BETA

This is a new website that we're testing. Please give us some feedback on our external survey.

Language: English / Gàidhlig

Skip to main content
Loading…

Scottish Biometrics Commissioner Bill

Overview

This Bill seeks to set up the office of Scottish Biometrics Commissioner. The main role of the Commissioner will be to create a Code of Practice. This will oversee how ‘biometric data’ is acquired, kept, used and destroyed for criminal justice and policing purposes. Biometric data is information about a person which could be used to identify them.

The Commissioner will also keep the law about biometric data under review. The Commissioner is to be independent of the Scottish Government.

This data might include:

  • physical data from a print from a person’s body
  • a photograph or other recording of a person’s body
  • samples taken from any part of a person’s body
  • information derived from such samples

Biometric data includes ‘first-generation biometrics’ like fingerprints, DNA and custody photographs. These have been used to identify people in policing for many years.

It also now includes new technologies (or ‘second-generation biometrics’) like:

  • facial recognition software
  • remote iris recognition
  • ·other behavioural biometrics such as voice pattern analysis

You can find out more in the Scottish Government document that explains the Bill.

Why the Bill was created

The changing use of biometric data and technologies raises ethical and human rights issues.  The Scottish Government wants to focus on these issues to keep communities safe while also respecting the rights of the individual.  The establishment of the office of Commissioner will also ensure the police are accountable in its use of such data.

You can find out more in the Scottish Government document that explains the Bill.

Where do laws come from?

The Scottish Parliament can make decisions about many things like:

  • agriculture and fisheries
  • education and training
  • environment
  • health and social services
  • housing
  • justice and policing
  • local government
  • some aspects of tax and social security

These are 'devolved matters'.

Laws that are decided by the Scottish Parliament come from:

Becomes an Act

This Bill passed by a vote of 110 for, 0 against and 0 abstentions. It became an Act on 20 April 2020.

Introduced

The Scottish Government sends the Bill and related documents to the Parliament.

Scottish Biometrics Commissioner Bill as introduced

Related information from the Scottish Government on the Bill

Scottish Parliament research on the Bill 

Stage 1 - General principles

Committees examine the Bill. Then MSPs vote on whether it should continue to Stage 2.

The deadline for sharing your views on this Bill has passed. Read the views that were given.

Committees involved in this Bill

Who examined the Bill

Each Bill is examined by a 'lead committee'. This is the committee that has the subject of the Bill in its remit.

It looks at everything to do with the Bill.

Other committees may look at certain parts of the Bill if it covers subjects they deal with.

Who spoke to the lead committee about the Bill

Video Thumbnail Preview PNG

First meeting transcript

The Convener

Our next item of business is to take evidence at stage 1 of the newly introduced Scottish Biometrics Commissioner Bill. I welcome to the committee the Scottish Government’s bill team. This is an opportunity for us to find out more about the purposes of the bill, which we will scrutinise in more detail. We have with us from the Scottish Government Elaine Hamilton, who is the bill team leader; Euan Dick, who is deputy director of the police division; and Louise Miller, who is from the directorate of legal services. I refer members to paper 2, which is a note by the clerk. I ask Elaine Hamilton to make some opening remarks on the bill. We will then move to questions.

Elaine Hamilton (Scottish Government)

The purpose of the bill is to put in place new oversight arrangements for collection, use, retention and disposal of biometric data in the context of policing and criminal justice. By “biometric data”, I mean fingerprints, DNA, other data that are currently being developed, such as facial recognition software, and any other forms of data that might emerge in the future that we cannot even imagine just now.

The oversight arrangements will focus on the creation of a new biometrics commissioner, who will have a range of functions. The oversight arrangements will apply to Police Scotland and the Scottish Police Authority. The bill allows a power for Scottish ministers to insert additional bodies, if that should be required in the future.

To ensure the impartiality of the postholder, the commissioner will be appointed by the Crown on the recommendation of Parliament. The commissioner will be accountable to Parliament for the performance of his or her functions and expenditure.

The need for independent oversight arises from the ethical, legal and human rights considerations that are associated with the use of biometric data. It is vital that the public have confidence in police use of biometric data. Given that biometric data and samples that are captured by Police Scotland may be taken without an individual’s consent, it is all the more important to ensure that there is adequate protection of rights and independent oversight of the police’s powers in that respect. The need for independent oversight has been identified in a number of independent reports—most recently, in the 2018 report, “Use of biometric data: report of the independent advisory group”. The Scottish Government consultation that followed the group’s report also indicated broad support for those arrangements.

I turn first to the commissioner’s general function, which is to support and promote the adoption of lawful, ethical and effective practices in relation to collection, use, retention and disposal of biometric data. That means that the commissioner will keep under review the law, policy and practice relating to biometric data in the context of policing and criminal justice.

The commissioner will also promote public awareness and understanding of biometric data, and of how police powers and duties are exercised, as well as how the powers and duties can be monitored and challenged.

The commissioner will prepare and promote a code of practice. In addition, his or her functions will include carrying out research and making recommendations in relation to any matter relevant to the Commissioner’s function.

In carrying out those functions, the commissioner will be required to promote in particular the interests of children, young people and vulnerable adults.

I will say a bit more about the code of practice. The commissioner is to prepare a code of practice in consultation with a list of prescribed stakeholders including Police Scotland, the Scottish Police Authority, the Police Investigations and Review Commissioner, HM inspectorate of constabulary in Scotland and anyone else whom the commissioner considers to be appropriate. The code must then be approved by Scottish ministers and laid before Parliament. The content of the code can be reviewed at any time, but there must be a report on it every four years.

The bill requires that there be a code, but it does not specify what its content should be. That is important, because it will allow the commissioner to use his or her own judgment and the input of stakeholders to shape the code. We anticipate that the code will provide information and guidance that sets out the standards and responsibilities of Police Scotland and the SPA, with the aims of ensuring good practice, driving continuous improvement and enhancing accountability. The SPA and Police Scotland will be legally obliged to have regard to the code.

To enable the commissioner to perform his or her functions, the commissioner will have the power to request information. Should that information be refused, concealed or destroyed, the commissioner has a remedy to the Court of Session, which would consider the matter. If an order were to be made by the court, it would be contempt of court to ignore it.

Having considered information about collection, use, retention and disposal of biometric data, the commissioner may wish to make a recommendation. Should no response to the recommendation be forthcoming, the commissioner would reference that in a report to Parliament, which would be made public. Therefore, the sanction is to name and shame, so to speak.

In conclusion, we will have a commissioner who will encourage and support the fulfilment by Police Scotland and the SPA of their functions in a manner that respects fundamental rights, the law and ethics. That support will include promoting good practice, identifying systemic deficiencies and providing a measure of transparency, which together will promote public confidence in policing and in the criminal justice system.

The Convener

Thank you for those helpful opening remarks. Before I bring in John Finnie, I want to ask a question about behavioural characteristics. Can you give an example of what those would include?

Elaine Hamilton

Behavioural characteristics would include analysis of, for example, a person’s gait or pattern of speech, such as a stammer—a defining characteristic in their behaviour. For example, if the person twitches or blinks, that could be helpful.

John Finnie

I thank Elaine Hamilton for her summary. I have a couple of questions, in particular about the status of the code of practice. It is very hard to predict the future, but four years on, if things go as expected, what status will the code have, what requirement will there be to adhere to it and what would be the sanction for someone who does not adhere to it?

Elaine Hamilton

The code of practice will set out the standards and responsibilities that will be expected of Police Scotland and the SPA. The expectation is that we will have in place internal systems to ensure transparency in how they exercise their powers, and that those powers will observe human rights and ethical considerations.

If the commissioner felt that Police Scotland or the SPA were not having regard to the code, the commissioner will be able to make a recommendation that they have regard to a certain part of the code. If Police Scotland or the SPA respond, the commissioner will consider that response. If the commissioner felt that they had not responded, that could be reported to Parliament and made public. There is therefore no legal sanction for failing to observe the code, but there is the sanction of reputational damage, which is a powerful one.

I have had discussions with Professor Wiles, the Commissioner for the Retention and Use of Biometric Material for England and Wales, and know that he, too, does not have sanctions in terms of enforcement powers. However, he feels that he does not need enforcement powers and that having them would adversely affect his relationship with police forces. I understand that there might be concerns here about the commissioner not having teeth, but in practice that does not appear to be an issue. The provisions in the bill for naming and shaming appear to be adequate.

John Finnie

Would there be retrospective application?

Elaine Hamilton

No. The code of practice will come into effect on a day that will be set by regulations that the Scottish ministers will lay before Parliament under affirmative procedure.

John Finnie

Have you formed a view of what the public might think about the likelihood of compliance, given the Scottish Information Commissioner’s and many other people’s views of the legitimacy of Police Scotland’s proposed deployment of cyberkiosks, and the fact that Police Scotland nonetheless considers it appropriate to go ahead with that deployment?

Elaine Hamilton

The cabinet secretary was clear when he appeared before the committee on 13 June that the legality of cyberkiosks is a matter for Police Scotland and the SPA. The bill’s proposed remit for the commissioner includes looking at developing technologies and ensuring proper validation of them before they are deployed, and ensuring that human rights and ethical considerations are taken into account.

John Finnie

Okay. I will not push further on that. Thank you.

The Convener

Liam Kerr has a supplementary question.

Liam Kerr

What is driving the process? Have there been breaches—for want of a better word—with regard to what is mandated just now? If so, is how we move forward time critical?

Elaine Hamilton

There have not been such breaches. The Scottish Government’s position is that Police Scotland and the SPA work to very high standards, and that there is no suggestion that the commissioner is required because of deficiencies in their performance.

As I mentioned in my introductory comments, there have been a few independent reports in recent years, including the independent advisory group’s report in 2018 and a report by HMICS in 2016, both of which called for independent oversight arrangements. There have been independent oversight arrangements in England and Wales for a number of years now, so it is felt that there is a gap in Scotland.

If we consider the times in which we live, so many processes are now propelled by technology, particularly biometric technology, and the Scottish Government understands that the public will naturally be concerned about issues including privacy and the security of data. There has, therefore, been alignment of a number of factors here that make creation of the post of commissioner all the more appropriate.

11:15  



Daniel Johnson

I would like to ask a supplementary before moving on to my substantive question. It follows on from the convener’s question about behavioural characteristics. My question is about the definition of “biometric data” in the bill. I accept that the list of types of data that is provided in section 23(2) is a “may include” list, but it does not include behavioural characteristics.

A more important concern stems from the fact that much machine learning does not codify behavioural characteristics in terms of information, as such. There is a system that can identify such behaviours, but it cannot articulate what information is being held by people. I am concerned that the definition might not capture all the means by which people are identified by their behavioural characteristics. To what extent has the bill team looked into and covered off that issue? Are you confident that the definition is comprehensive?

Elaine Hamilton

The definition of “biometric data” was considered very carefully by the bill team. We wanted to offer a very broad and comprehensive definition that would allow future proofing, given the fast pace of technology. Ultimately, the definition that is provided in the bill is not meant to define biometric data generally; rather, it is provided for the purposes of the bill and for setting out the scope of the commissioner’s remit.

To be clear, in the bill,

“‘biometric data’ means information about an individual’s physical, biological, physiological or behavioural characteristics”

that may establish their identity either on its own, or when it is combined with other information. When we talk about information about a person’s physical characteristics, that would include facial recognition. Information about biological characteristics would include a DNA profile, which can be derived from blood, saliva, hair and so on. Information about physiological characteristics would include vein patterns. As I mentioned earlier, information about behavioural characteristics could include a person’s gait or speech pattern.

In offering the definition in the bill, we have tried to be as broad as possible. We have made the definition broader than existing definitions of biometric data, such as in the general data protection regulations, which focuses more on data that has undergone some sort of chemical process.

Daniel Johnson

The area is one that I would like to examine further as scrutiny of the bill progresses. There is an important difference between data and information, particularly when it comes to machine learning.

I will move on to my substantive question. The committee has taken evidence on the preliminary report on the handling of complaints against the police. Four bodies oversee or are involved in policing; indeed, if HMICS is included, it could be argued that we have five such bodies. The bill would introduce a sixth one. I note that the policy memorandum says that consideration was given to whether the functions of the proposed commissioner could be given to another body, such as the Police Investigations and Review Commissioner.

Is there concern that we are creating a crowded landscape for police governance? What steps have been taken with the bill to avoid that? Why was the idea of giving the functions in question to the PIRC, the Scottish Police Authority or some other body rejected in favour of creating a separate commissioner?

Elaine Hamilton

The regulatory landscape in Scotland includes the roles of HMICS and the PIRC. It is the policy of the Scottish ministers not to create a new public body unless there is an absolute need for it and the functions cannot be carried out by an existing body. To that end, a robust options appraisal was undertaken in May of last year, which considered existing bodies such as HMICS and the PIRC.

HMICS and the PIRC are certainly well established in their respective areas of expertise, but they do not have a remit across all areas of biometrics. If we were to widen their remit, that could lead to a loss of focus for them, and it could negatively impact on their perceived authority and credibility. On that basis, using an existing body was not considered to be optimal. To have added to the remit of either of those bodies would have represented a fundamental shift in their purpose.

Undoubtedly, HMICS and the PIRC have valuable roles to play, but the options appraisal identified that they were not ideally placed to take on an additional function such as this. The need for a new parliamentary commissioner was based on having a fresh approach to supporting improvements in the setting, monitoring and enforcing of standards. The option of a new body scored the highest for benefits realisation, particularly around strengthened oversight and accountability of public services. It also offered the value of ensuring a proportionate and effective approach to biometric data and additional capacity to support world-class innovation research and development.

A new parliamentary commissioner would also function independently, with no perception of undue influence from policing-related bodies.

Those are a number of reasons why it was felt to be inappropriate to use HMICS or the PIRC, and why the optimal solution was to have a completely new parliamentary commissioner.

The Convener

When will the code of practice be available, even in a draft form?

Elaine Hamilton

The provisions of the bill are such that the code of practice is to be prepared by the biometrics commissioner in consultation with a list of prescribed bodies. The whole point of having an impartial commissioner is they will not be under the direction of Parliament or the Scottish ministers. It is therefore difficult for me to say exactly when the code of practice will be produced. I hope that it will be the new commissioner’s top priority but, as I say, there is a requirement for the commissioner to prepare the code in conjunction with stakeholders, which always takes time. The code will then have to be approved by the Scottish ministers and laid before Parliament. There is therefore a time element to it.

There is existing material that could be drawn on to form the code. The Scottish Government prepared a concept of operations code that was part of its consultation last year, and the new commissioner could also choose to draw on the existing standards from the forensic science regulator, for example. One would therefore hope that the commissioner will not be starting off with a blank sheet, but we have to respect the postholder’s impartiality, so I would not like to estimate when the code might be produced.

The Convener

It will be after the bill is passed and it will be introduced by secondary legislation.

Elaine Hamilton

Indeed.

The Convener

You mentioned raising awareness. Could you clarify whether that is about the role of the new commissioner or about the legislation itself and say how it is intended to raise public awareness?

Elaine Hamilton

Yes. One of the functions of the new commissioner will be to raise public awareness of police powers and duties in respect of biometric data. Because the post is impartial, it will be for the commissioner to decide how he or she will go about that. We would expect the commissioner to liaise with parliamentarians, with various representative groups and with the media in order to raise awareness of rights and duties in respect of biometric data.

The Convener

That is quite a grey area. It sounds very good, but the detail of how you raise awareness in practice is not so clear. Is there a budget for doing that?

Elaine Hamilton

Yes. The financial memorandum sets out the costings for the bill. That particular part of the commissioner’s role has been costed. There is a budget for publications and a budget for travel and subsistence, which will cover the costs of the commissioner travelling around the country, attending conferences or public meetings to provide information. There is a costing for that but not one specifically for public awareness raising—that is wrapped up in the travel and subsistence budget, the salaries and other administration costs.

The Convener

What is the budget?

Elaine Hamilton

The budget for travel and subsistence is £4,000 per annum. The administrative costs are £2,000 per annum. Do you wish to know the salary or remuneration costs?

The Convener

Why not?

Elaine Hamilton

The commissioner’s remuneration is estimated at £57,000, and the staff salaries at £167,000, based on three full-time equivalents.

The Convener

Thank you—that is helpful.

That concludes our questioning. I thank the bill team for providing evidence today.

11:27 Meeting suspended.  



11:28 On resuming—  



Video Thumbnail Preview PNG

Second meeting transcript

The Deputy Convener (Rona Mackay)

Good morning and welcome to the 23rd meeting of the Justice Committee in 2019. We have received apologies from Margaret Mitchell. I am pleased to welcome to the meeting Maurice Corry, as the Conservative Party substitute.

Agenda item 1 is an evidence session on the Scottish Biometrics Commissioner Bill, in which we will hear from two panels of witnesses. I refer members to paper 1, which is a paper by the clerk, and paper 2, which is a private paper.

I welcome the witnesses for our first panel: Professor Paul Wiles is the Commissioner for the Retention and Use of Biometric Material, and Lucy Bradshaw-Murrow is head of office at the Office of the Commissioner for the Retention and Use of Biometric Material. I thank the witnesses for their submissions, which are most helpful.

We will move straight to questions: I will ask the opening questions. Commissioner, will you give the committee an overview of the powers and functions of your role and how it currently applies in Scotland? What are the main differences between your role and the role that is proposed for the Scottish biometrics commissioner?

Professor Paul Wiles (Commissioner for the Retention and Use of Biometric Material)

Thank you for inviting us to talk to the committee.

My role is defined under the Protection of Freedoms Act 2012, and the remit that I have follows the current extent to which powers are devolved, or not devolved, across the United Kingdom. My role in national security is a UK-wide responsibility because security is currently a non-devolved matter. Therefore, I cover national security matters in England and Wales, in Northern Ireland and in Scotland.

