Scottish Biometrics Commissioner: safeguarding our biometric future

Guest blog from Diego Quiroz, Operations Manager, Scottish Biometrics Commissioner.

A new biometrics landscape 

You may have never heard of us, but if your work relates to biometrics, chances are you will do soon. A new biometrics landscape has taken effect across Scotland to support and promote the adoption of lawful and ethical practices in relation to the use and retention of biometric data for policing and criminal justice purposes. Established under the Scottish Biometrics Commissioner Act 2020, the Commissioner’s role is to ensure that biometric data such as fingerprints, DNA or facial recognition are used lawfully and ethically by police and others in Scotland.

Dr. Brian Plastow was appointed by the Scottish Parliament as the first biometrics commissioner. Following my many years working at the interface of public policy and human rights practice in Scotland and internationally, I was very excited to join his team and embark on this journey. In my role, I am responsible for operational leadership, external assurance, scrutiny programmes, and day-to-day activities. You can see our strategic plan here.

So what’s the big deal here?

Well. There are a number of innovative attributes in the legislation that created the biometrics commissioner. I will mention three.

Image by Alan Warburton / © BBC / Better Images of AI / Quantified Human / CC-BY 4.0

Code of Practice

The first is that the Commissioner will build and monitor a code of practice. This will oversee how ‘biometric data’ is acquired, kept, used, and destroyed for criminal justice and policing purposes. The beauty of this code is that it will be a statutory instrument, which means that the Police, the Scottish Police Authority (SPA), and the Police Investigations and Review Commissioner (PIRC) must adhere to it when acquiring, retaining, using, or destroying biometric data for criminal justice purposes.

This move will give people in Scotland greater protection over how their biometric data is collected and used, whilst also providing a professional decision-making framework for the police and others in the criminal justice system to help keep people safe. The draft code is currently under a 60-day public consultation and we welcome your views about it. Once finalised, the code will be laid before Parliament later this year to be passed as law. When this happens Scotland will become the first UK country – perhaps the first country in the world - to have a biometrics statutory code of practice for policing and criminal justice purposes.

Promoting respect for human rights is a key consideration in our code. This is both progressive and relevant as fundamental rights are not only important for the deployment or retention of personal data, but also at the developmental stage. This is what I call ‘human rights by design,’ which is an approach that integrates human rights considerations into the development of products, services, and technology.

Actual application and procedures

A second attribute is its actual application, including a complaint procedure. The legislation provides a number of compliance powers to promote and monitor the impact of the code including bringing a case before a Scottish court. We are now working on a complaints procedure to ensure individuals, including children and vulnerable people, can directly complain to us if there is a breach of the code of practice and the police, SPA and PIRC hold personal biometric data for the complainer.

Defining Biometric Data

Finally, the legislation defines ‘biometric data’. The definition is a wide one that includes any information about an individual's physical, biological, physiological, or behavioural characteristics that is capable of being used to establish their identity. So, this definition includes second-generation biometrics such as facial or iris recognition and voice pattern analysis.

The main biometric data used in Scotland for policing purposes are fingerprints, DNA, and photographic images. The UK operates shared biometric databases for policing purposes, many of which contain AI solutions to assist human decision-making. For example, the UK DNA database contains an automated searching capability of more than 6.6 million subject profile records. AI can improve the effectiveness and efficiency of policing. In doing so, it is vital to ensure that biometric technologies and AI do not negatively affect our human rights and foster discrimination. Our code of practice will provide the basic principles to promote good practice, transparency, and accountability in Scotland.

Engaging with stakeholders

I am particularly keen to engage with all stakeholders. Listening and learning from you will help us to achieve our goals. It is also important to keep track of changes and best practices in this dynamic and major public area. So, if you have not heard about us before - you have now!

Please get in touch, there is so much we need to do to safeguard our biometric future.