Commissioner's Quarterly Newsletter No 3: December 2021

Structural work at Bridgeside House, 99 McDonald Road, Edinburgh is almost complete. The provisional entry date is 13 December, albeit we will continue with hybrid staff working during the pandemic.

I am delighted to be able to advise that three staff members will be joining me over the coming weeks.

Cheryl Glen will become SBC Corporate Services Manager. She has a background in the public sector including as a police intelligence analyst coordinator in Scotland.

Diego Quiroz will become SBC Operations Manager. He is a lawyer and joins us from the Scottish Human Rights Commission.

Joanna Milne will become SBC Business Support Officer. She has experience in the financial, care, and charitable sectors in Scotland.

Thanks once again to Rosemary Agnew, Fiona Paterson, Helen Wilson, Elena Carrara (SPSO) and to Tina Yule (HMICS) for assisting me with the various stages of recruitment.

Over the summer months, I consulted extensively on the content of the first draft of my first 4-year strategic plan. The strategic plan as required by Section 28 of the Scottish Biometrics Commissioner Act 2020 sets out my objectives and priorities for the next 4 years, how I will achieve them, a timetable for doing so and estimated costs.

The Strategic Plan was developed in consultation with my professional advisory group and with the bodies to whom my functions extend. Following approval by the Parliament corporation, the plan was laid before the Scottish Parliament on 24 November 2021.

A copy of the Strategic Plan is included with the distribution list for this Newsletter and will be published on my website as soon as it goes live.

In October 2021, I submitted a paper to the Biometrics Institute international congress entitled: ‘From World’s End – To World Leading’. The paper represents a personal reflection of how biometrics and forensics have developed from the pre digital age in 1977 Scotland at the time of the ‘World’s End Murders’ through to the creation by Scottish Government and the Scottish Parliament of a single national police service (Police Scotland), a single national forensic services provider (SPA Forensic Services), significant investment in world-leading DNA interpretation technologies, the unravelling of ‘DNA time capsules’ in cold case reviews, and the establishment of layers of scrutiny including the appointment of an independent Scottish Biometrics Commissioner answerable to the Parliament and people of Scotland.

You can read the 20th Anniversary Report including my article by following this link:
https://www.biometricsinstitute.org/about/20-year-anniversary-report/

Following a procurement process, the contract to build the website for the Scottish Biometrics Commissioner website was awarded to Edinburgh based digital development, marketing, and design company: ‘Gecko’

In late November 2021, I had a project kick-off meeting with Mike Octigan and the team from Gecko. I am hoping that the Scottish Biometrics Website will be live around 01 February 2022. Gecko are a well-established digital development company and already provide website services to the Scottish Human Rights Commission.

Under the provisions of Section 33 of the Scottish Biometrics Commissioner Act, I must establish and maintain an Advisory Group. The purpose of the professional advisory group is to give advice to the Commissioner about matters relating to the Commissioner’s functions. The members of the group are determined by the Commissioner subject to the approval of the Parliamentary Corporation.

The second meeting of my Advisory Group took place on Thursday 25 November 2021. Adopted minutes from these meetings will be published as soon as my website goes live.

I am currently running a closed 3-month consultation until 31 December 2021 on version 0.2 of the draft Code of Practice on the acquisition, retention, use and destruction of biometric data for policing and criminal justice purposes in Scotland. This phase of consultation includes statutory consultees, the policing and criminal justice community, academia, pressure groups, and all those previously consulted through the work of the former Independent Advisory Group on Biometric Data in Scotland in 2017/18 Chaired by solicitor advocate John Scott QC.

Subsequent phases of consultation in late winter will open the consultation up to a wider public audience before a final draft version is laid before the Parliament around Spring for Scottish Ministers to consider. I have also shared early drafts with Scottish Government officials and Ministers and have had the opportunity to personally brief Audrey Nicoll MSP, Chair of the Scottish Parliament Criminal Justice Committee on progress.

Related to consultation on the Code of Practice, I have also commissioned the UK’s leading social research organization to run a public attitudes and awareness survey in Scotland in relation to the use of biometrics in policing and criminal justice. The intention is to understand what the public know and think about such issues to assist me in subsequently discharging my function under section 2 (3) (b) to promote public awareness and understanding. Results will be available around February and will be published on my website. Further information on NatCen can be viewed on their website:

https://www.natcen.ac.uk/

My statutory functions as Scottish Biometrics Commissioner relate solely to the policing and criminal justice sector. However, since taking office I have been approached about various contemporary debates in Scotland around biometric authentication technologies in the public sector ranging from Covid status certification applications through to digital identity projects.

There have also been questions asked in the Scottish Parliament about whether the functions of the Scottish Biometrics Commissioner should be expanded in future to other public sector contexts. See for example the following link to recent exchanges between Willie Rennie MSP and the First Minister on the use of Facial Recognition technologies in Scottish schools: https://www.theyworkforyou.com/sp/?id=2021-10-28.23.0&s=speaker%3A25111

Whilst not within my remit, readers will be aware that the UK GDPR prohibits the processing of biometric data (without consent) for the purpose of uniquely identifying natural persons. The UK Data Protection regulator the Information Commissioner (ICO) defines ‘Biometric Data’ as ‘...personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of individuals.’ In other words, processing biometric data without consent is prohibited without a specific lawful purpose for example law enforcement.

Whilst beyond my statutory remit, I nevertheless acknowledge both the question from Willie Rennie MSP and the statement by the First Minister that the use of Facial Recognition technologies in education setting is neither proportionate nor necessary. Ultimately, the acid-test in such matters relating to the capture of biometrics without consent through surveillance technologies should always be for policy makers and practitioners to ask whether the proposed course of action is lawful, and even if so, whether same objective could be obtained through conventional and less intrusive means. The answer to this question should then inform policy.

On 2 December 2021, I will be participating in a round table online event hosted by the RSA in Scotland https://www.thersa.org/fellowship/in-your-area/scotland . The theme for this initial event is ‘Biometrics in Scotland’ as a precursor to a follow up physical symposium in Scotland in the New Year.

On 7 December 2021, I will also be attending an academic symposium at Northumbria University in Newcastle hosted by Professor Carole McCartney who has previously assisted policy development in Scotland around forensics and biometrics. In this symposium I will be presenting on the theme of ‘Human Rights vs Human Wrongs, and Biometrics’

At both symposiums, I will be discussing the twelve general principles and ethical considerations around which the draft Code of Practice is being designed. These events form part of the overall consultation and external engagement strategy for the draft Code of Practice, in the hope that a fully consulted and agreed version can be presented to Ministers for consideration in the Spring.