As I am sure members are aware, my basic function in that regard is for when the police have no other legal power by which they would be able to take or retain biometrics, and so keep biometrics if a chief officer of police makes a national security determination. The grounds for such determinations are laid out in legislation. I have to look at all such national security determinations and, if for any reason I think that they have not been properly made, I have the power to order deletion of the biometric material.

There have been, comparatively, very few national security determinations from Scotland. Since the 2012 act came into force, there have been 21 NSDs from Scotland, which is really quite a small number compared with the number from England and Wales. Therefore, the power has not been used to any great extent in Scotland—although of course that could change, depending on what happens.

For police use of biometrics for reasons other than national security, my remit is limited to England and Wales, because such reasons are a devolved matter. Therefore, Police Scotland’s use of biometrics for any reason other than national security is a matter for the Scottish Parliament, and not Westminster. The same is true for Northern Ireland. My remit in that regard only covers England and Wales.

The difference between my role and what is proposed in the bill is quite significant. Under the 2012 act, my role covers only DNA, fingerprints and shoe impressions—although I am not clear why, because shoe impressions are not biometric. My role does not explicitly cover what I call second-generation biometrics. Through the bill, the Scottish Government is seeking to find a way of providing governance for police use of second-generation biometrics. The Scottish Government should be congratulated because Scotland is, as far as I know, the first country in the world that is trying to do that.

Many other countries are quite interested in what Scotland is doing, because they are all aware that they have similar issues. In particular, they are interested because the Scottish Government has come up with a form of legislation that the proposers at least believe will be flexible enough to cope with the fact that the technology in this area is moving very rapidly indeed.

I have no remit in respect of the new biometrics. I commented on second-generation biometrics in my annual report simply because I am constantly asked about them and the police constantly come to me and discuss them. My having no remit on them has not stopped people assuming that I do. That is why they are covered, to some extent, in my annual reports.

The proposed Scottish commissioner will, of course, have an active role—which I do not have—in determining the way in which governance operates in the future, because they will have the responsibility for drawing up codes of practice. I have no such proactive role in England and Wales.

The Deputy Convener

Thank you. That is really helpful. For clarification, am I right that, from what you have said, you will not have much interaction with the Scottish commissioner other than on matters of national security?

Professor Wiles

Yes. Broadly, it is correct to say that the Scottish commissioner will deal with the police on matters that are not matters of national security.

People who have submitted written evidence to the committee have rightly drawn attention to two things. First, Police Scotland uploads biometrics to the UK-wide databases, so there are issues to do with the extent to which retention of that material will follow Scots or English law. I think that the answer to that question is that, if the biometric samples or biometric profiles in the case of DNA are Scottish, Scots law ought to apply. Technically, there is no reason why that should not be done.

There are potential problems simply because the databases on which the biometrics are held at UK level are elderly. They are in the process of being replaced, but there has been a delay in that, so there might be some problems because of that. However, with the new databases, I can see no reason why Scottish samples should not be held according to Scottish legislation and English samples held according to English legislation. That would mean that, if the bill is passed and a commissioner appointed, he or she should become a member of the strategy board that oversees use of national UK databases, just as I am. That should deal with that matter—although I can imagine one or two issues, at the moment.

Secondly, there are, of course, law enforcement bodies—for example, the British Transport Police and the Ministry of Defence Police—that operate UK-wide, in both England and Scotland. I cannot remember whether anybody has drawn attention to that. When the British Transport Police in Scotland arrests someone and takes biometrics, it uses Police Scotland to take them, but then ships the biometrics down to London. That is an issue, because those biometrics are currently kept according to England and Wales legislation. If a commissioner is appointed, that is perhaps something that they will need to take up. Samples that have been taken in Scotland should, in my view, be subject to the legislation that is in place here.

The Deputy Convener

Thank you. John Finnie has a supplementary question.

John Finnie (Highlands and Islands) (Green)

That is very interesting, Professor Wiles. I had hoped to discuss that issue, so that was timely.

The example of the British Transport Police is a very good one. One might reasonably imagine that the legislation should apply to Scotland, within the confines of the territorial boundaries. Should similar provisions apply to the National Crime Agency?

Professor Wiles

Yes. You referred to territorial boundaries. I was suggesting that it is not just a matter of territorial boundaries, but that the approach should depend on where and by whom the samples were taken. It seems to me that if biometric samples are taken in Scotland, they ought to be subject to Scots law, even if they are taken by an agency that operates in England and Wales as well as in Scotland.

John Finnie

I concur fully.

You said that you have a specific role relating to national security. Should the bill also apply to the Security Service operating in Scotland?

Professor Wiles

First of all, the Security Service is outside my remit, as it clearly reminds me whenever I try to get involved. As far as I know, national security is not a devolved matter. Therefore, it is for the UK Parliament to provide that oversight. Of course, that is on the basis—

John Finnie

Is that notwithstanding the fact that a sample might have been obtained in Scotland?

Professor Wiles

Yes. I do not think that the proposals would put in place legislation to control retention and use of biometric samples that have been taken by the Security Service. The bill specifies that it relates to samples that are taken by Police Scotland and other such bodies. As I understand matters, national security is not within devolved powers.

John Finnie

You mentioned the British Transport Police. It is my view that there is a dearth of accountability in that respect. If we want an open, transparent and accountable process, surely the principle should apply to all public bodies.

Professor Wiles

That is a political matter for members, sir. As far as national security determinations are concerned, there is transparency, and it is provided by me and my office. The annual report gives the number of national security determinations, the number that I have challenged and the number for which I have ordered deletion. That information is publicly available, as regards biometrics that are being kept on the ground of national security, rather than any other grounds. However, as far as I know, the Security Service does not, itself, take biometrics—the police take the biometrics. In other words, that is covered by the NSD process.

John Finnie

Of the 21 applications from Scotland, how many did you refuse?

Professor Wiles

From memory, I do not think that I refused any of the 21 applications. Perhaps it would help if I explain the process. When I look at national security determinations, I have a two-stage process, not just because the legislation specifies that but because of what we have put in place. If, for any reason, I have concerns about why the NSD was awarded—basically, if I do not think that it meets the legal requirements of necessity and proportionality—I will challenge that. If the answer that I get back does not deal with my concerns, I order deletion of the samples.

Shona Robison (Dundee City East) (SNP)

You said that the Scottish Government should be commended for being the first in the world to propose specific legislation about how new biometrics are used for policing and criminal justice and how that should be governed. I have a couple of questions on that.

First, does it surprise you that such legislation has not been introduced before? Secondly, is there a reason for that? You talked about how quickly things move in the area, so is that speed one of the reasons? Do you think that other jurisdictions, in particular England and Wales, will introduce similar legislation on the back of what is happening in Scotland?

Professor Wiles

It is interesting to note that the Protection of Freedoms Act 2012, which is the current legislation in England and Wales, is relatively recent, but covers only DNA and fingerprints. That is because at that time people were not expecting the second-generation biometrics to become more usable at the speed at which that has happened. Essentially, we have three technologies coming together—biometrics, big data and artificial intelligence. The use of artificial intelligence on large data sets has driven the utility of the new biometrics—face and voice recognition, and so on. The matching capabilities of those technologies has improved exponentially in the past two or three years: it has been very rapid.

I think that all Governments have been faced with a situation that has been caused by the speed and extent to which the new biometrics are becoming available and, potentially, used. That process has been very rapid, compared with the normal processes of legislation.

Secondly, the number of new biometrics that are emerging is increasing all the time. More to the point, perhaps, is the fact that the number of cases of use of the new biometrics is multiplying. Members have probably noticed that, in England, there has been significant debate recently about use of facial recognition technology not just by the police, but by the private sector.

10:15  



The process has been very rapid, and I think that all Governments have realised that trying to legislate and put down rules for each biometric and each use case simply would not work, because they would always be behind the technological change. The difficulty has been in finding a way of providing legal governance for use of the new biometrics—by the police, in particular—that can respond to change.

In Scotland, an expert group looked at that problem and came up with some proposals that include a legal architecture that lays down principles, and the appointment of a commissioner to produce codes of practice that can respond to the rapid technological changes. There might be other ways, but I cannot think of one. At least that is an attempt to deal with the problem. I think that Scotland is the first country that has tried to do that. It is interesting that the legal architecture that is being used is very similar to the legal architecture that is used for data protection legislation.

James Kelly (Glasgow) (Lab)

I want to follow up on the issue of how quickly the technology is moving and the ability of legislation to keep up with that. You have said that the codes of practice will be the main tool that will be available to the new commissioner. Bearing it in mind that the main challenge is that the technology is continually changing, what do you think should be the main points of a robust code of practice?

Professor Wiles

The bill proposes the principles on which codes of practice should be drawn up, which include human rights, data protection legislation and principles from the current legislative framework for DNA and fingerprints. The commissioner must operate within those broad principles—they will not be free simply to do what they want. Furthermore, the bill provides that the commissioner, having drawn up the code, should report that to the Scottish Parliament, so Parliament will continue to have oversight of the process. That is the general framework, as I understand it.

When it comes to what the issues are, there are a number of steps. First, there is the question of whether a particular use of biometrics is in the public interest. I think that we would regard police use of biometrics as probably being in the public interest. At the moment, there is a question in England about whether use of facial recognition technology for public surveillance is in the public interest. That is a slightly different question from the question on which a court in south Wales recently decided, which was whether there is a lawful basis for its use.

If use of biometrics is in the public interest, it is inevitable that it will involve intrusion into individual privacy and liberty. That raises the question of proportionality and how the public benefit that is being claimed can be balanced against intrusion into privacy and limitation of individuals’ liberty. It seems to me that the first question that needs to be addressed is whether the public-interest case outweighs the invasion of privacy and the reduction of liberty.

There are also questions about who should be allowed to take biometrics and under what conditions, when and with what authority. Examples are whether the police would have the right to take facial images or do voice analysis; when they would do it—at arrest or some other point; and whether they would be entitled to take those by force if necessary, or only by consent.

There are issues about retention of biometric data and the form in which it can be retained. As members know, in the early days of police use of DNA, there were concerns about the police being allowed to keep DNA profiles but not samples, which would have allowed them to learn a lot more about individuals than was necessary for policing purposes.

The code of practice will have to address those questions and propose answers.

Fulton MacGregor (Coatbridge and Chryston) (SNP)

Good morning, panel. You have talked a wee bit about the bill creating a requirement for law enforcement bodies to be compliant with the code, but the bill does not give the Scottish commissioner any enforcement powers. Drawing on your experience, can you provide examples of where monitoring and public reporting by themselves have ensured compliance?

Professor Wiles

At the moment, the bill is limited to police use of biometrics, which is interesting. I am drawing attention to that because a common way by which commissioners or regulators are given enforcement powers is to give them powers to levy fines, as is the case for the information commissioner. The problem with trying to achieve compliance from public bodies by using fines is who suffers from the sanction, because the people who suffer the consequences are those who receive the services of that public body.

My experience of policing in England and Wales is that the police—like all public bodies, but particularly so—are very concerned about continuing to carry public trust in what they do. They know very well that it is much more difficult to police without public trust and without public belief in the legitimacy of what they do. The police are sensitive about carrying the public with them. That means that, when we visit, they are always extremely open with us; we always have open discussions and they are always amenable to our suggestions about their compliance, and the basic reason is that they want to continue to hold public trust.

We visited just over half the forces in England and Wales last year and we will visit the rest this year. When we visit, I always say to forces that I do not name individual forces in my annual reports, unless we are publishing data that is broken down by force, such as the number of samples held. On the other hand, I also say that I will publish if I ever get into a situation in which a force deliberately misleads me or is knowingly non-compliant with legislation. However, there would be several stages before that, such as writing to the force’s chief constable and the Home Secretary. I would question how far what the force was doing was compliant.

Fulton MacGregor

I hear what you say about not mentioning individual police forces in England and Wales, which seems sensible enough. Are there are good examples of individual police forces with regard to the particular point that I made?

Professor Wiles

Recently, for the first time, I visited a police force in England and Wales, and I asked whether it was making any use of facial image matching. I was told that it was not. About two weeks after that visit, I read in the press that that force had been involved in some facial imaging at a shopping mall. I wrote to the chief constable and said that I was concerned because I had asked that question and been given an answer that I now understood was not full or correct. The chief constable wrote back to me to apologise but also to say that, if I had been misled, it was completely inadvertent, because the officers I was talking to and, indeed, the senior command team in that force were not aware that that had been happening. In other words, there had been sharing of information at a fairly junior level in the force. I have looked at that, and I entirely accept what the chief officer was saying. As far as I am concerned, I think that that deals with it.

However, what that case shows is the kind of risks that exist in the absence of clear and specific legislation to deal with the second-generation biometrics such as face recognition. Although senior officers in England and Wales are sensitive to the risks that they would run in terms of public trust by using the new technologies, inevitably, that might not work through all the way down the command chain. Officers lower down who are used to working co-operatively—quite properly—with bodies that run shopping malls, local universities and so on might inadvertently start sharing stuff that, in my view, they probably should not. As I say, I have seen an example of that but, on inspection, nobody was trying to mislead me deliberately or be knowingly non-compliant.

Liam McArthur (Orkney Islands) (LD)

Listening to that exchange, it occurred to me that, in England and Wales, there is a plethora of forces, which means that the information is coming in from different places, and the sanctions that you have described will probably be applied in a different way from the way in which they would be applied in Scotland, where there is a single national force, which means that any data that comes forward will inevitably come from Police Scotland. Can you make any observations about the way in which this legislation and the sanctions would apply in that context?

Professor Wiles

Of course, Scotland has a single police force and, in that sense, there is—well, the equivalent will be one inspection. However, I tell you what: I will make a bet with you that the different bits of Police Scotland are not totally uniform. That is not based on what I know about Police Scotland; it is based on what I know about police forces. If I were the new commissioner, I would be interested in testing whether Glasgow operates in exactly the same way as Aberdeen or Inverness—that would be worth looking into. That is not a disparaging comment about Police Scotland at all; it is just that, although there is a single force, it covers a wide area and there will inevitably be some local variations. When you appoint the new commissioner, I would think that he or she might want to investigate that issue and find out whether there is uniform compliance or variation. In a sense, what I have just described in a single police force in England and Wales was about variation within the rank structure, and that force is a fairly compact one, geographically. Police Scotland is geographically widely spread and is quite a recent creation, so I would want to check the extent to which local cultures still apply.

Jenny Gilruth (Mid Fife and Glenrothes) (SNP)

You spoke earlier about the new Scottish commissioner having a proactive role. However, the bill envisages the role as being a part-time one. What is your view on that suggestion? Could the job be done part time? Is that a reasonable ask?

10:30  



Professor Wiles

I think that the role will be part time due to a combination of the amount of time that the commissioner is envisaged as providing and the extent to which his or her office can help in that process.

I am sure that you will want to ask Lucy Bradshaw-Murrow some questions in a moment. She and I work quite closely together, as do the rest of my team. It is a team effort rather than just that of a single person. Of course, you are right that it is the commissioner who will have to take responsibility for the decisions and be answerable for them.

If the bill becomes law and you appoint a commissioner, they will, particularly initially, be involved in significant consultation about the codes of practice. The workload will probably get a bit easier once the codes are established, but I imagine that they will require a lot of work. That is partly because the legislation would require consultation with certain people. I am sure that whoever you appoint will want to consult with all sorts of stakeholders, too.

There will initially be quite a process of consultation and quite a process of giving the principles that are in the legislation practical import in the way in which they feed into the codes. I imagine that that will be a lot of work. I think that that means that in the first year the commissioner will be focusing almost exclusively on that task, and other aspects of the role will probably have to wait until the first codes are in place. The bill allows for that, because the first report on the codes is not expected quickly—there is an assumption that it will take time to get to that point. That is quite sensible.

The other thing is that it depends on what previous experience the person whom you appoint has. To some extent, that says something about what kind of person you want to appoint as commissioner, particularly initially.

The Deputy Convener

What is Lucy Bradshaw-Murrow’s view on the role being part time? Is the workload too heavy for that?

Lucy Bradshaw-Murrow (Office of the Commissioner for the Retention and Use of Biometric Material)

The Commissioner for the Retention and Use of Biometric Material covers England and Wales and UK national security cases on a part-time basis—the role is 0.6 of a full-time equivalent. That works for us. As Paul Wiles said, we have in place a team that can represent him in his absence or continue the work when he is not there. I will give a very simple example of how that relates to my role. If we had a strategy board meeting on a day when the commissioner was not working, I would represent his views on his behalf. The rest of the team continue the commissioner’s work in his absence, essentially. It is important that he is there for certain elements of the role and to provide a figurehead for the office, but he does not always need to be there.

Liam McArthur

It is probably perverse in the context of what we have been discussing about the role’s part-time nature to bring up this issue, but other witnesses that we will hear from in our second session today, such as Dr Hannah Graham, have pointed to the wider use of biometrics in other countries. Biometrics are even being used in the criminal justice system more broadly. We have seen that in relation to electronic monitoring, probation, parole and prisons. Notwithstanding the priority that is attached to the police and the Scottish Police Authority, is there a case for broadening out the role and remit of the commissioner into the broader criminal justice sphere?

Professor Wiles

I fully understand why the Government has started off focusing on the police’s use of biometrics, although the expert group suggested a slightly broader remit. The case for that is simply to do with the powers that police forces hold and the fact that they have a right to interfere in the lives of individuals in a way that no other organisation in law has.

There are issues with the criminal justice system, in particular, because the police are part of that overall system. In England, as in Scotland, there are links between the way in which the police use biometrics and the way in which the courts and prisons use them, because the same people are going through the system. There are links between the police use of biometrics to authenticate identity and the potential use of biometrics by the courts to check whether the person before them is the same one who was arrested by the police and by the prisons to check that they have received the person whom the courts sentenced and the police arrested. An individual is going through a process.

