Biometric data retention: review report

Overall Conclusion

143. The principle of policing by consent is fundamental to Scotland's operational policing model. This is critical to the legitimacy of policing and is built on the bond of trust with our communities. The trust that people across Scotland put in the police is essential to the functioning of our justice system.

144. The importance of balancing the rights of the individual with the safety of our communities is therefore key. The use of biometric data continues to evolve, and how long it is retained should be a key consideration for the police as data controllers going forward.

145. The traditional techniques of custody photographs, fingerprinting, and DNA analysis are evolving as the world moves on. We have now seen new and sophisticated technologies such as live facial recognition (which takes the traditional custody photograph as its starting point), being developed and deployed in England & Wales. Other techniques such as voice recognition are already in use by some UK forces - and the use of artificial intelligence is expected to expand significantly in the coming years.

146. The review team acknowledges that Police Scotland and the SPA plan to develop specific biometrics strategies which will identify key priorities, one of which is likely to be an options appraisal for retention periods for biometric data. This will enable all aspects of biometric work to align moving into the future.

147. While the evidence showed that there is no absolute gold standard for retention across the world, the review team finds that Scotland is in a good position to adapt to an evolving landscape and potentially assist in shaping this area of interest.

148. The review team therefore concludes that further evidence is required to assess whether and how current statutory provisions and practices need to evolve to take account of policing needs, and of current societal expectations and attitudes. Therefore, as a first step, during the first scheduled review of the Code of Practice in 2025, the SBC will consult on proposed amendments to the Code which will include guidance developed in partnership with Police Scotland on both the acquisition and retention of images.

149. In conclusion, the review team found that the combination of existing law and Police Scotland practice has for a number of years ensured an approach to retention which is lawful, effective and proportionate. However, recent judgments at the ECtHR and developments in data protection law may now require some changes which must of course be evidence-led. Technological developments such as digital biometric templates also require special consideration as to their lawful use and retention in the context of modern policing.

150. The recommendations in this report are therefore aimed at ensuring that the retention of biometric data in Scotland continues to be lawful, ethical, effective and proportionate. The issues highlighted in the report are intended to generate multi-agency discussion and involvement in the future shaping of law and practice in this important area.