Biometric data retention: review report

Annex A

Scope of the review

1. The purpose of the review is to prepare a report and generate findings in respect of the retention of biometric data for policing purposes in order to inform the policies and procedures of the Scottish Government (SG) and of law enforcement authorities; and, if appropriate, to make recommendations on procedural and legislative change as considered necessary – to ensure that the approach taken to the retention of biometric data is lawful, ethical, effective and proportionate.

2. The review will be led by SG officials in collaboration with the Scottish Biometrics Commissioner (SBC). Police Scotland (PS) will be a strategic partner to the review, given its operational expertise. While the review remains independent, it is recognised that any emerging findings from the review will require to take into account the operational considerations involved i.e. whether such findings are practically and financially realistic for Police Scotland to implement. The development of operational solutions in response to any emerging findings from the review should also, where applicable, not be dependent on the conclusion of the review and its report.

3. This scoping paper has been prepared on the basis of the Independent Advisory Group (IAG) recommendation to consider a review of Sections 18 to 19C of the Criminal Procedure (Scotland) Act 1995 and the associated evidence base. It is recognised that police retention policies are also relevant to the review in light of the requirement under the Data Protection Act 2018 (DPA) for review periods to be specified when data is being held for an indefinite period.

4. Therefore, there are three elements to the review scope : Legal Review; Research; and Procedural Review.

Legal review

• Review section 18 of the 1995 Act through the lens of proportionality, human rights (ECHR), the DPA and the United Nations Convention on the Rights of the Child (UNCRC).
• Section 56 of the Criminal Justice Act (Scotland) 2003 allows volunteer data to be held indefinitely – this needs to be assessed in terms of proportionality.
• Take forward a strategic gap analysis in terms of how the primary Criminal Justice legislation now stacks up against other legal frameworks - Scottish Biometrics Commissioner Act 2020, Age of Criminal Responsibility Act 2019, Children's Care and Justice Bill, DPA, UNCRC, ECHR and European Court of Justice judgments such as 'Gaughran' and 'S. and Marper'.
• Consider whether retention periods should take account of convictions out with Scotland – as is the case in England & Wales (Section 63J of Police and Criminal Evidence Act 1984 that was inserted by the Protection of Freedoms Act 2012).
• Consider the concerns that have been expressed relating to section 19 of the 1995 Act i.e. how retention should be applied in circumstances where prosecutions are combined; the restrictive timescales which apply when taking samples in certain circumstances i.e. samples to be taken within one month if not taken at time of original arrest, re-taken if the original is rejected, lost or destroyed. Review the timescales of when - and the circumstances of how - these samples can be obtained. Consider the impact of the loss of biometrics as convictions fall over time and whether retention should be based on offending history and/or gravity of offence rather than a single arrest.

Policy / procedural issues

• Is the current twenty-forty / thirty-seventy (TFTS) rule working effectively for the retention of Fingerprints and custody images? i.e. can the time periods be justified? Could they be seen as prejudicial to certain age groups? How can PS compliance with TFTS be assessed/ monitored?
• DNA, Fingerprint and Image data may be retained up to the subject's 100^th birthday (or longer). This could be viewed as indefinite retention as it will more than likely extend beyond the lifetime of the data subject. Is this compliant with the proportionality requirement?
• Weeding of data once a date of death has been submitted: Is the current policy proportionate and can it be justified?

Research

• Confirm the number of complaints about retention that have been received by:
  • PS & ICO since the creation of PS in 2013.
  • SBC since the SBC Code of Practice took legal effect in November 2022.
• Confirm the number of requests for deletion received by Police Scotland
• Explore decision-making by Police Scotland in terms of proportionality and necessity for retaining biometric data i.e. what are the relevant factors that shape decisions? e.g. evidence base, age, likelihood of re-offending, and gravity of crime. How do Police Scotland build a case for continuing to hold the data (i.e. balancing preventative measures and public protection against human rights and the impact on a person's life).
• Undertake a comparative study of retention law in other jurisdictions.
• Identify the ethics to be considered when retaining data.
• Review existing empirical research findings on the beneficial or adverse effects of different retention schemes on individuals or on the police e.g. the 2018 IAG report; findings from thematic reports and compliance assessments prepared by the SBC.

Consultation and collaboration

• SG and SBC to work closely together on all aspects of the review.
• Police Scotland to have a strategic partner role and to undertake Action Research as appropriate to explore practical and financial implications of potential changes to retention periods while the review is ongoing.
• SBC Advisory Group to be consulted on scope and draft report; in between times, individuals to be approached for advice as necessary.
• Consider the merits of undertaking a public attitude survey, and of consulting particular pressure groups; organisations representing victims of crime; and specialised civil society groups, based on the findings from the Research and the review of Legal and Policy/Procedural issues.