I can see the case for extending the use beyond the police to the criminal justice system and why that is a particular case. On the broader question, there is a live public debate in England and Wales, as I said earlier, because it is becoming clear that the technologies are being used by the private sector. Unlike the police use of the technologies, private sector use is not always transparent or publicly admitted to; indeed, we have had some real evasions about that use. Therefore, I can see that the use of biometrics outside the police and criminal justice system should be looked at. Politically, that case is developing at the moment in England and I am sure that that will happen.

One has to remember that data protection legislation already covers it all—not only use in the public sector but use in the private sector. The information commissioner is certainly looking at the use of facial matching technology by the private sector in that mass public space around Kings Cross and St Pancras stations, for example, which has been in the news recently. It is not without some regulation, but the question, which will be one for the Government and Parliament of Scotland later, is whether you wish to see specific governance through law of the use of those technologies by the private sector or, for that matter, by the rest of the public sector.

Maurice Corry (West Scotland) (Con)

The bill currently provides a list of people who should be consulted before a draft code is submitted to the Scottish ministers. Does either witness have a view on the proposed list of consultees and whether any other stakeholders should be included in the bill?

Professor Wiles

My view is that the bill has named the most obvious stakeholders. At the same time, I do not see anything in the bill that limits the commissioner to consulting only those stakeholders. Obviously, I cannot speak about that being the case for ever, but let us say that the bill becomes law and you appoint a commissioner. If I was the commissioner, I would obviously consult the people whom the legislation required me to, but I would also think about whether there were others whom I should consult, and I would make public the fact that I was interested in hearing from any other parties. I think that the commissioner would be sensible to do that. The question is whether the commissioner can produce a code that not just you in the Parliament think is all right but the people of Scotland think is appropriate. The commissioner that you envisage under the bill will have a broader role of trying to carry public opinion with them.

In a sense, the commissioner would also have that problem of trust, and they would be well advised to encourage all parties who might wish to have a say on the issue to do so. I was asked a few moments ago about whether there is enough time. Getting public opinion is a difficult process. You would have to think of mechanisms to limit how far that could go, but I cannot see anything in the bill that would prevent the commissioner from bringing a group of people together and getting them to do some of that work on their behalf.

Maurice Corry

From your experience in England and Wales, can you give the Scottish Government a steer on any bodies or stakeholders that may not have been identified but which should be considered?

Professor Wiles

I am speaking from memory, so I am not sure that I am remembering the bill absolutely correctly, but one group that is not a user of biometrics but which is nevertheless influential is the providers of biometrics. As I am sure that you are aware, the technology companies—particularly the big ones—are vociferous lobbyists for the use of their technology. Therefore, if I were the commissioner, I would want to talk to them and make sure that they were part of that conversation, because, at the moment, it is difficult to keep up with the different uses for biometrics that technology companies are developing, some of which are surprising uses that one had not thought of.

Recently, I was slightly, though not entirely, surprised to discover the use of facial imaging—on the basis of a belief that I am not sure is scientifically accurate—as a proxy for people’s emotional response to things. That is very different from simply authenticating identity. The claim is that you can tell from the face something about the way people are thinking and emotionally reacting. That is a different issue, and I would want to talk to the tech companies to make sure that I understood the other things that biometrics might be used for.

Maurice Corry

That is the point that I am driving at.

Liam Kerr (North East Scotland) (Con)

On a similar topic, the bill does not provide for an ethics advisory group, but we know that the Cabinet Secretary for Justice intends to establish such a group. What might that look like? I understand that there is a biometrics and forensics ethics group in England and Wales. Might the cabinet secretary’s group look similar to that, and how might such a group contribute to the work of the Scottish biometrics commissioner?

Professor Wiles

As a precursor to my response, I should say that I do not think that the bill will prevent the commissioner from setting up an ethics group. One way or another, that can happen.

However, you are correct. The Home Office has an ethics group, which has done some very important and useful work, some of which has been published. I say “some”, because it is a Home Office group and therefore the Home Office decides whether the group’s reports are published.

I was surprised when you said that it is the justice secretary who will set up an ethics committee, as opposed to the commissioner. If there is going to be an ethics committee, it should be transparent and its findings open.

In England and Wales, there are a number of ethics committees. You referred to the Home Office one, but there is also a cross-Government ethics committee that is looking at new technology in Whitehall.

I fully understand why people should look at the ethics of the use of new technology—I assume that we are talking about public ethics here. Of course, we expect individual actors to act morally, and we have seen examples in which those who work for technology businesses have pretty well forced their companies to pull out of contracts as a result of ethical concerns. Recently, some Google employees did that.

Of course individual ethical decision making is important, but we are really talking about the public ethics of the use of biometric data. That leads on to what I said a moment ago: the first question is how you balance the public interest in the use of the data against invasion of privacy and restriction of liberty. Those things seem to go together, and they are the kinds of issues that ethics groups can advise on.

10:45  



Liam Kerr

I go back to the line of questioning that Maurice Corry was pursuing. Would there be value in somebody setting up such a group prior to and in order to advise on the codes of practice that he was asking about?

Professor Wiles

You have said that the justice secretary is thinking of setting up a group; if that is so, it is not for me to comment on. The justice secretary will no doubt do that, and I can understand why he might want to do so. As I say, there is a cross-Whitehall group that looks at ethics and advises ministers and Government on the ethics of all new technology, not just biometrics. I can see such a group playing that role and being extremely useful. If there is such a group, I am sure that when the commissioner draws up codes of practice, they will be interested in the issues that the ethics group raises.

If the justice secretary does not set up an ethics group, the commissioner remains free to do so—I think.

John Finnie

I do not know whether you are aware of the criticism that Police Scotland faced about its roll-out of digital device triage systems, which became known as cyberkiosks. That criticism was founded on the dearth of a robust legal basis for that roll-out or any engagement with relevant stakeholders. You talked about the providers’ “vociferous lobbying”—that lobbying will involve getting information to the public about how vital a product is.

You have also repeatedly talked about how important trust in the police service is and how the term “policing by consent” is often used. I do not think that anyone would dispute that there should be engagement, but how informed can that public consent be?

Professor Wiles

I have several things to say. First, that is why I said that there are three pieces of technology that go together here. The kiosks that you refer to are not necessarily biometric, but they are part of the technological family of which biometrics is a member. That is exactly why I made that point; it raises the same issues.

I noticed the proposal to give the Scottish commissioner a role in informing the public, which is important. Another important point is that, in carrying out that role, the commissioner will want to bring together what the tech companies say about the products and their evidence to justify what they say about the products—the scientific basis for that, any independent testing that has been carried out and so on. I hope that the commissioner will be in a position to bring that together and offer some advice on where the evidence points.

That role in encouraging and, to some extent, leading public debate will be important for the commissioner in Scotland, and will result in, I hope, a proper and informed public debate. What you are hinting at without saying it—and I agree with you—is that the current debate in England and Wales is not terribly well informed. As you are probably aware, I have been critical of Whitehall ministers for not leading that debate.

John Finnie

Who is leading it?

Professor Wiles

That is the problem; I do not think that anybody is leading it in England and Wales. That is exactly why I have been critical.

People have tried. The House of Commons Science and Technology Committee, on which some Scottish MPs sit, has considered the matter. I have given evidence to that committee, as has the Forensic Science Regulator and the Home Office minister responsible for biometrics. The Science and Technology Committee has published a report and, as you know, it has called for a moratorium on the use of facial imaging until some broader regulation is put in place.

There is a debate going on. At the moment, it is being led by, first, the Science and Technology Committee and, secondly, pressure groups such as Liberty and Big Brother Watch, which have successfully pushed the matter into the public realm so that the public are more aware than they were even a few months ago about the way in which some technologies are being used. The debate is still quite muted, however, and it is not as fully informed as it could be, ideally.

John Finnie

Would the new commissioner be able to move the debate beyond the idea that interfering politicians are trying to frustrate the efforts of the police to keep communities safe? That is how the debate is presented.

Professor Wiles

That goes back to the question that I raised some time ago about the public interest. I would have thought that we have a general interest in wishing to see justice properly existing. None of us wishes to be a victim of crime; we seek to ensure that we are protected from being victims of crime. I am sure that we think that those who commit crime—particularly serious crime—should be dealt with appropriately by the judicial system. I doubt that there are many people who do not think that that broad purpose is in the public interest. The question is how far the new technologies can aid that purpose and whether that outweighs the extent to which the use of those technologies interferes in the liberty of other people. When cases have got to court—particularly the European Court of Human Rights—that is the balance that the courts have always been concerned about: is that proportionality appropriate? That remains a very proper question, and it is a question that anybody who wishes to use the new technology should be answering.

On the other hand, I do not think that the matter should be left to those who wish to use the technology. It is a matter of public interest—it is a public matter and therefore a matter for a body such as Parliament, or Parliament through a commissioner in the way that is proposed. I find it interesting that the commissioner of the Metropolitan Police has said clearly that she thinks that new technology will improve policing and that she wishes it to be deployed in policing, while saying at the same time that she does not think that it is for the police to draw up the rules by which that technology is used.

The Deputy Convener

That concludes our questions. I thank you both very much for attending.

10:53 Meeting suspended.  



10:56 On resuming—  



The Deputy Convener

I welcome our second panel of witnesses: Dr Christopher Lawless, associate professor, department of sociology, Durham University; Dr Hannah Graham, senior lecturer in criminology, Scottish centre for crime and justice research, University of Stirling; and Dr Karen Richmond, University of Strathclyde. Thank you for your submissions.

We will move straight to questions and I will ask the first one. From what we have been hearing and what we know, it would appear that the introduction of the bill is timely, given the rapid development of new biometric technologies. Will you outline why you think that establishing a Scottish biometrics commissioner at this point in time is so important?

Dr Christopher Lawless (Durham University)

In the previous session, we heard that there are many fast-moving developments in biometric technology. In terms of anticipating such developments, the first important thing is that there is a gap that needs to be filled by an agency or body that can address the technical standards around biometric technologies and critically assess the scientific basis of such technologies. For me, that is really important, because when we talk about the ethics of biometrics, the ethical issues are very closely related to—if not interdependent with—matters of reliability and validity, and they link into matters of public confidence. We see that with, for example, automated facial recognition. There have been concerns about the reliability of that technology, the potential adverse impact that it may have on individuals and, in turn, the potential for adverse views from the public.

With regard to the role of a Scottish biometrics commissioner, there is a gap to be filled. We have the Forensic Science Regulator in England and Wales, and there is a need for a separate agency in Scotland to address the various ethical and scientific challenges, which are interlinked, and how we communicate them to the public.

Dr Hannah Graham (Scottish Centre for Crime and Justice Research)

To complement what Dr Lawless said, I emphasise Professor Wiles’s comments on certain issues capturing the public imagination, but perhaps with the public having a limited or diminished understanding of what is involved. As recently as in the past few weeks, there have been headlines in London around whether some of the technology might be inaccurate in 80 per cent of cases. Such statistics can capture the public imagination quite quickly, potentially cast doubt on authorities in which we would want to maintain public trust, and raise legitimate questions about accuracy, validity, bias and discrimination, and the transparency with which data is collected. The bill focuses on the police—although it may be extended—but our biometrics are being used across our daily lives, therefore the role of commissioner needs to involve public communication and awareness raising, and to an extent provide public reassurance. It must also be independent from but have the confidence of the Parliament.

I echo what Professor Wiles said about Scotland having the opportunity to be pioneering in that way. One of the strengths of the bill is that the commissioner’s role could have an appropriate level of flexibility to deal with the rapid rate of change. Each time that I go to a tech conference, there are new uses, and your head has to try to keep up with how many human rights implications there might be. With the pace of change, an independent oversight role would be appropriate for the public.

11:00  



Dr Karen Richmond (University of Strathclyde)

I echo what Dr Lawless and Dr Graham have said and what Professor Wiles alluded to. We are seeing a step change in the emergence of new investigatory and broadly forensic techniques, which are quite different from the techniques that we are used to, such as the use of fingerprints or DNA, which emerged from certain forensic trade crafts or the scientific sector. Investigatory techniques are emerging that are driven by big data, and they are proliferating into areas that go beyond what the police, the investigative authorities and the Forensic Science Regulator, for instance, would be used to dealing with. The time is right to try to catch up with that development and even to try to get ahead of the curve to some degree by creating a position that is flexible and reflexive and can react to those interdisciplinary challenges.

Shona Robison

Good morning. As we have heard, the bill provides that the commissioner’s general function will apply only to Police Scotland and the Scottish Police Authority. Should it also apply to other criminal justice organisations or other bodies that collect and use biometric data? If so, what bodies should be included?

Dr Graham

That is almost entirely what my submission focused on. I deliberately chose language such as “consider” and “discuss” because future proofing of the bill might be considered. I am not strongly advocating that certain justice authorities must be included, but it would be worth considering whether the Scottish Prison Service, electronic monitoring providers or local authority providers of public space closed-circuit television combined with facial recognition technologies should be encompassed within the commissioner’s remit and the code of practice now or in the future.

I want to draw attention to the fact that the Scottish Prison Service and the provision of electronic monitoring currently involve both public and private companies, and that might continue to be the case in the future. In addition, electronic monitoring does not have a dedicated inspectorate. Inspectorates have roles that are separate from what is proposed in the bill, and electronic monitoring would span three inspectorates with changes that are coming in with the Management of Offenders (Scotland) Act 2019.

I am not involved with and am not able to comment on the live electronic monitoring procurement exercise that is under way, but most of the international providers of electronic monitoring and reporting technologies, such as tagging, boxes and kiosks, have increased interconnectivity with other technologies. Therefore, we might see biometrics connecting with the global positioning system and with other things that we could know about people who are monitored. Increasingly, nearly anyone who bids for the Scottish contract will have biometrics as part of what they are suggesting, because they will need to be able to verify or identify a person remotely for their home detention curfew or alcohol monitoring, and to verify that a breath sample that has been given is indeed theirs. That will be a feature.

With the Scottish Prison Service, we can have a bricks and mortar understanding of what happens in prisons but, as recently as at your evidence session last week with Her Majesty’s inspectorate of prisons for Scotland, you heard the deputy chief inspector advocating further use of technology in Scottish prisons as a priority, and that might use biometrics.

Another area that I am unclear about and that has captured the public imagination is the involvement of biometric data in cases involving violence in custody as well as the profoundly serious and sad cases where there is a death in custody. The committee should check and discuss with the relevant people how the bill relates to that. If the bill goes ahead largely unamended, I would want the committee to check that you are confident that the Police Scotland and SPA remit within that is fine. A fatal accident inquiry is not about criminal or civil liability or the investigation of a crime; it is about establishing the circumstances of a death, yet biometric data has been the subject of questions at First Minister’s question time and public headlines, particularly in relation to CCTV footage in recent high-profile cases. I do not advocate that you should arrange everything around statistically rare but high-profile exceptional cases but, given the seriousness of what can sometimes happen in our prisons or with monitored people, it is worth discussing that further.

Dr Lawless

I largely agree with that and I have just a small point to add. Incidents and offences can occur in prisons and they need to be investigated, too. Some thought needs to be given to that, even if it is just a small amount of thought, to consider who collects biometrics, when they do it and by what means.

Dr Richmond

The use of biometrics in prisons is beyond my area of expertise, but I would be concerned if we focused entirely on the use of biometrics by investigative authorities and overlooked the use of biometrics in SPA forensics. There is a tendency to focus on the use of biometrics in investigations in the public sphere and then to assume that anything that happens beyond that is a matter for the courts. However, members of SPA forensics talk about using forensic techniques from the crime scene to the court—they understand it more as an evidential trajectory. It is important to bear in mind that virtually all the techniques that have ever been used just for forensic intelligence or investigative purposes have then developed and evolved and become evidential techniques—at least, there have been attempts to walk them into the courtroom. There is a forensic and scientific element to all the biometric techniques, and we should not lose sight of that when we concentrate on their use for investigation.

Liam McArthur

Just to follow up on that, I think that you have picked up Professor Wiles’s point about the journey through the criminal justice system. He made the point—he has left the public gallery, so I can probably now confidently paraphrase him—that the controls around data protection and the involvement of the information commissioner provide some safeguard across the public and private realms. Does that give you confidence about the way in which biometric data is potentially being used?

Dr Lawless

I still think that there is a gap to be addressed. We need to think about how we define biometrics. Are we talking just about the final data that comes out? For example, to go back to the distinction between a data profile—the data that is stored—and the material, do we need to think more broadly in terms of the processes that are at play in the production of a piece of biometric data?

A whole host of processes—from recovering a piece of evidence at the crime scene to turning it into a piece of biometric data that might be comprehensible in the course of an investigation—potentially need to be monitored to ensure that scientific standards are being properly applied, as well as in relation to other kinds of issues.

I am not sure whether that falls under the remit of the information commissioner, which is an argument for a biometrics commissioner to oversee the wider process.

Liam McArthur

Witnesses talked about the extent of the pace at which technological change is opening up a raft of complex issues. Does the way in which the bill is drafted allow sufficient flexibility and responsiveness to keep pace with that change?

Is it important to amend the bill to provide a greater degree of reassurance that it is future proofed and that the commissioner will be able to respond to, and anticipate, changes in the way in which technology is developing?

Dr Graham

I do not have major concerns in that area. Although I do not wholly specialise in the area, there is a sense that—despite the need for more discussions—there are no significant surprises or unexpected things in the way that the bill is drafted.

I emphasise that what sounds like a distinction between what is happening in Scotland and what happens in England and Wales is the proactive nature of the commissioner. I would celebrate that element of flexibility being recognised and cemented in the bill. The committee will be well aware of the inherent difficulties and sensitivities in making law and policy around a controversy with more heat than light. The commissioner’s role and their need to be flexible may grow and may need to be re-evaluated in line with more use of technology and more cases coming to their desk. I see biometric technologies and other forms of data practices only growing in the future.

