Commissioner's Quarterly Newsletter No 1: June 2021

I commenced as Commissioner on 12 April 2021. I am a retired police Chief Superintendent and former HMICS Lead Inspector. I have a PhD in Criminology and have researched biometrics and digital forensics extensively. I have over 4 decades of experience of policing in Scotland.

My role is to support & promote the adoption of lawful, effective, and ethical practices in relation to the acquisition, retention, use, and destruction of biometric data for criminal justice and police purposes in Scotland, as set out in the Scottish Biometrics Commissioner Act 2020.

Subject to change-of-use planning permission, I hope to establish my office at Bridgeside House, Edinburgh. This will facilitate some shared services with other Parliamentary officeholders. My thanks to the Scottish Public Sector Ombudsman (SPSO) and her management team for kindly offering me a potential solution.

I am also in the process of procuring the Scottish Government SCOTS/ERDM system as my secure ICT platform. I have designed outline content for a public facing website and have secured the website domain biometricscommissioner.scot

Once my office location is confirmed, I will begin the process of recruiting 3 members of staff. I anticipate my physical office and website becoming fully established by late September.

As a values-led organisation, we will conduct our activities in a way that is:

• Independent
• Transparent
• Proportionate
• Accountable

We will be accountable to the Scottish Parliament, and will submit to whatever scrutiny is appropriate to our function. We will promote equality, diversity, and human rights in everything that we do.

Scotland has long-standing arrangements in place for the sharing of biometric data for law enforcement purposes both within the U.K. and internationally. This month, I will be discussing the European Cross-Border (Prüm Treaty) arrangements in Scotland following the exit from the European Union. I will also be participating in a meeting of the Home Office Biometrics and Forensics Ethics Group (BFEG) as well as attending a meeting of the Strategy Board of the U.K. Forensic Information Database Service (FINDS). I have already had introductory discussions with other U.K wide policing bodies and with Professor Fraser Sampson, the Biometrics and Surveillance Camera Commissioner for England and Wales.

I am currently simultaneously drafting several key documents in parallel with activity to establish an office base, secure an ICT platform, and recruit staff. Work ongoing includes:

• The establishment of my Advisory Group (first meeting anticipated in July)
• Draft Terms of Reference for the advisory group
• A first draft of my 4-year Strategic Plan
• A first draft of the Code of Practice
• A first draft of the complaints procedure to accompany the Code of Practice
• First draft of a National Assessment Framework for biometric data outcomes in Scotland
• A website structure and content plan to facilitate website designer engagement
• A records management structure plan (file plan) once ICT platform secured
• Draft corporate identity guidelines and branding
• A draft FOISA publication guide for when the website is established
• Role requirements for the 3 staff members to be recruited
• A draft strategic risk register

I wish to publicly acknowledge the support that I have received from many collegues both old and new and for the support of Police Scotland, Scottish Police Authority (SPA), Police Investigations and Review Commissioner (PIRC), HMICS, The U.K. Information Commissioner (ICO), Scottish Government officials, and other UK-wide policing bodies. Particular thanks are due to Janice Crerar at the Scottish Parliament Officeholder Services whose knowledge, experience, and contributions have been truly outstanding.

The Code of Practice will seek to promote good practice, transparency, and accountability in Scotland by setting out an agreed framework of standards which strikes the right balance between the needs and responsibilities of policing and our criminal justice system in terms of enforcing the law and keeping citizens safe, and the fundamental obligation to guarantee the basic human-rights and freedoms of individual members of the public.

The draft Code of Practice will be the subject of extensive consultation but will be principles based.

Once approved by Scottish Ministers, the Code will come into effect under regulations, at which point Scotland will become the first country in the world to have a statutory code of practice on the acquisition, retention, use, and destruction of biometric data for criminal justice and police purposes. This will be a significant human rights landmark for Scotland.

The draft Strategic Plan will also be the subject of extensive consultation but will align to the strategic purpose of the Scottish Biometrics Commissioner as set out in the Scottish Biometrics Commissioner Act 2020:

Our purpose and vision: To support and promote the adoption of lawful, effective, and ethical practices in relation to the acquisition, retention, use, and destruction of biometric data for criminal justice and police purposes in Scotland

Our 4 strategic priorities:

1. Keep under review and report on the law, policy, and practice relating to the acquisition, retention, use, and destruction of biometric data for criminal justice and police purposes in Scotland
2. Promote public awareness and understanding of criminal justice and policing sector powers and duties in relation to biometric data, how these powers are exercised, and how the exercise of these powers can be monitored or challenged.
3. Develop, publish, promote, and assess compliance with a statutory Code of Practice on the acquisition, retention, use, and destruction of biometric data for criminal justice and police purposes in Scotland
4. Provide reports to the Scottish Parliament on the outcomes from the use of biometric data and technologies and highlight key issues to inform public debate, thus strengthening democratic accountability

Once approved by Scottish Ministers, our Strategic Plan, our Code of Practice, and our national assessment framework for biometric data outcomes will provide a substructure through which to assess compliance with the Code of Practice and more generally in the evaluation of overall direction, execution, and results. This will help improve independent oversight, governance, and scrutiny and facilitate self-assessment by the bodies to whom the Code of Practice will apply.