having been suspected of committing an offence. For example, in S. andMarper v. the UK, 2008 and M.K. v. France 2013.

138. In the UK Supreme Court case of Gaughran v Chief Constable of the Police Service of Northern Ireland^[51], the majority held that the blanket policy of retaining DNA profiles from all convicted persons was within the margin of appreciation, and proportionate and justifiable interference under Article 8.

139. In Gaughran v the UK the ECtHR judged that the indefinite storage of the biometric data and photographs of the applicant, who had been convicted of driving with excess alcohol, amounted to a violation of Article 8.

140. This does not mean that the ECtHR is opposed to biometric retention for criminal justice purposes. In fact, the Court has found no violation of Article 8 in cases where the data had been retained for "long" periods of time, for example in, B.B. v. France, 2009^[52] and Peruzzo and Martens v. Germany, 2013^[53].

141. From these cases it could be argued that the lack of a maximum time-limit for the retention of personal data is not necessarily incompatible with Article 8, but assessment criteria and procedural safeguards must be in place. A description of storage periods in law would also be desirable.

142. It is also important to note that the ECtHR has also differentiated between various type of biometric data in terms of intrusiveness and sensitiveness for both retention and acquisition as seen in S and Marper v. The UK, 2008 and Van der Velden v. the Netherlands, 2006^[54].