Liam McArthur

In your written evidence, Dr Richmond, you suggested that the bill might be open to challenge with regard to the Scottish commissioner’s functions. Will you explain in a little bit more detail what you mean by that, and whether you have any suggestions as to how the bill might be amended in order to address that concern?

Dr Richmond

Certainly. In my submission, I was concerned that there might be a slight lacuna in the bill between the function of the Scottish biometrics commissioner and Professor Wiles’s function in England and Wales.

As he stated in his evidence, when Police Scotland and the SPA collect samples of DNA and what are called “ten prints”—fingerprints—and load them on to Scottish databases, they are also loaded on to the UK national DNA database and to IDENT1, which is a national UK fingerprint database. From the way in which the proposed legislation is drafted, it seems as though the samples that are copied on to UK databases might fall between two pieces of legislation.

Professor Wiles alluded to one or two solutions. First, he stated that new databases are coming in, through which the problem might be resolved. Although I do not know anything about that—I could try to find out and send you a written submission—I hope that the new databases that are to replace the existing ones do not replicate their architecture, as that will not resolve the problem.

His other suggested solution was that the commissioner should sit on the strategy board. That is certainly a good way forward, and it seems to exemplify the flexible and communicative role that is envisaged for the commissioner.

I would hope that that would be made concrete through some form of protocol, so that if a member of the public was concerned about the retention of their fingerprints or DNA, there would be some fairly robust mechanism to ensure that, if the retention was unlawful, that information could be removed from the databases.

11:15  



Liam McArthur

Thank you—that is very helpful.

James Kelly

One of the main tasks in implementing the bill would be for the Scottish biometrics commissioner to draw up a code of practice for the use of data by the police and the SPA. What main factors should be considered in order to ensure that the code is robust enough?

Dr Lawless

Following on from what Professor Wiles said, it is important that a code of practice is driven by clear principles. I have been thinking a lot about the process of drawing together such a code. I emphasise the importance of the consultation process—that has been discussed previously, but it is worth revisiting. The bill lists some obvious consultees, but it gives the commissioner quite a lot of scope to consult other stakeholders, too.

It is important for the commissioner to consult as wide a variety of stakeholders as possible. I emphasise the need to have a conversation with suppliers and industry, which should have their own board, but it is also important to consult others, such as civil society groups. We have heard about the role of organisations such as Big Brother Watch in England and Wales; such groups very much need to be included. The public should possibly be consulted, too, as the code of practice needs to be clearly communicable and clear to the public. Consulting a suitably varied and diverse array of people might help to protect the code from any accusations of vested interests or other such criticisms.

I have one final thought. The bill talks about the need to consult. Perhaps there needs to be some real reflection as to what consultation actually means in this case. Would the commissioner draft a code and send it out to stakeholders, or are those stakeholders to be included in the process from the outset? That is maybe something to think about.

Dr Graham

I agree with Dr Lawless. I underscored in my written submission the need to consider diversity, equalities and protected characteristics in that regard. From the independent academic and scientific research that is going on around some of these technologies, we have an awareness of issues around data justice, algorithmic bias and the disproportionate impact on particular groups, some of whom, although not all, are minority groups. For example, women are not a minority group but a fair proportion of the population.

The process would depend on the data, technology and practice involved, but I echo the need to consult widely and listen to people. One of my suggestions was to consult the Mental Welfare Commission for Scotland, because the commissioner has to have due regard to children and vulnerable people. In addition, I celebrate the fact that the Scottish Human Rights Commission is one of the named groups in the bill. However, as I originally come from Australia, I point out that, in an Australian jurisdiction, there would be quite a lot of consultation with an anti-discrimination commissioner if there was the potential for people of colour, ethnic minorities, young people or people with other protected characteristics to be impacted and for issues of equality and diversity to arise. The public would—quite rightly—be interested in those aspects, and we have seen some practices that have been experienced disproportionately by certain groups.

If you extended the remit of the commissioner and the code of practice to include other criminal justice agencies, you would need to add their inspectorates to the list of those to be consulted, as well as HM inspectorate of prisons for Scotland and the Care Inspectorate if it involved local authorities and community justice.

Dr Richmond

As well as the code of practice being robust, I recommend that a degree of flexibility is built in. Given the nature of many of the challenges, which are arising at an increasing pace, a degree of flexibility would allow the biometrics commissioner to respond in an agile way.

James Kelly

Dr Graham touched on the point that one of the concerns about the fast pace of development of biometrics technology is that people’s human rights might be compromised. How can the code of practice protect people’s human rights?

Dr Graham

That is a good question. Some of the answers might depend on the extent to which the code can be enforced and what the commissioner’s powers are. Scotland prides itself on being progressive and a rights-respecting nation and so I would hope that everyone would speak about human rights, but we also need to have a pragmatic conversation about enforcement or processes of communication to expect public and private bodies to comply with the code of practice.

I am not a human rights lawyer and I know that the Scottish Human Rights Commission has some excellent and vibrant views on that. I commend the amazing and excellent report of the independent advisory group on biometric data, which had human rights running right the way through it. However, I cannot easily answer the question without talking about the power or authority to enforce.

James Kelly

I will come to the other witnesses in a minute, but on that specific point about enforcement, do you think that it is a concern that the bill does not give the commissioner the power to enforce the code of practice?

Dr Graham

There are probably different views on that. If my understanding is correct, the ability to require people to provide information is good and I would support it. As you heard from Professor Wiles earlier, it sounds as though there is quite a diplomatic ramping up of communication—it reminds me of how we train probation officers—in that if an organisation does not comply, the commissioner might release the name of the police force, agency or whatever. I imagine that that would clarify decision making.

Unfortunately, on rare occasions, there might be a serious case in which enforcement would be needed. I hope that the committee and the Parliament are either satisfied with the bill as it is or amend it to provide for some of those enforcement powers. Personally, I would tend towards giving the commissioner the enforcement powers, but with the recognition that they may not be used regularly.

Dr Lawless

There is a potential question about resourcing. If we are talking about human rights, we are going back to some of the questions that were discussed earlier, such as who should be allowed to take biometrics and under what circumstances. We need to think carefully about how such practices might occur on the front line. To go back to what was said earlier, we must ask whether we need to think about potential local differences in practice or whether we need to ensure that good practice takes place across Scotland. That gets me thinking about whether the commissioner would have time to visit various parts of the policing service to compare and contrast, check and establish that the code is being followed and to ask such questions across the board. Potentially, it comes down to being a matter of having enough time.

Dr Richmond

I return to the issue of a statutory power of enforcement. The way in which the bill is drafted—without such a statutory power—sits quite well with the way in which the regulator’s role has been envisaged in this case.

I have done some research on the Forensic Science Regulator, who has a slightly different function, and there has been a lot of impetus from that office to get a statutory power of enforcement. That fits well with the FSR’s role, as it is to police the boundaries of science and ensure that everyone meets a certain basic quality standard with a stable set of scientific techniques.

What is envisaged for the new commissioner is more evolved and slightly different, involving much more flexible communication and engagement with a number of stakeholders. Perhaps that is the way to move forward, rather than having a statutory enforcement role.

Liam Kerr

I return briefly to an issue that came up earlier. Dr Lawless brought up resourcing and Jenny Gilruth quite rightly asked the earlier panel about the commissioner’s role being part-time. Professor Wiles said that, because they would have a team, it would fundamentally be okay. However, in his written evidence, Dr Lawless disagreed and expressed a concern that a part-time role might not be sufficient. Will you elaborate on that, Dr Lawless?

Afterwards, will you give us your thoughts, Dr Graham, because you talked in your evidence about the remit being extended to other agencies such as the Prison Service? Presumably, that would load responsibility on to what is currently intended to be a part-time role.

Dr Lawless

I have reflected on that and I heard what was said earlier in the meeting. Some of my concerns would be met, provided that the commissioner is sufficiently supported by a full-time team. There is an important need for a multitier system, which has been suggested in written submissions, so that there is an advisory group to assist the commissioner.

Potentially, the part-time issue could be resolved if the commissioner has sufficient support, but we should not underestimate the scale of the challenge that they might face. There is the increasing variety of technology that might be available and would need to be considered, as well as the amount of work that might need to be done, not just in anticipating new technology but thinking about how that technology might be regulated, including through the development of technical standards. Those aspects are interlinked with matters of ethics and public confidence.

On reflection, I am open to arguments either way, but members should not underestimate the potential scale of the task that the commissioner might face. I urge members to consider, regardless of whether the role is part-time or full-time, the point that the commissioner be given sufficient support.

Liam Kerr

Forgive me, Dr Graham, but before you come in, I want to ask Dr Lawless about a concern that was raised in his written evidence—it might or might not have been in his submission—about resourcing and the financial memorandum not sufficiently taking into account the support that you have mentioned. Will you elaborate on that point?

Dr Lawless

Having looked at that again in a bit more detail, I can see the other arguments with regard to some of my concerns, but one concern remains. I think that the financial memorandum said that the cost of implementing the code would be “minimal” and, if we assume that we are just dealing with the police, I can see that the costs might be minimal. My concern is whether—and, if so, to what extent—the police are reliant on third-party suppliers for biometrics. If those technologies are being brought in by commercial firms, and if we were to allow for that in the bill and the commissioner’s remit, we might need provision to assess the technologies, think about how they are being used and check technical standards with the third-party suppliers.

11:30  



Dr Graham

I, too, acknowledge what has been said and emphasise the level of interdisciplinarity that will be needed in the role. I say with respect and humility that there are not an extraordinary number of people in Scotland who could do the role, and they would need an interdisciplinary team around them. Even the panellists have different qualifications—they may have similar qualifications, too—and quite different experiences. For example, I can speak only as a criminologist to one narrow part of that topic. Thought needs to be given to what might be expected of the commissioner now and in the future, the potential growth of the role and the need to work across technology, policing, criminology, criminal justice, data science, information, law and human rights. Those are the things that the panellists have to spend many of our waking hours reading up on in order to understand what is going on, so the commissioner will have to have a team around them.

I also acknowledge and echo the recommendation of the independent advisory group on the use of biometric data in Scotland to establish an ethics advisory group. That group could be established by the Cabinet Secretary for Justice or by the commissioner. That could be done in different ways. It may or may not operate for free.

I note that the research budget would not buy much research, should the commissioner want to commission any. I mean no disrespect to my colleagues’ contributions, but there is not a lot for us to go on. The bill talks about ethical and effective practices. There can be no claims about effectiveness without evidence to back that up.

The commissioner could work more with the people who bring in larger, independent research funds, or they could work with organisations such as the Ada Lovelace institute, which, along with the Nuffield Trust, is doing amazing research. In recent weeks, it published research on recent public attitudes towards facial recognition technology.

The commissioner could choose to work in both those ways. However, I suggest that the resourcing needs to be reasonable for the remit that you end up agreeing to, if you pass the bill.

Dr Richmond

Dr Graham mentioned interdisciplinarity. I echo that that should really be brought to the fore in relation to the commissioner’s capabilities and the mixture of the support staff that are available. The challenges that a commissioner faces will entail an interdisciplinary approach, a high degree of reflexivity and an ability to work over disciplinary boundaries and understand the needs and objectives of other actors. That should also be reflected in the ethics group.

The Deputy Convener

Dr Graham mentioned that there might not be such a large pool of people with the necessary experience to pull everything together. Should the person be based in Scotland? Should they have an in-depth knowledge of the Scottish system and the devolved nature of the issues?

Dr Graham

That is a good question. I suggest that the Scottish biometrics commissioner should have a well-developed knowledge of the Scottish context. Despite there being a national policing hierarchy, localism is a feature of Scottish justice, public protection and community safety. At times, that is something that this Parliament might celebrate; at other times, it may throw up some complexities.

Whoever has the role must have good awareness, because they need to hold the confidence of the Parliament and the public. They must have a very strong awareness and sense of Scottish contextual features. I do not have a view on where they should live or where they should be from. As a dual citizen and someone with an accent, I do not mind.

Dr Lawless

I agree that this is very much an interdisciplinary role. The pool of candidates is potentially limited. However, I am confident that there are people who could fit the interdisciplinary remit. In my experience of talking about forensic and biometric issues with various stakeholders, I get the sense that many recognise that, if someone has a scientific background, for example, they must also be conversant in law, matters of ethics and social impact; likewise, they recognise what other knowledge someone with a legal or social scientific background would need. A lot of us recognise that there is a need to be conversant in those areas.

I am quietly confident that there are people who would fit the remit. Even in the short time that we have had the roles of the Commissioner for the Retention and Use of Biometric Material in England and Wales and the Forensic Science Regulator, the people doing those roles have had quite varied professional backgrounds. If some flexibility is given in relation to people’s backgrounds, it would be possible to find candidates for the role.

The Deputy Convener

That is an encouraging note to end on. Thank you very much for attending. We shall have a five-minute comfort break, to allow the witnesses to leave.

11:35 Meeting suspended.  



11:40 On resuming—  



Video Thumbnail Preview PNG

Third meeting transcript

The Convener

Agenda item 2 is an evidence session on the Scottish Biometrics Commissioner Bill. I refer members to paper 1, which is a note by the clerks, and paper 2, which is a private paper.

I welcome to the meeting our witnesses. They are Humza Yousaf, who is the Cabinet Secretary for Justice; Angela Davidson, who is the head of the police powers unit; Elaine Hamilton, who is the head of forensics policy; and David Murdoch, who is from the Scottish Government legal directorate.

I invite the cabinet secretary to make a short opening statement.

The Cabinet Secretary for Justice (Humza Yousaf)

I apologise for running late and thereby interfering with the committee’s business.

I thank the Justice Committee for its scrutiny of the bill to date, and I thank the stakeholders who have contributed to developing this important bill.

The Scottish Biometrics Commissioner Bill speaks to key societal issues of our time—it touches on human rights and ethics as they relate to police use of personal information.

I want to ensure that our approach to biometric data—including from new technologies such as facial recognition software—is effective, proportionate and ethical. The bill will create an independent commissioner to advise on such issues and to oversee police policy and practice. My goals are to keep communities safe while respecting the rights of individuals, and to improve the accountability of the police.

The oversight arrangements in the bill will apply to Police Scotland and the Scottish Police Authority. The commissioner’s general function will be to support and promote adoption of lawful, ethical and effective practices in relation to collection, use, retention, and disposal of biometric data in the context of policing and criminal justice.

Another important function of the commissioner will be to promote public awareness of biometric data and of how police powers are exercised and may be challenged.

The commissioner will also prepare and promote a code of practice that may set out the standards and responsibilities of Police Scotland and the SPA, with the aims of ensuring good practice, driving continuous improvement and enhancing accountability. The code will be subject to consultation and the approval of Scottish ministers and the Parliament.

To enable the commissioner to perform his or her functions, the commissioner will have the power to request information. Having considered the information, the commissioner can make a recommendation with a requirement to respond. If no response is forthcoming, the commissioner could publicise that fact, so there will be the sanction of naming and shaming.

Through the bill, Scotland will have a commissioner who will encourage and support fulfilment by Police Scotland and the SPA of their functions in a manner that respects fundamental human rights, the law and ethics. That support will include promoting good practice, identifying systemic deficiencies and providing a measure of transparency, which will promote public confidence in policing and in the criminal justice system.

I am happy to respond to members’ questions, and I look forward to considering the committee’s stage 1 report and any recommendations that it might make.

The Convener

In their evidence, several stakeholders mentioned that the bill does not principally define the commissioner as a body with powers to scrutinise police use of biometrics. Instead, the bill refers to the general function, which you mentioned,

“to support and promote the adoption of lawful, effective and ethical practices”.

Should the commissioner’s powers be strengthened to include such a scrutiny and investigative role?

Humza Yousaf

That is an important matter, which I know has been a common thread in the committee’s evidence sessions. I was particularly taken by the evidence that was given by Paul Wiles, who is the Commissioner for the Retention and Use of Biometric Material, for England and Wales, in which the idea that the sanction of naming and shaming should not be seen as a light-touch option came through clearly. You asked about strengthening the commissioner’s role, convener: I caution against thinking that naming and shaming is a weak sanction.

Careful consideration was given to the scope, functions and powers of the commissioner. We had to be mindful not to duplicate or step over into the roles of other regulators—in particular, the UK Information Commissioner. Professor Wiles said in evidence that his role—the equivalent of the Scottish biometrics commissioner—does not need specific enforcement powers and that the police and other authorities are, in his experience, open to discussion.

Failure to have regard to the code of practice could result in notification to Scottish ministers and the Scottish Parliament. That public sanction of naming and shaming could have a significant effect on the police; I am certain that the police would not want to be in that position. We have given the matter careful consideration and I think that we have struck the right balance. The dynamic of the relationship between the commissioner, Police Scotland and the Scottish Police Authority will be very important.

The Convener

Given that it is important that the public have confidence in the legislation and the power of the police to collect personal data, the Information Commissioner’s Office is quite supportive of the biometrics commissioner having a stronger role, and suggested that they could work together, which would mean that your fear of duplication could be overcome. Would you be prepared to consider that, as the bill progresses?

Humza Yousaf

As always, convener, I will be open minded about any suggestions. I have a very positive relationship with the Justice Committee in respect of the recommendations that it makes on legislation. As things stand, my resolute belief is that we have struck the right balance. We want to ensure that the dynamic of the relationship between the commissioner, Police Scotland and the SPA is positive and open, but we also want to ensure that the commissioner feels that he or she has enough powers—should it ever be the case that Police Scotland and the SPA are not complying—to get them to have regard to the code. We have got that balance just about right.

I will wait to see the recommendations in the committee’s stage 1 report, but at this point I do not envisage making many changes to the commissioner’s role in relation to sanctions. As I said in my previous answer, I see the roles of the UK Information Commissioner and the Scottish biometrics commissioner as being complementary, and I do not want overlap. Your points on that are on record, convener, and I will give consideration to whatever the committee’s stage 1 report recommends.

Liam McArthur (Orkney Islands) (LD)

Good morning, cabinet secretary. In your opening remarks you mentioned building public confidence in the activities of the SPA and Police Scotland, so it would be helpful if you could give further details on how you see the functions of the commissioner giving rise to that confidence across all the biometrics technologies that Police Scotland and the SPA will use. In particular, you noted the public debate around facial recognition technology. Would you expect assessment of use of live facial recognition to be a priority for the commissioner?

Humza Yousaf

I know that Liam McArthur has a long-standing interest in that matter. I thank you for the question, which I will answer in two parts.

Public confidence is hugely important. I think that there is a high degree of public confidence in Police Scotland—we see that through criminal justice surveys and so on. It is absolutely correct that, whenever new technologies are being used, especially those that have a biometric data element, it is really important that the public be given as much reassurance as possible. How will that be done? First, the biometrics commissioner’s role should not be seen in isolation, so a number of other structures are being put in place to complement it. Liam McArthur will know about the independent advisory group’s recommendation that an ethics advisory group sit alongside the commissioner to provide expert advice and opinion.

I have been at the Justice Sub-Committee on Policing, on which Liam McArthur sits, where I talked about the group that I want to set up that will look at technologies that are coming down the line, and how we will ensure that the ethical frameworks around those technologies are positive. My officials are working on that: the work will largely relate to the sub-committee’s work on what are known as cyberkiosks, or digital triage devices. We have the UK Information Commissioner plus a suite of other measures.

When it comes to developing the code of practice, it will be very important that consultation be part of that. The bill prescribes the organisations that the commissioner should consult, but there is also a catch-all provision to the effect that other relevant stakeholders must also be consulted. I do not want to prejudge, of course, but the commissioner might well think it a good idea to consult the wider public on a code of practice: I think that doing so would be a positive step. Therefore, there are a number of ways in which we can build public confidence.

The second part of Liam McArthur’s question is about facial recognition technology, which has two elements. The element that is most relevant to the question is live facial recognition technologies, such as those that we see being piloted by the Metropolitan Police and South Wales Police. At a concert, for example, faces can be matched to images that the police have on their database. That is exactly the sort of technology that will fall within the scope of the biometrics commissioner’s role and, I would think, the code of practice. It is also exactly the sort of technology that should be rigorously assessed in relation to human rights and ethics. Liam McArthur is right to raise that as one of the most important issues for biometrics, moving forward.

Liam McArthur

That is very helpful. I take it from what you are saying that you see the matter as being a priority, in the sense that there will be a lot of work to be done in the early stages. Given some of the discussion around use of live facial recognition technology, do you expect that it will be a priority for the commissioner?

Humza Yousaf

I suspect that it will. My only caveat is that it is my understanding—it is an operational matter, of course—that live facial recognition is not used by Police Scotland, although no doubt it is looking at the pilots that are being carried out by the Met and South Wales Police. It might well be that the priority is existing technology that is being used, with a view to looking at emerging technologies in the future. Either way, live facial recognition will certainly be one of the priority areas that will be looked at.

John Finnie (Highlands and Islands) (Green)

It has been suggested that the commissioner’s responsibilities be extended to include other criminal justice users, such as the Scottish Prison Service and the British Transport Police. Why is the bill limited to the Scottish Police Authority and Police Scotland?

Humza Yousaf

The bill is narrow in its scope and specifically covers Police Scotland and the SPA because, although biometrics can be used by other public bodies and agencies, including the national health service, the way that biometrics are used in policing is unique. For example, there will be occasions when the biometric information is, for important operational reasons, taken without the individual’s consent.

Therefore, the context within which biometric data is taken in policing and the SPA is different from how it is done any other context. I will reflect carefully, and the committee might well signal this in its report, on whether we can give more consideration to where there are cross-jurisdictional issues—the British Transport Police and the National Crime Agency being obvious examples. I think that we have to give a little more consideration to bodies whose work has a policing implication. I have not made a decision on whether oversight should be extended to other policing bodies; I keep an open mind on that.

I also keep an open mind about broadening the commissioner’s remit in the future. It will be important that, from the moment when the commissioner begins to develop the code of practice, it is specific and narrowly focused on policing. If, once the code of practice is embedded and the commissioner is embedded in the role, a suggestion that the code be widened to include the Scottish Prison Service, for example, should not be off the table. However, from the moment the commissioner is appointed, he or she should be very focused on the SPA and Police Scotland, in my view.

10:30  



John Finnie

Thank you. I am pleased that you mentioned the BTP and the National Crime Agency; colleagues have questions on them. Is there a danger in the general principle of their not being included at this stage? Might we find that double standards emerge regarding collection and use of biometric data?

Humza Yousaf

I do not think that the comparisons are necessarily being made between apples and oranges here, because biometric data is used in a very different and specific way by Police Scotland and the SPA—particularly in forensics, obviously—from how it is used in any other scenario in which biometrics are retained. The policing context in which data is preserved, retained, collected and disposed of is unique: it does not compare with other contexts, and the rules that apply to policing do not necessarily apply to other public bodies. There might be good guiding principles on good practice that other bodies should consider, but some circumstances are very specific to the police, as John Finnie knows very well from numerous roles that he has had. The context of policing is very specific and very different from that of any other public body.

John Finnie

I know that you will pick up on this, but I note that of course the bill will not cover all the police that operate in Scotland. It will cover only Police Scotland, so I am pleased that you have undertaken to consider that.

I also suggest that other public authorities and private actors that utilise biometric technology should come within the commissioner’s ambit. The example that many people will be aware of is public-space closed-circuit television that is used by councils. Is there any reason why it should not be considered for the same level of scrutiny?

Humza Yousaf

If criminality has taken place in a public space, or there is a suggestion of criminality, such CCTV footage would be passed to the police. If a pub brawl, for example, was captured by CCTV cameras in a public place, one would think that that would, in the course of things, be passed to Police Scotland, which would have to make sure that it abided by, and had regard to, the code of practice, with oversight by the commissioner. Criminality, or even potential criminality, would be captured by the code and oversight of the commissioner.

I will not labour the point that I made earlier too much, but the context within which data is captured for policing purposes is unique. That is the priority of the effort, for very good and understandable reasons.

There cannot be a bigger effect on an individual’s human rights than through restricting their liberty—for example, if they end up in prison. The powers of our criminal justice system are unique and can have lasting and significant impacts on people’s lives. For that reason, the focus is on policing. We should not dismiss a possible broadening of that remit, or take it off the table, but the initial phase should be focused on policing, in my view.

John Finnie

Thank you very much.

The Convener

If we are to refer to the new post as the commissioner for biometrics, is there a possibility that the public will expect the commissioner to be able to look at biometrics in the wider sense, and that he or she might have to spend a lot of time explaining that they are just looking at biometrics in the context of policing and the SPA?

Humza Yousaf

That is a fair point, and I remember raising it at a meeting with my officials and other colleagues when we were drafting the bill, at which I asked whether there could be a misunderstanding of the role of commissioner. I wrestled with that a fair bit. It goes back to the points that Mr Finnie and Mr McArthur made that, if the commissioner was called the Scottish biometrics commissioner for policing, broadening that role in the future would be extremely difficult.

Once the position and code of practice are embedded, there might well be good reasons for the role to be extended to other public bodies outside policing, such as the NHS and so on. We could change the commissioner’s role, but if they had a different title we would need to decide whether to carry out a whole rebranding exercise. There are pros and cons, but I will keep a relatively open mind.

If we look at the role’s counterparts in England and Wales, I think that there is a good argument for both options, but ultimately we thought that, if the role was extended, we would have to change the title and that would be more challenging.

Jenny Gilruth (Mid Fife and Glenrothes) (SNP)

As you will be aware, it is anticipated that the commissioner’s role will be carried out on a part-time basis. You will be aware from some of our earlier evidence sessions that there has been a bit of debate around that subject. What is the rationale for the part-time role and is it something that you might consider revisiting in the future?

Humza Yousaf

Again, I noticed that that was discussed in a number of your evidence sessions, and I refer to the evidence given by Professor Wiles and a number of other interested parties. I will use the comparator example of Paul Wiles in England and Wales. Professor Wiles works part-time—0.6 full-time equivalent—in his role as commissioner. His remit covers 43 police forces but covers only fingerprints and DNA. His office is resourced to a maximum with four FTE officials who obviously do a good job of supporting him and his functions.

Those functions do not include the development and monitoring of a code of practice as is proposed for our commissioner, but they include considering applications from police forces to retain biometric data under certain circumstances, which is not proposed for the Scottish commissioner.

In all of that, having paid due regard to the differences between the commissioner in England and Wales and our proposals for the Scottish biometrics commissioner, we think that 0.6 FTE to cover the oversight of a wider group of biometric data—not just fingerprints and DNA—that is managed by one police force, albeit the second largest in the United Kingdom, and the Scottish Police Authority, is the right call. Also, our commissioner will be supported by three full-time members of staff in comparison to England and Wales, where there are four FTE staff.

Considering the comparators was the best way to do this. It will be quite an undertaking in the first year. The main focus will be on developing that code of practice with stakeholders and potentially with the public. Should we keep an open mind on that? Yes, absolutely. If the demands on the commissioner mean that they come back to us to say that they should go from 0.6 FTE to full time, we should keep an open mind on that. As we would always do, we will keep an open mind on the committee’s recommendation in that regard, because you have taken evidence from quite a number of sources.

Jenny Gilruth

That is helpful. The financial memorandum to the bill shows that the first year’s costs will be met by the Scottish Government and thereafter they will fall to the Scottish Parliament. It does not give any resources for research or public engagement that might be carried out by the commissioner. Is the assumption that those costs would be met by the Scottish Parliamentary Corporate Body, or would the Government meet them?

Humza Yousaf

There was maybe an issue about how the financial memorandum was presented. Perhaps we can be more explicit in future stages of the bill.

The public engagement budget is made up partly of the travel and subsistence budget of £4,000 per annum and partly of the website maintenance budget of £15,000 per annum, because there would obviously be a strong online element to the engagement. Both those sums are pretty generous estimates in the context of comparator public engagement bodies. Engagement with the public will be key, with both face-to-face engagement and an online presence. Any running costs relating to research will be sourced from the professional fees budget of £20,000 per annum, as set out by the financial memorandum.

Shona Robison (Dundee City East) (SNP)

Good morning, cabinet secretary. You mentioned the code of practice earlier, and I would like some detail on that, given its importance. You will be aware of the evidence from the independent advisory group on the use of biometric data, which recommended that a code of practice should be established in legislation and should come into force at the same time as the commissioner takes office. You will also be aware that other witnesses have said something similar to that. So far, that recommendation has not been accepted by the Government. In the light of the evidence that has been given, though, will you consider putting the code of practice on a statutory footing?

Humza Yousaf

For a couple of reasons, I would strongly prefer not to do that. First and foremost, I want the commissioner to develop the code of practice through his or her engagement with the public, stakeholders and whoever else. If the Government introduced the code of practice, it would obviously be heavily influenced and driven by the Scottish ministers and would therefore not be independent. The point about the code’s independence is hugely important. If we put the code of practice on a statutory footing at the same time as the commissioner took office, we would have to develop it. It is better that the independent commissioner develops it.

Secondly, the approach in which ministers give the date on which a code of practice would come into effect is done by the affirmative procedure and involves introducing the code of practice to Parliament, which means that there will be parliamentary scrutiny. Of course, we would not want to avoid parliamentary scrutiny of the code of practice, and there will be no suggestion of that, because scrutiny will be undertaken by a committee—I suspect by this committee. We have the right priorities of ensuring that a code of practice is independent and that it receives parliamentary scrutiny.

A third important point, which is often made about legislation, harks back to what Liam McArthur and John Finnie said. If the code of practice was put on a statutory footing, it would have a degree of inflexibility. However, we are talking about emerging technologies in this context. We might be focused just now on live facial recognition, DNA or fingerprints, but technologies will emerge in five to 10 years that are probably beyond our comprehension at the moment. There must therefore be a degree of flexibility about the code of practice. If we put it on a statutory footing, we would not have that flexibility.

Shona Robison

I guess that that would depend on the nature of the code. I do not want to pre-empt a later question, but we would like to know how detailed the code will be and how it will be segmented. I guess that the independent advisory group made its recommendation because it felt that the code is important. Do you believe that the code will be seen as important and solid whether or not it is put on a statutory basis?

My recollection of the independent advisory group’s evidence is that it recommended establishment on a statutory footing because so much of the detail of the operation will rely on the code. How do you answer that point?

10:45  



Humza Yousaf

I see where the IAG is coming from. I understand why people want things in statute. I have passed a number of bills in this Parliament and there has often been a desire for things to be in the bill. You are absolutely right and the IAG is correct that people sometimes view things in legislation as being more solid and having more effect.

However, it is undeniable that, when something is in primary legislation, it is far more difficult to change than when it is in a code of practice, as we have suggested here. With regard to the issue that we are talking about, it is important to have that flexibility.

It will be for the commissioner to highlight the significance or importance of the code of practice in the public awareness part of his or her job. How the stakeholders to whom it applies—in this case, Police Scotland and the SPA—act towards the commissioner and the code of practice will send an important signal about how important it is. I have spoken to the chief constable about the bill, and I have no doubt whatsoever that Police Scotland will treat it with the importance that it deserves.

The Convener

Significant concern has been raised about the effect of the code of practice. As things stand, Police Scotland and the SPA will simply have to “have regard” to the code, rather than have a duty to comply with it. Do you think that that should be changed to a duty to comply?

Humza Yousaf

I do not. In my answer to your opening question, I said that the dynamic is hugely important. I was quite taken by Professor Wiles’s evidence on that point, which was very strong. He felt that he had effective powers to make sure that police forces comply, which is the most important point, and that he enjoys a good dynamic and relationship with police forces, which means that he can be quite open with them and they, in turn, are quite open with him.

We should not downplay the seriousness of the power that the commissioner will have to alert ministers and the Parliament if the police do not have regard to the code of practice. I ask my officials whether there is also a power to inform the Court of Session.

David Murdoch (Scottish Government)

There is no power to inform the court about whether the police are having regard to the code. However, the biometrics commissioner will have the power to require the production of information by the police or SPA, to determine whether those bodies are having regard to the code of practice. That is the information requirement power.

Humza Yousaf

If the committee’s report were to have recommendations to strengthen that power, I would keep an open mind about it. I just do not want to get to a position in which the enforcement powers are so heavy that they affect the dynamics of that relationship. That might be something that can be considered once the commissioner and the code of practice are embedded.

The Convener

When the bill was mooted, right at the very beginning, this issue was up there as one of the main concerns. We were asked whether the commissioner—the person in charge—would be toothless, or whether they would have powers to ensure compliance and to investigate and scrutinise, so that the public would have confidence in them. I am not sure, as things stand, that the public will have confidence. The commissioner will be able only to name and shame, without the power to investigate and scrutinise properly, perhaps in advance, and the police and SPA will only have to “have regard” to the code, so the powers sound a bit weak at this stage.

Humza Yousaf

I take your point. We always thought that that element of the bill would come under a severe degree of scrutiny. I will keep an open mind to suggestions.

In one sense, the committee underestimates itself. Nobody likes to be hauled in front of a committee. We are happy to appear in front of a committee and answer questions, but if we are not complying with a code of practice or regulation and we get hauled in front of a committee and interrogated for an hour or two on that, it is enough to make us think twice about whether we are doing the right thing. I say that as someone who has been a Government minister for seven years, and I could say the same for my colleagues in Police Scotland and the SPA.

I would not downplay the public element. If there was a failure to have regard to the code, this committee—or any other committee in this Parliament—would not sit back and allow the police to get off the hook. I am sure that there would be intense political and media scrutiny. That public element is an important part of the commissioner’s powers.

The Convener

Legislation should be strong enough and it should not rely on the committee doing that scrutiny.

Police Scotland and the SPA suggested that the bill should refer specifically to the forensic services department and not to the whole of the SPA. Is that a reasonable suggestion? There seems to have been a rolling back.

Humza Yousaf

I cannot speak for the SPA, but I do not think that there was a suggestion of rolling back. The SPA was perhaps trying to focus on the part of the SPA that largely deals with biometrics, which is the forensic services department. I do not agree with the suggestion that the scope of the bill should be limited to that department. It should cover the whole of the SPA.

There is a legal reason for that. Forensic services is a department, not a legal entity in its own right. When legislating, we must be aware that the name of the department could change. Legally, it would not be right to specify that department. In future proofing the legislation, we must be aware that we do not know what other responsibilities the SPA might subsume in the future—although I am not prejudging that or suggesting that it will have any other responsibilities. For the legislation to be future proofed, it should apply to Police Scotland and the SPA. There should not be any narrowing of the focus.

The Convener

Legislation should always be as precise as it can be and there should be no room for misinterpretation. To “have regard” might say that there is manoeuvrability and wiggle room, whereas a “duty to comply” is quite different. However, I welcome your view that the bill should apply to the whole of the SPA for the reasons that you outlined.

James Kelly (Glasgow) (Lab)

How would you respond to those who say that, if there is no legal remedy for an instance in which someone pays no regard to the code of practice, the code is ineffective?

Humza Yousaf

I will defer to David Murdoch and other colleagues on the legal implications. Section 7 of the bill covers actions in which the code might be a relevant consideration; for example, if an action were taken against the police or the SPA—regarding the unlawful retention of data, let us say—the code could be a relevant consideration in any such action. A failure to “have regard to” the code is not in itself a matter to go to court about. However, if someone was concerned about, for example, unlawful retention or collection of data, section 7(2) allows failure to take into account the code of practice to be part of any action that is taken to court. There could be a point at which the bill could be relevant to that. As the legal head here, David Murdoch might have more to add.

David Murdoch

What the cabinet secretary said is correct. The code can be taken into account in relation to any action against the police. The duty to have regard to the code means that the SPA can depart from the code only if there is a good, case-specific reason for doing so—it cannot simply depart from the code because it disagrees with the general tenor of the code.

There is probably a public law remedy in relation to not having regard to the code, which would be a judicial review of the actions of the police or the SPA. There is a form of judicial oversight in relation to the police having regard to the code. There are some consequences for not having regard to the code. The police and the SPA have a public duty to have regard to the code, and there are administrative law consequences if they do not. There is always the possibility of judicial review.

James Kelly

Is the point about judicial review explicitly referred to in the bill?

David Murdoch

No, it is not explicitly referred to in the bill, because that is not necessary. The courts have supervisory jurisdiction over public bodies and their actions. The courts would have supervisory jurisdiction over the police and the SPA and the exercise of their functions in relation to the code, so there is no need for the bill to make specific reference to that.

James Kelly

I am sure that you will agree, cabinet secretary, that it is important that the public have confidence in the bill. Do you think that the bill would be strengthened if it explicitly stated that there was a mechanism for making complaints to the commissioner?

Humza Yousaf

At the moment, specific complaints about the handling of data can be made to the UK Information Commissioner. In answer to the convener’s opening question, I said that we have given a fair amount of consideration to the non-duplication of roles, to ensure that the Scottish biometrics commissioner complements the role of the Information Commissioner. There is currently an avenue to make a complaint about the handling of data, which can be investigated. The role of the biometrics commissioner is designed not to duplicate that.

However, I take the point that Mr Kelly is making about public confidence and perhaps being explicit about what the commissioner can and cannot do.

James Kelly

If an individual had concerns about the collection and processing of biometric data, where would they take them?

Humza Yousaf

That would come under the remit of the Information Commissioner. At the moment—even before the bill is enacted—there is nothing that would preclude an individual from going to the Information Commissioner if they felt that their biometric data was being unlawfully collected, retained or disposed of.

James Kelly

What would be the logic behind going to the Information Commissioner rather than the biometrics commissioner?

Humza Yousaf

The biometrics commissioner will develop the code of practice and be the oversight mechanism for the police and the SPA in relation to that code of practice. His or her job will be to have that oversight function and to make sure that the duty to have regard to the code of practice is complied with. We would expect the carrying out of the role to involve wide consultation. It would be at the discretion of the commissioner whether that consultation included the public.

I can see the attraction of giving the public a range of options of places to go with concerns, but given that there is already an avenue for an individual to make a complaint about the way in which their data is held, I am not sure that having another avenue for the individual to go down would be helpful—it might just muddy the water.

Elaine Hamilton (Scottish Government)

The Information Commissioner’s work is driven by complaints from individual members of the public, but the Scottish biometrics commissioner’s remit will be driven by identifying systemic deficiencies. There has been a lot of discussion with the UK ICO about the complementarity of the roles. The ICO very much welcomes the creation of the new Scottish biometrics commissioner and views that role as complementary to its role.

11:00  



As I said, the work of the Information Commissioner is driven by complaints from individual members of the public. The Information Commissioner has certain powers of sanction—for example, it can fine private and public sector organisations—but, in respect of the Scottish biometrics commissioner, we are talking about a day-in, day-out review of the use by the police and the SPA of biometric data.

In terms of public confidence, the biometrics commissioner role is all about driving improvement, improving transparency and raising public awareness. The bill’s provisions make those duties very clear. The bill is drafted in such a way as to allow the biometrics commissioner discretion in how he or she will carry out those functions, but the functions themselves are quite clear.

The Convener

The clerks have drawn my attention to the fact that, recently, the ICO published a report on how the police use facial recognition technology, which included the comment:

“The absence of a statutory code of practice and national guidelines contributes to inconsistent practice, increases the risk of compliance failures and undermines confidence in the use of the technology.”

I thought, cabinet secretary, that it might be useful for you to be aware of that comment and the context in which it was made.

Humza Yousaf

Yes, the clerks are, as always, very diligent and we will, of course, have due regard to that comment. It is an important point.

Fulton MacGregor (Coatbridge and Chryston) (SNP)

As you will be aware, cabinet secretary, the bill as introduced does not provide for an ethics advisory group to be established, but I know that you have committed to forming such a group. Is that still your view? What is the rationale for that not being on the face of the bill?

Humza Yousaf

It is important that we have an ethics advisory group, and I accept the IAG’s recommendation that such a group should be established. I made a public commitment to do that, and my officials are scoping the remit and membership of the group. My expectation is that the ethics advisory group will be established at around the same time that the new biometrics commissioner role is established.

I never envisaged that the group would have a statutory footing—nor, as far as I recollect, did the IAG. I would need to be persuaded on that point. The remit of the group is very much still under consideration and my officials are in touch with the counterpart group in England and Wales, the biometrics and forensics ethics group, to help to inform the remit of the group and what its membership should be. Some members of the IAG have volunteered to assist with the scoping of that, and I would welcome their views on how we should progress.

It is absolutely still our aim to have an ethics advisory group, and I think that it will come into force at around the time that the new commissioner role is established.

Fulton MacGregor

I know that you are still looking at the group’s remit, but is it your intention that it will be independent of Government? Do you think that it will be established as a permanent adviser to the commissioner?

Humza Yousaf

The group will not be established by statute, but some might argue that its having a statutory footing would give it a level of permanency. However, as well as the ethics advisory group, we will have the group that will look at emerging future technologies, and both those groups must have a degree of flexibility. Again, I will look at the committee’s recommendations in that regard.

I accept that the ethics advisory group should be independent. I am sure that my officials will correct me if I am wrong, but I think that the group in England and Wales is made up largely of academics. My initial view is that I would want membership of the group here to be broader than that. That is no slight on academics—there will probably be a number of academics on the new group—but I do not think that its membership should be made up largely of academics; we will probably want other practitioners and stakeholders to be part of the group as well. However, the group should be independent, and I expect that it will be a very helpful source of advice for the commissioner.

Fulton MacGregor

You touched on the membership of the proposed group. Have you had any early thoughts on what stakeholders, in addition to academics, might be members of the group?

Humza Yousaf

I do not want to pre-empt the process by making any suggestions about that. The similar body in England and Wales is made up largely of academics, but I think that we would want to have a better or wider mix and greater diversity in terms of the people, professions and expertise that input into the group here.

Rona Mackay (Strathkelvin and Bearsden) (SNP)

The bill’s ethos is to maintain public confidence in the commissioner’s independence, and he or she will be appointed by, and responsible to, the Parliament. However, the Scottish ministers will have final approval of the code of practice. Can you explain why that approach was taken? Should the code of practice be laid before Parliament for scrutiny and debate?

Humza Yousaf

The member is right that the code of practice must be approved by the Scottish ministers. The reason for that is largely to ensure that there is alignment with affordability and policy coherence, which are important considerations for us. Clearly, if a code of practice was developed that was unaffordable and went in a direction that we would view as regressive rather than progressive, against our policy alignment, we would want to be able to influence that.

In terms of parliamentary scrutiny—I might have referred to this in an earlier answer—we must lodge in the Parliament an affirmative instrument that sets the day on which the code will come into effect, and we must lay the code on the same day. Therefore, I suspect that there will be rigorous parliamentary scrutiny of the code.

Rona Mackay

If, for whatever reason, ministers do not approve a draft code of practice, they must provide the commissioner with reasons for not doing so. Would those reasons be made public? What would happen if a draft code was not approved? Would it simply be revised until ministers approved it?

Humza Yousaf

There is no explicit mention in the bill of making those reasons public. We are talking about biometric data, so an element of discretion might sometimes be needed. However, the Government always tries to be open minded and as transparent as possible, so we will keep an open mind about making those reasons public. There might be good reasons for our rejecting a draft code, but there would be strong pressure from parliamentarians to understand why the Government had done that. We would therefore have to explain that in public in some way, shape or form. There would perhaps have to be appropriate caveats around certain things, but I think that we should look to make those reasons public in almost every instance.

Liam Kerr (North East Scotland) (Con)

Sticking with the issue of the code of practice, before submitting a draft code for approval, the commissioner is required to consult stakeholders. Can you confirm whether that category includes the public? Will the consultation be about what should ultimately go in the code? If not, do you envisage the commissioner drafting the code and then consulting on that draft?

Humza Yousaf

Those are good questions. We are trying to give the commissioner as much independence as possible to develop the code as he or she sees fit. Section 8 enables the commissioner to consult a list of prescribed stakeholders, but it also has a catch-all provision on consulting any other relevant stakeholders. The commissioner will be independent, and he or she will be appointed by Parliament. I would not want to push them into a particular position, but I think that consulting the public will be a hugely important part of that exercise.

You asked whether the consultation should take place before or after the code is drafted. We have to respect the independence of the commissioner, who, as I said, will be appointed by Parliament, but I have always found that consultation before we introduce a piece of legislation or guidelines—which is what the Government often does—is the better way to go, as opposed to trying to bolt things on at the end. I suggest that consultation before the code of practice is drafted would be a better way to do it, but ultimately I have to take a step back and allow the independent commissioner to do as he or she sees fit.

Liam Kerr

If we start from the position that biometrics are evolving fairly rapidly and, as you said, the commissioner’s responsibilities could extend over time, do you have a view on whether a single code of practice will ultimately be the best way forward, or is there scope—would it be possible and, indeed, advantageous—for there to be more than one code of practice?

Humza Yousaf

I take your point. There could be numerous codes of practice, depending on the technology. It would make the most sense, where possible and pragmatic, for the stakeholders involved—Police Scotland and the SPA—to have one code of practice to refer to and have regard to. That is why it is important that it is a code of practice: if we had provisions in the bill, changing the code of practice would be difficult. I envisage one code of practice that has the flexibility to evolve, given emerging technologies. However, the commissioner could decide that the code needs subsections, or that there needs to be more than one code, in which case those things should be considered.

The Convener

Given the legal and ethical issues surrounding the collection of biometric data, do you expect the code of practice to definitively outline specific data protection considerations in terms of human rights that must be taken into account?

Humza Yousaf

The short answer is that I absolutely have that expectation. Pretty much the primary reason for bringing forward the IAG and then the bill, and eventually the Scottish biometrics commissioner and the code of practice, is because of human rights and ethical considerations. If those were not a consistent golden thread throughout the code of practice, I would have severe concerns. I go back to my point about why Scottish ministers should approve the code—and I suspect that this is where Parliament’s consideration will be when it comes to approve it under the affirmative procedure. If, for whatever reason, the code of practice was regressive in terms of human rights, you would want to have a say in that.

The Convener

Thank you.

Rona Mackay

You touched on this in your exchange with John Finnie. You will be aware that the committee has received evidence that there are potential legal issues around biometric data that is collected in Scotland but stored in UK national databases. How do you envisage the Scottish commissioner having oversight over biometric data that is collected in Scotland but stored outwith Scotland? Who will have legal responsibility for that?

Humza Yousaf

The bill does not give the Scottish biometrics commissioner direct access to UK databases, but where Police Scotland or the SPA choose to store that biometric data will be a matter that falls within the oversight functions of the commissioner under the bill. The fact that biometric data is being stored in UK databases could be the subject of reports and recommendations by the commissioner, which could inform further consideration of the matter.

Rona Mackay

Can you clarify that whether it is the UK or the Scottish commissioner is up for negotiation?

Humza Yousaf

The biometrics commissioner does not have direct access to UK databases, but where Police Scotland or the SPA chooses to store that biometric data will absolutely be under the oversight function of the commissioner, so there should not be an issue around where that data is stored. Again, I look to my officials for clarification: there are nodding heads, which is generally a good sign.

The Convener

That concludes our questioning. I thank you, cabinet secretary, and your officials for attending today.

11:14 Meeting suspended.  



11:15 On resuming—  



Video Thumbnail Preview PNG

25 June 2019

Video Thumbnail Preview PNG

24 September 2019

Video Thumbnail Preview PNG

12 November 2019

What is secondary legislation?

Secondary legislation is sometimes called 'subordinate' or 'delegated' legislation. It can be used to:

  • bring a section or sections of a law that’s already been passed, into force
  • give details of how a law will be applied
  • make changes to the law without a new Act having to be passed

An Act is a Bill that’s been approved by Parliament and given Royal Assent (formally approved).

Justice Committee Committee's Stage 1 report 

This report was published on 9 December 2019.

Find out what else the Justice Committee is doing.

Delegated Powers and Law Reform committee

This committee looks at the powers of this Bill to allow the Scottish Government or others to create 'secondary legislation' or regulations.

Read the Stage 1 report by the Delegated Powers and Law Reform committee published on 3 October 2019.

Find out what else the Delegated Powers and Law Reform Committee is doing.

MSPs agreed that this Bill could continue

Stage 2 - Changes to detail 

MSPs can propose changes to the Bill. The changes are considered and then voted on by the committee.

Changes to the Bill

MSPs can propose changes to a Bill  these are called 'amendments'. The changes are considered then voted on by the lead committee.

The lists of proposed changes are known as a 'marshalled list'. There's a separate list for each week that the committee is looking at proposed changes.

The 'groupings' document groups amendments together based on their subject matter. It shows the order in which the amendments will be debated by the committee and in the Chamber. This is to avoid repetition in the debates.

How is it decided whether the changes go into the Bill?

When MSPs want to make a change to a Bill, they propose an 'amendment'. This sets out the changes they want to make to a specific part of the Bill.

The group of MSPs that is examining the Bill (lead committee) votes on whether it thinks each amendment should be accepted or not.

Depending on the number of amendments, this can be done during one or more meetings.

First meeting on amendments

Documents with the amendments that will be considered at the meeting on 4 February 2020:

Video Thumbnail Preview PNG

First meeting on amendments transcript

The Convener

Item 2 is consideration of the Scottish Biometrics Commissioner Bill at stage 2. I ask members to refer to their copy of the bill, the marshalled list of amendments and the groupings of amendments, and I welcome Humza Yousaf, Cabinet Secretary for Justice, and his officials. We will be joined by Gordon Lindhurst later, for consideration of amendments that he has lodged.

Section 1 agreed to.

Schedule 1—The office of Scottish Biometrics Commissioner

The Convener

Amendment 14, in the name of the cabinet secretary, is grouped with amendments 15 and 17.

Humza Yousaf (Cabinet Secretary for Justice)

Good morning. Amendments 14, 15 and 17 will make minor and technical changes to the bill. Schedule 1 makes detailed provision on matters such as the appointment, status, terms of office and remuneration of the commissioner. Paragraphs 7(1) and 7(3) provide for the parliamentary corporation to pay or make arrangements to pay the commissioner such remuneration, allowances, pensions and gratuities

“as the Parliamentary corporation determines.”

The parliamentary corporation will have discretion over the amounts that are to be set. Amendments 14 and 15 simply clarify that it will also have discretion as to whether anything is paid at all, in case there is any question about whether it can determine to set an amount at zero.

It will therefore be for the parliamentary corporation to decide whether payments are made and, if payments are made, at what level. That will provide maximum flexibility for the parliamentary corporation to determine matters as it sees fit.

Amendment 17 will simply fix a typographical error in section 2(4)(a).

I move amendment 14.

The Convener

As members do not have any questions or comments for the cabinet secretary, he does not need to wind up.

Amendment 14 agreed to.

Amendment 15 moved—[Humza Yousaf]—and agreed to.

Schedule 1, as amended, agreed to.

Section 2—Functions

The Convener

Amendment 16, in the name of the cabinet secretary, is grouped with amendments 3, 18, 24 and 7.

Humza Yousaf

Amendment 16 adds the Police Investigations and Review Commissioner to the list of persons who are subject to the oversight of a Scottish biometrics commissioner. In line with that, amendment 24 makes a change to section 7(1) to include the PIRC as a person who is subject to the code of practice.

Amendment 18 adds the Commissioner for the Retention and Use of Biometric Material to the list of bodies that the Scottish biometrics commissioner can work with jointly, assist or consult. The committee asked me to do that in its stage 1 report, and I am happy to oblige. The Commissioner for the Retention and Use of Biometric Material has the functions of keeping under review national security determinations that are made by the chief constable of Police Scotland and the retention and use of biometric material by the police for terrorism investigations and national security purposes.

Amendment 18 reflects the importance of the Scottish and United Kingdom biometrics commissioners co-ordinating their activities when carrying out their roles in Scotland by explicitly mentioning the Commissioner for the Retention and Use of Biometric Material in section 3.

Amendments 3 and 7, in the name of James Kelly, seek to include local authorities, health boards, the Scottish Prison Service and external contractors that provide biometric services as bodies that fall within the oversight of the commissioner and which are subject to the commissioner’s code of practice.

I recognise that members are keen to provide the public with the fullest protection against the mishandling of biometric data in a criminal justice and policing context. We all want that. However, as I have said previously, the existing provisions in the bill already go some way towards covering the activity of other bodies. The commissioner’s oversight function would allow the commissioner to review and report on the activities of public and private sector bodies that provide biometric data services to the police, the Scottish Police Authority or the PIRC. Furthermore, the code of practice could require any contracts that those bodies enter into with third parties to be compliant with the terms of the code.

I will consider consulting on including further persons or bodies in respect of their criminal justice or policing functions in due course. However, I will do that only once sufficient time has passed to allow the current oversight provisions to bed in. That would be in line with what the committee recommended. It would be premature to add all those other bodies now, when the commissioner’s office is just getting up and running.

For the avoidance of doubt, if James Kelly’s amendments were agreed to, the expansion in scope that they propose would be no small undertaking, and would have a substantial associated cost. There are 14 regional health boards; the Scottish Prison Service has 15 prisons that, together, hold more than 8,000 prisoners; and there are—as we all know—a total of 32 local authorities. There has been no consultation—none whatsoever—with the Convention of Scottish Local Authorities, the health boards or the Prison Service on the proposal.

In addition, as things stand, the commissioner’s role is due to be 0.6 full-time equivalent. The expansion would require the role to be full time, as well as—undoubtedly—requiring the employment of additional staff. Again, that would all come at huge cost, and without any consultation.

I urge members not to be rushed into expanding the scope of the commissioner’s oversight at this time; instead, they should allow time for proper reflection, discussion, consultation and analysis of the cost with the bodies that would be affected.

I move amendment 16.

James Kelly (Glasgow) (Lab)

Amendment 3 seeks to extend the remit of the commissioner to public bodies, including local authorities, health boards, ministers—in respect of the Scottish Prison Service—and contractors that provide services to those groups. Amendment 7 is a logical follow-on, in that it seeks to extend the remit of the code to cover the bodies that are listed in amendment 3.

I will move my amendments for three reasons: the extension is logical; it is important for public confidence; and it is also important for futureproofing. I welcome the extension that the cabinet secretary has made beyond the original drafting in the bill, but it does not go far enough; it leaves a gap in the provision in relation to health boards, local authorities, the Scottish Prison Service and contractors working with those bodies. There are huge issues around the collection and use of biometric data, and if we are setting up a biometrics commissioner, it is important that they have appropriate scope to cover all those bodies. My approach is supported by the Open Rights Group and Amnesty.

My second reason for moving my amendments is that I believe that the approach is important for public confidence. If we are going to establish a biometrics commissioner, their work should have proper reach. If there are gaps, the public will question why those gaps are not being covered.

Finally, on futureproofing, the committee heard that technology is moving very quickly in this area. It is therefore important that we cover all those bodies because developments in technology and other such issues will come up in future. It is important to get the scope and reach of the commissioner right at this stage.

John Finnie (Highlands and Islands) (Green)

I support the cabinet secretary’s move to include the PIRC in the provisions of the bill. I have spoken previously about the policing function and how it is not exercised exclusively by Police Scotland, so the move is appropriate.

I also support James Kelly’s amendments 3 and 7, for the reasons that he articulated. His amendments are supported by the Open Rights Group and Amnesty. I refer members to my entry in the register of members’ interests, as I am a member of Amnesty.

Public confidence is important, but the committee repeatedly heard calls for a public debate on the issue. I hear what the cabinet secretary says about consultation, but the independent advisory group has referred to that issue.

We have the opportunity to ensure that we futureproof the bill, so I will support the cabinet secretary’s amendments and those in the name of James Kelly.

Liam Kerr (North East Scotland) (Con)

There is merit in the cabinet secretary’s amendment 16, but I remain somewhat concerned about Mr Kelly’s amendments 3 and 7. Mr Kelly talked about the extension being logical and about public confidence, but I am not sure that that makes it practical. The cabinet secretary was right to highlight the possible costs, and I would like to understand a bit more about that.

Throughout its evidence taking, the committee was also concerned about whether the new commissioner would have sufficient capacity, given the part-time nature of the post and the amount of funding available. If, through amendments, we add in significant extra responsibilities, is there not a risk that we inadvertently overburden the commissioner before we have even discovered whether they have capacity for what was originally included, plus the PIRC?

Fulton MacGregor (Coatbridge and Chryston) (SNP)

I do not necessarily disagree with the premise in amendments 3 and 7, but I feel that they have come out of the blue, unlike the cabinet secretary’s amendment 18, as what it proposes was referred to in the stage 1 report. Amendments 3 and 7 were lodged without any consultation, as has already been said, and I do not feel that we took enough evidence—or any, in some respects—during stage 1 about the issues. We really need to hear the views of the national health service, COSLA and the SPS, among others, on amendments 3 and 7. At this point in time, I cannot support them. They have come a wee bit out of the blue.

11:15  



Rona Mackay (Strathkelvin and Bearsden) (SNP)

I will oppose amendments 3 and 7 on fairly clear grounds, the main one being cost. On the capacity issue that Liam Kerr mentioned, the scope of the role will become far too wide for a part-time commissioner at the start of his post. Our stage 1 report did not recommend adding the extra bodies right now, and the Government has indicated that it may be appropriate to extend the remit in future. Adding them at this stage would be the wrong thing to do, and I will oppose it.

Liam McArthur (Orkney Islands) (LD)

I thank James Kelly for lodging the amendments.

It is right to say that, at stage 1, the committee did not take a firm view on such an extension. However, the purpose of stage 2 is to probe. James Kelly’s points about public expectation, public confidence and futureproofing are right.

If the extension is a bridge too far at this time—and I rather suspect that it is, for reasons that others have articulated—we should at least paint a pathway to the point at which the use of biometrics technology in the areas in question, and potentially others, is achieved. The public would expect us to do that.

Although I am not minded to support amendments 3 and 7 in their current form, they serve a useful purpose in aiding us to move towards where we need to be.

I welcome the cabinet secretary’s extension to the bill to cover the PIRC, as he committed to doing during the stage 1 debate.

Shona Robison (Dundee City East) (SNP)

I oppose James Kelly’s amendments on the very straightforward basis that the evidence that the committee took at stage 1 is not sufficient to support the proposed extension at this stage. There was a lot of discussion of the evidence, and we landed on a phased approach as the best way forward. That has been acknowledged by the cabinet secretary; it might be helpful for him in his summing-up to say a little more about that phased approach.

The Convener

I welcome the inclusion of the PIRC in the commissioner’s oversight.

There has been a good discussion of the issue. The committee should look at futureproofing and whether there are any gaps, but, equally, there are huge implications about how the extension would work in practice, so I tend to agree with Liam McArthur: it is absolutely right to discuss the issue and put it firmly within the cabinet secretary’s sights at this stage. If the proposal is not agreed to, perhaps we should consider how we could look at it at stage 3.

James Kelly

I will address a couple of points.

I do not agree with Fulton MacGregor’s comment that the amendments have come out of the blue. The point was made clearly by the Open Rights group and by Amnesty in their submissions to the committee and ahead of the stage 1 debate. It was also covered in the stage 1 debate; I specifically mentioned it, as did John Finnie.

I acknowledge that there would be additional costs. However, as was said throughout stage 1, we are asking the commissioner to undertake a serious role. We are at stage 2. If the amendments are agreed to, there will be an opportunity at stage 3 to take account of them and to upgrade the commissioner’s role.

Ultimately, capturing data, getting the approach right and ensuring that human rights are observed are serious issues. Therefore, it is right that the scope of the commissioner’s role should be widened and that any consequential costs should be met.

Humza Yousaf

I very much associate myself with the remarks made by Liam McArthur, Liam Kerr, Fulton MacGregor and the convener. It was helpful for James Kelly to lodge the amendments, so that the point could be debated and discussed. I know that his doing so was well intentioned and that the amendments reflect concerns that have been raised by important external stakeholder groups.

However, I will go back to my central point, and will try to give some reassurances. The need to futureproof the bill has been mentioned. It is because of the need to do so that the bill contains a power to amend the legislation to include other bodies. If it was thought that more bodies should be added to the list, that could be done in a phased way. The power to extend the list of bodies already exists.

I want to reassure James Kelly on one particular point that he raised. Section 2(3)(a) instructs the commissioner to

“keep under review ... the acquisition, retention, use and destruction of biometric data by”—

this is the important part—

“or on behalf of the persons”

named in the bill. That means that, if the police are using medical professionals to collect biometric data, the commissioner will examine what those medical professionals do.

The commissioner has a defined and set role, and there is a phasing-in period. If Parliament and others think that the list should be amended to include other bodies, that can be done under the legislation. However, it would be wrong to do that in relation to substantial bodies without any consultation or costings.

Again, I thank James Kelly for lodging his amendments, which have allowed for a good debate.

Amendment 16 agreed to.

Amendment 3 moved—[James Kelly].

The Convener

The question is, that amendment 3 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Kerr, Liam (North East Scotland) (Con)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is For 2, Against 7, Abstentions 0.

Amendment 3 disagreed to.

The Convener

Amendment 4, in the name of John Finnie, is grouped with amendments 13 and 30.

John Finnie

Amendment 4 is about the role that the commissioner could play in keeping technologies under review. We heard a lot of evidence about the efficiency of the equipment that has been used and the atrocious success rates—2 per cent, which is ridiculously low when we are talking about people’s human rights and the importance of community safety. If we want to have effective equipment, if it is ever deployed, it is important that the commissioner should have some oversight role in relation to the technology that is used in the acquisition, retention, use and destruction of biometric data. I hope that members will support my modest proposal.

I move amendment 4.

Liam McArthur

I support John Finnie’s amendments, for the reasons that he has set out.

Under section 2, the commissioner will monitor the extent to which the relevant bodies comply with the code of practice. Amendment 30 provides that if, in the course of monitoring the code, the commissioner finds that it is being disregarded, that information must be made public.

Colleagues will recall lengthy discussions during stage 1 about whether the enforcement powers in the bill go far enough. Many, including the Scottish Human Rights Commission and the Open Rights Group Scotland, concluded that they did not. The Government has always maintained that the bill’s strength is to be found in the persuasive powers of naming and shaming or, at least, the threat of that. In that regard, the cabinet secretary said that the power of reputational damage should not be underestimated. Of course, that view is shared by the current UK commissioner. However, I am concerned that, if the commissioner is not required to make breaches of the code public, the risk of reputational damage is one that many people might be prepared to take.

I appreciate that there might need to be a degree of latitude around minor breaches that are quickly rectified once they are identified. However, if the public are to have confidence in the new powers, transparency is key. In that context, amendment 30 is a sensible step in the right direction, and I hope that the committee and, indeed, the Government, will support it.

Humza Yousaf

I do not consider amendment 4 to be necessary. The commissioner’s review duty under section 2(3)(a) already implicitly includes the function of keeping under review the methods or technologies used to

“acquire, retain, use and destroy”

biometric data. That is because the phrasing is such that what must be reviewed is

“the law, policy and practice relating to the acquisition, retention, use and destruction of biometric data”.

The technologies that are used would relate—very much—to that data.

Furthermore, if amendment 4 is agreed to, it could cast doubt on whether the commissioner’s function as set out in section 2(3)(b) includes the function to promote public awareness and understanding of the power and duties of the police and the SPA in relation to the use of biometric technologies, given that no similar reference to biometric technologies would be added to the provision. I ask John Finnie not to press amendment 4. If the committee wishes to see an express reference to technologies, I would be happy to work with the member on a suitable amendment ahead of stage 3.

Amendment 13 would require persons mentioned in section 2(1) to comply with the commissioner’s recommendations regarding biometric technologies. It would be entirely acceptable to require a person to indicate what steps they were taking in respect of a recommendation by the commissioner and to make those steps known to the Scottish ministers and Parliament. However, I have concerns about the way in which proposed section 15(3C) would require those specified in section 2(1) not to use a technology if the commissioner recommended that it should not be used.

There are several difficulties. First, it would not be acceptable that a recommendation by the commissioner on the use of a certain kind of technology should be binding to the extent that it impinged on the operational independence of the police, given that the SPA and Her Majesty’s Inspectorate of Constabulary in Scotland do not have similar powers. Secondly, such things would not be recommendations at all: proposed section 15(3C) would, in effect, allow the commissioner to make the law on the use of biometric technologies without there being any consultation or approval mechanism in place. I consider that that would subvert the role of Parliament.

Thirdly, the law must be accessible. If the commissioner’s recommendations were in effect to be law, a person would have to trawl through the commissioner’s reports and code of practice as well as the substantive law to find out what technologies they were allowed to use. That would mean that the rules on technologies would not be as accessible as they should be.

Finally, there would be no mechanism in the bill for the recommendations—in effect, prohibitions—to be amended or revoked by the commissioner at a later date.

For those reasons, I ask John Finnie not to move amendment 13.

Amendment 30, in the name of Liam McArthur, to some extent duplicates section 15(1)(a), which provides that the commissioner may prepare and publish reports about whether persons who are required

“to have regard to the code of practice have done or are doing so”.

Amendment 30 makes it compulsory to publish reports about failures to have regard to the code.

As is clear from the bill’s accompanying documents and stage 1, it is anticipated that reporting will be a key aspect of the commissioner’s role. Therefore, I do not consider amendment 30 to be necessary. In addition, the way in which it inserts that duty is slightly confusing, because it does not alter the commission’s discretion to issue reports under section 15. That would mean that, in one sentence, we are saying that the commissioner “must” issue reports on failings but, in the next, that the commissioner “may” issue reports. Therefore, I ask Liam McArthur not to move amendment 30. However, if he is not reassured by my comments and still wishes to make that element of reporting mandatory, I would be happy to work with him to agree a suitable amendment ahead of stage 3.

John Finnie

It was remiss of me not to refer earlier to amendment 30 in the name of my colleague Liam McArthur. I lend support to amendment 30 for the reasons that he outlined.

I do not recognise the cabinet secretary’s characterisation of the intention behind amendment 4. When it comes to something that could impact on citizens’ human rights and have such a level of collateral intrusion, I have no concern about someone having to “trawl through” various information to come up with the appropriate answer. We know from the various information technology projects that it is hugely important to get things right. We do not want to find ourselves in the situation that we were in with the cyberkiosks, where the equipment has already been bought so we have to go along with it because of the expenditure that has already been made. There are several issues around that.

I am happy to engage with the Scottish Government on that point to come up with an amendment that would meet the intention and what we all want to see, which is that quality equipment is correctly deployed. I will not press amendment 4.

11:30  



Amendment 4, by agreement, withdrawn.

Amendment 17 moved—[Humza Yousaf]—and agreed to.

Section 2, as amended, agreed to.

Section 3—Power to work with others

Amendment 18 moved—[Humza Yousaf]—and agreed to.

Section 3, as amended, agreed to.

Sections 4 and 5 agreed to.

After section 5

The Convener

Amendment 5, in my name, is in a group on its own.

In its stage 1 report, the Justice Committee recommended

“that the Scottish Government includes a complaint mechanism within the Bill, to enable the public to refer issues to the Scottish Biometrics Commissioner on the use of biometrics by Police Scotland and the SPA, or on their lack of compliance with the Code of Practice.”

That follows many witnesses, including Matthew Rice from the Open Rights Group, expressing concern that, despite it being one of the key functions of the commissioner to promote public awareness and understanding of the duties and responsibilities of those who acquire, retain, use and delete biometric data, there is no corresponding complaints mechanism whereby a member of the public could raise such concerns with the commissioner.

In his evidence, Detective Chief Superintendent Scott from Police Scotland acknowledged the importance of the public having the right to complain, and Tom Nelson from the SPA said that he thought that the commissioner would want to hear from the public and understand where their concerns were coming from; he also believed that the ability to engage with and speak to the public would allow the commissioner to provide assurance to the public and would ensure that the public and the commissioner could identify any challenges.

Amendment 5 seeks to ensure that the bill provides a complaints mechanism that affords individuals, or someone who acts on their behalf, the right to complain directly to the biometrics commissioner about the acquisition, retention, use or destruction of their data by or on behalf of Police Scotland or the Scottish Police Authority.

Furthermore, amendment 5 also takes cognisance of the concerns that were expressed by the cabinet secretary about the risk of duplicating the role of the UK Information Commissioner if the Scottish biometrics commissioner had a similar function of looking at complaints about the use of biometric data, which can be personal data, which is a reserved matter. The cabinet secretary considered that the relationship between the UK Information Commissioner and the biometrics commissioner should be addressed and said that he was supportive of the Justice Committee’s recommendation that there be a memorandum of understanding between the two commissioners to avoid potential confusion about the two roles and to protect the independence of both offices.

Amendment 5 addresses both those concerns by providing that the biometrics commissioner must consult the Scottish Public Services Ombudsman, Police Scotland and the SPA, as well as any persons or groups that the commissioner considers appropriate, on the commissioner’s proposals for a complaints procedure. The commissioner must keep that procedure under review and must vary it

“whenever, after such consultation, the Commissioner considers it appropriate to do so.”

Late last night, I received a letter on amendment 5 from the UK Information Commissioner’s Office; it was distributed to the committee first thing this morning, and the cabinet secretary’s officials have a copy. It helpfully points out that amendment 5 contains an error—the “Information Commissioner Act 2000”, to which it refers, does not exist. That can easily be rectified at stage 3. In the meantime, the error should not prohibit the passing of amendment 5 today, if the committee is so minded.

Helpfully, the UK ICO confirms that complaints about the way in which the personal data relating to an identified or identifiable person is handled should be referred to the UK ICO. However, biometric data relating to an identified or identifiable person is deemed to be special category data and subject to additional safeguards. If, therefore, the complaints process is confined to compliance with the code of practice, the UK Information Commissioner says that that should be clearly stated in the bill to avoid any ambiguity. The complaints process as laid out in amendment 5 is confined to compliance with the code of practice.

Finally, the cabinet secretary stresses that, in his view, the biometrics commissioner

“should concentrate on ... systemic issues in the criminal justice and policing context”,

with its

“oversight driven by a systematic review of Police Scotland and the SPA’s activities as these relate specifically to biometric data”,

rather than the resolution of individual complaints. However, that fails to recognise that it is only by being aware of and involved in resolving instances in which things have gone wrong that systemic improvements can be made and robust systemic oversight achieved. More than that, quite simply, as the Justice Committee and many others have pointed out, there is a risk to public confidence and transparency if a complaints mechanism is not included in the bill.

I move amendment 5.

John Finnie

Convener, you are aware that, had you not lodged amendment 5, I would have done so. I am therefore happy to lend it my support.

The public would imagine it to be passing strange if there was a public body that did not have a complaints mechanism attached to it. That is a fundamental principle for how the public should engage with public officials. I am very supportive of the proposal.

Rona Mackay

I am not going to support amendment 5. It is unnecessary. The public are already free to make complaints to the commissioner, so I do not think that we need another piece of law to give them permission to complain.

Amendment 5 technically only requires the commissioner to establish a procedure for people to make complaints but it does not require the commissioner to do anything with them. Such a requirement should not be in the bill, and the legislation should not oblige the commissioner to deal with complaints; the mechanism for people going to the commissioner with complaints already exists.

Fulton MacGregor

I agree with my colleague Rona Mackay. Also, I know, convener, that you have taken head-on the fact that the amendment is technically wrong, but it is significant that the UK ICO has taken the time to write to us. I do not think that we fully understand what the consequences of amendment 5 might be. I therefore agree with Rona Mackay and will not support the amendment today, but I politely suggest that speaking to the Government ahead of stage 3 and getting a factually correct amendment on the table might be the best way forward.

James Kelly

I welcome amendment 5. It deals with the issues that were raised in the committee’s stage 1 report. John Finnie made the point about public confidence and how the public might think that it is strange if there were no complaints mechanism in place for the work that the biometrics commissioner is undertaking. I support amendment 5.

Humza Yousaf

I have serious reservations about amendment 5. Let me make a couple of points about it.

Convener, you referred to the letter that came in late last night from the Information Commissioner’s Office—I thank the parliamentary clerks for giving us sight of the letter as we were on our way in. As you said, it refers to the inaccurate reference to the 2000 act. However, the Information Commissioner’s Office’s more substantial point is this:

“I would bring the Committee’s attention to the evidence which I gave during its Stage 1 deliberations where I made reference to the role of the UK Information Commissioner’s Office regarding complaints about the way in which individuals’ personal information is handled. Any complaints about the way in which such data are handled should be referred to the ICO. This separation of locus has worked well south of the border where a Biometrics Commissioner has been in post since 2016.”

In addition, convener, you said that the scope of amendment 5 is confined to the code of practice, as the ICO would wish it to be, but I do not think that that is the case; nowhere in amendment 5 do the words “code of practice” appear.

Moreover, amendment 5 is not necessary. Individuals will be free to make complaints to the commissioner at any time. They do not need the law to give them permission to complain.

The bill does not oblige the commissioner to investigate complaints or set up a process to deal with them. However, if someone were to draw the commissioner’s attention to a relevant and important issue, by way of a complaint, the commissioner could use their powers to look into the matter, for example by requiring a body to produce information. That could lead to the publication of reports and recommendations or to the issuing of a compliance notice.

The commissioner’s function of dealing with complaints about the processing of biometric data, which can include personal data, closely parallels the functions of the Information Commissioner’s Office. Amendment 5, as drafted, does not delimit the role of the biometrics commissioner and would allow the commissioner to deal with complaints about breaches of data protection law that should properly be dealt with by the ICO.

John Finnie

Do you accept that all members in their constituency business and lots of organisations have the facility to signpost individuals if it would not be appropriate to deal with a complaint themselves? I am trying to imagine a website for the commissioner that did not provide for a complaints mechanism. Every other public body has such a mechanism. You must acknowledge that not to have one is passing strange.

Humza Yousaf

People will be able to make a complaint about the commissioner himself or herself in the context of the role that they will fulfil. We should make that obvious.

On your point about signposting, I think that the recommendation of a memorandum of understanding between the ICO and the commissioner is the right way to go. I think that I made that point in the debate. In my capacity as a constituency MSP, I often signpost people. I share an office with the local MP and, if a matter comes to me that I cannot deal with—for example, if the Home Office will not engage with me on an immigration matter—I can signpost the constituent to the local MP. The system works perfectly well. There is, in effect, a verbal MOU between me and the local MP.

John Finnie

I do not want to sound facetious, but you will understand that the public do not go about wondering whether there are memoranda of understanding between different public bodies. The word “complaint” is readily understood, and a complaint should be responded to.

Humza Yousaf

I was trying to make the point that, just as a constituent should be free to come to any elected member on any issue, and that member might choose to refer the case to another body—I used the analogy of an immigration case that is referred to an MP, because the Home Office does not deal with MSPs regularly—nothing will stop a member of the public going to the biometrics commissioner to make a complaint and, perhaps through the proposed MOU, being signposted to the Information Commissioner’s Office.

Setting up a separate complaints mechanism for the biometrics commissioner would create confusion for the public. It would also cut across the clear remedy that already exists, which is that members of the public may make a complaint to the Information Commissioner’s Office in respect of the processing of personal data. I have concerns about our straying into reserved matters in that regard. In any event, it is better to maintain the delineation between the roles, whereby the ICO fully investigates complaints from the public and the new biometrics commissioner will undertake a monitoring role and make thematic reports.

To complement that, I reiterate that there is support for a memorandum of understanding to be drawn up between the biometrics commissioner and the ICO so that there would be a common understanding of their roles. That could be communicated to the public, but it would also be important for the internal purposes of the two commissioners. I understand that the ICO is very receptive to that idea.

11:45  



My final point is on a number of technical issues with amendment 5. We have already discussed its reference to a non-existent act. In addition, as it is drafted, the amendment requires the commissioner only to “establish a procedure” for people to make complaints but not to do anything with them. It also does not take account of the fact that the bodies that are listed in section 2 might change.

For all those reasons, I ask Margaret Mitchell not to press amendment 5.

The Convener

The technical error is a minor defect. It is not unusual for the Parliament to agree to an amendment at stage 2 and to pick up on technical errors at stage 3. It is the thrust of what we want to achieve that is so fundamentally important.

As for the code of practice not being mentioned specifically, the effect of amendment 5 would be to ensure that compliance with the code of practice would be achieved. As the ICO said, that should be stated in the bill.

I am somewhat surprised by members’ comments—especially Rona Mackay’s—on amendment 5. It was the committee’s unanimous recommendation that the Scottish Government should include in the bill provision for a complaints mechanism to enable the public to refer to the Scottish biometrics commissioner issues with the use of biometrics by Police Scotland and the SPA, or about their lack of compliance with the code of practice. For members to say at this stage that they are totally opposed to that I find puzzling. Behind its recommendation lay the committee’s concern that there would be risks to public confidence and to transparency if provision for a complaints mechanism were not included in the bill. That view was shared by the Law Society of Scotland, which agreed that a complaints mechanism should be included to enable the public to refer issues to the Scottish commissioner on the use of biometrics where there is a lack of compliance with the code of practice.

The cabinet secretary is absolutely right to say that systemic oversight should be robust—that is essential. The power to look at people’s personal biometric data is a very important one, and they should have the right to complain if they believe that there has been a breach of the code. That is what amendment 5 seeks to establish.

On that basis, I press amendment 5.

The question is, that amendment 5 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 5 agreed to.

The Convener

Amendment 19, in the name of Liam McArthur, is in a group on its own.

Liam McArthur

As we heard in relation to an earlier grouping, throughout stage 1 there was a lot of debate on whether the bill’s reach went far enough in setting out the commissioner’s remit. It was accepted that, although the use of biometrics in policing requires robust regulation, it is a technology whose reach already extends far more widely. We therefore need to ensure that the regulatory framework and oversight powers meet public expectations.

Given how long it has taken to bring the bill before the Parliament—my former colleague Alison McInnes raised concerns in this area in the previous parliamentary session—it is fair to say that we are still playing catch-up. I suppose that the question is whether we should opt for a phased approach, starting with Police Scotland and a limited range of other bodies that are involved in the delivery of policing in this country, or seek to empower the Scottish biometrics commissioner to take the broadest possible view of the use of such technology. We explored some of those issues in discussing that earlier grouping, and it is clear where the committee currently stands on them. However, given that both the pace of the technology and the ways in which it is being used are changing, it will always be a challenge to ensure that legislation on the subject remains fit for purpose.

Amendment 19 would establish a process for review, which would help to fine-tune the commissioner’s remit as it is currently proposed and leave open the door for expanding its scope in the future, as might be appropriate based on our experience of it in practice.

In their evidence, Amnesty International, the Open Rights Group and the Scottish Human Rights Commission raised their concerns about the proposed scope of the commissioner’s remit. As I said earlier, I have a great deal of sympathy with those concerns. At the same time, there are risks in overstretching the commissioner in the early stages. Establishing the commissioner’s role and function will take time, and it is crucial that the commissioner can demonstrate effectiveness in carrying out his or her duties.

I know from my correspondence with the cabinet secretary that he intends to keep the commissioner’s remit under review. Although I welcome that commitment, it is perhaps a little vague and vulnerable to not surviving his departure from his current role. In that sense, amendment 19 seeks to add a little bit more certainty around that intention.

I look forward to hearing comments from colleagues including the cabinet secretary.

I move amendment 19.

John Finnie

I support my colleague Liam McArthur’s amendment 19. An argument can be made that we can review anything at any time, but making that specific request of ministers will give the review an appropriate profile, given the speed with which technology changes and with which we might have to respond to some of the implications of the proliferation of public surveillance. I am very supportive of amendment 19.

Shona Robison

I have concerns about laying down a timeframe. It is one thing to have a commitment to post-legislative review, which is always good, but requiring that the commissioner’s powers and functions be reviewed

“3 years after the day of Royal Assent”

and at five-yearly intervals thereafter might get in the way of a natural timeframe for review. Why should we set those timeframes, which might not make sense when things are up and running? Those timeframes seem very fixed and inflexible. Would it not be better that, instead of fixed timeframes being set out, review would be based on what made sense at the time and be led by the commissioner’s view of what progress had been made?

Fulton MacGregor

I agree with that point. Although I see where Liam McArthur is coming from, I will not support amendment 19. We have included in the bill provisions for post-legislative scrutiny. I think that we sometimes try to predict what a future Parliament with different members will think about legislation or to mandate what it should do. I hear what John Finnie says about the other side of the argument and about it being our job to look at what might be needed in the future, but I come down on the other side of the argument, so I will not support amendment 19.

The Convener

It seems to me that amendment 19 would strengthen parliamentary scrutiny, which would be a very good thing. In my opinion, it does not seem unreasonable that, after 12 months, we should look at how this important but potentially intrusive legislation is working.

Humza Yousaf

I will stick to remarks on amendment 19 rather than comment on Liam McArthur’s prediction of my political demise.

Although I understand and have a great deal of sympathy with the reasons for his lodging amendment 19, I have some concerns, as Liam McArthur might understand. Those concerns have been articulated well by Shona Robison and Fulton MacGregor. I reiterate that a means of review already exists. Provisions for post-legislative scrutiny do not need to be hardwired into an act. The Parliament or the Government can conduct a review whenever it wishes and at a time that is most appropriate. That is surely preferable to a requirement to conduct a review at a time that is selected in advance and that might not work well because of the load of other things that might be going on at that pre-selected time.

The committee will be aware that the bill already provides for a lot of on-going accountability and reporting to Parliament through strategic plans, budgets, annual reports, other reports and recommendations, and so on. There will also be parliamentary approval of the code of practice and any revisions to it. All of those processes can be triggers for ministers or Parliament carrying out post-legislative scrutiny at any time. That would allow a review to be conducted when we know that there is an issue to be examined, instead of our being required to do it at a particular time even if everybody is content.

On reviewing the scope of the commissioner’s oversight, ministers have already taken powers allowing the list of bodies over which the commissioner has oversight to be added to by means of regulations. Ministers will therefore keep under review whether it is appropriate to exercise those powers.

What the amendment proposes is somewhat unusual compared to other examples of compulsory post-legislative scrutiny in that it would set up a recurring rather than a one-off duty. I question whether it is appropriate to commit time and resource to almost never-ending reviews when everyone might be content that the commissioner’s functions are working perfectly well. Those compulsory recurring reviews might end up draining away resources from other issues that the Parliament and Government agree ought to be a higher priority at the time.

Although post-legislative scrutiny is important and I believe that Liam McArthur’s amendment is well intentioned, I suggest that hardwiring scrutiny arrangements into the bill is unnecessary and unhelpful, so I ask him not to press amendment 19. As always, if he does so, I offer to work with Liam McArthur in advance of stage 3, if necessary.

Liam McArthur

I thank all members who have contributed to the debate for the spirit in which they have offered their remarks. In particular, I thank John Finnie and the convener for their express support for amendment 19. John Finnie suggested that it would raise the profile of something that one might expect to happen, but it is no less important or relevant for that.

I listened carefully to what Shona Robison and Fulton MacGregor suggested, and I understand the anxieties about what appears to be a rigid timeframe. That, in a sense, sets the minimum requirements—it would be a process in which the triggers would be up front and obvious. However, if circumstances were such that an additional review was required because of revelations that gave rise to public concern, nothing in amendment 19 would prevent that from happening.

The cabinet secretary rightly pointed out that it is open to the Government and, indeed, Parliament to carry out post-legislative scrutiny. We have had that power from the get-go, but it has been used in exceptional circumstances rather than routinely.

On the recurring nature of the duty, I understand the anxiety that we might get locked into a process that, over time, becomes less relevant. However, given the nature of the technology involved—we have all talked about the speed at which it is changing—it is unlikely that the need to keep the issue constantly under review will diminish in any way in the foreseeable future. Therefore, notwithstanding that the Government might want to work with me ahead of stage 3 to make further refinements, I am minded to press my amendment.

The Convener

The question is, that amendment 19 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 19 agreed to.

Section 6—Code of practice

The Convener

Amendment 20, in the name of the cabinet secretary, is grouped with amendments 35, 21 and 36.

Humza Yousaf

My amendment 20 is intended to make a clear link between the principle that is set out in the commissioner’s general functions under section 2(1) and the content of the code of practice. The committee asked me to do that in its stage 1 report, and I am happy to oblige.

The commissioner’s general function is

“to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes”.

Anything that the commissioner does, including preparing the code of practice, should be in furtherance of that general function. Amendment 20 therefore makes it clear that the commissioner must prepare a code that is designed

“to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data”.

Amendments 35 and 36 require the commissioner to have regard to specific principles when preparing or revising the code of practice, including the principles of promoting and protecting human rights, privacy and public confidence, as well as the principle of ensuring individual and community safety. I consider the amendments to provide a reasonable balance between specifying what the code should include and preserving the independence of the commissioner to decide what the code should cover.

12:00  



Although I do not think that amendments 35 and 36 are strictly necessary, I am happy to support their general principles if Liam Kerr wishes to proceed with them, despite the comfort that is already offered by amendment 20. I would, however, note some technical concerns, particularly about aspects of amendment 36. For example, the reference to revising a code in amendment 36 is confusing because there is already a default rule in section 6(5) that sets out which sections also apply to revised codes. It would therefore be clearer to apply the general rule to the new section that is proposed by Liam Kerr.

Some of the other language in the amendments will require further consideration. For example, the reference to the principle of ensuring the safety of individuals and communities could be considered to be problematic because that is not something that the commissioner can ensure, although they can recognise the importance of it.

I therefore ask Liam Kerr not to move amendments 35 and 36 at this time. If he wishes to proceed with them, I will be happy to work with him to agree suitable amendments to the technical aspects ahead of stage 3.

Amendment 21 requires the code of practice to include a presumption of destruction of biometric data three years after it was acquired. I fully recognise the member’s concerns that a clear direction should be given by the commissioner regarding retention periods. I do, however, have strong concerns about amendment 21.

If amendment 21 was supported, it would require a change in policy and procedure that is not entirely aligned with the law as set out under the Criminal Procedure (Scotland) Act 1995. A presumption of destruction of data after the expiry of three years, as is suggested in the amendment, does not fully take account of the provisions in the 1995 act, which, in some cases, allow biometric data to be retained for up to two years only. The 1995 act also allows retention periods to be extended by a sheriff in some cases, and it is not clear how the proposed presumption would fit with that power.

It should be noted that the police are already bound by the European Convention on Human Rights and data protection laws regarding retention periods for biometric data. I have previously committed to conducting a review of the retention periods that are set out in the 1995 act once the commissioner is in post. If retention periods are to be set, it would make more sense for the commissioner to consult on them and set them within the code of practice, given that the code will be subject to the consideration and approval of Parliament. That would mean that retention periods would benefit from the flexibility of being set out in the code, and Parliament would be able to approve retention periods when it approved the commencement of the code of practice. It would also mean that the period could be changed to reflect changing circumstances.

However, if amendment 21 was supported, the presumption could not be adjusted to opt for either a longer or a shorter period. Even if the code set rules about retention periods, it would have to be done in a way that was clear and did not appear to contradict existing law. I therefore ask Liam McArthur not to move amendment 21.

I move amendment 20.

The Convener

Liam McArthur will speak to amendment 21 and other amendments in the group—[Interruption.]

I am sorry; I have taken the Liams out of order. Liam Kerr will speak to amendment 35 and other amendments in the group.

Liam Kerr

I am happy to support amendment 20. I am glad that you brought me in first, convener, because I will be interested to hear Mr McArthur’s response to the cabinet secretary’s points on amendment 21.

Amendment 35 simply inserts a reference to the relevant section; that will be required if the committee is with me on amendment 36.

Amendment 36, which is the substantive point, picks up the committee’s recommendation at paragraph 206 of the stage 1 report, which says that

“the principles underpinning the Commissioner’s role and the purpose of the Code of Practice in promoting and protecting”

various items, and the

“principle of delivering community safety”

should be included in the bill. Amendment 36 simply seeks to codify those principles, to which the commissioner must have regard when preparing or revising a code.

I am grateful to the cabinet secretary for his comments. He said that the reference to revision is confusing and that further technical amendments will require consideration at some point. My preference is to move amendment 36, after which I would be pleased to work with the cabinet secretary to amend it to the optimum level at stage 3.

I would be pleased to have the committee’s support for amendments 35 and 36.

The Convener

Are there any questions? [Interruption.] Sorry—I seem to be determined to get Liam McArthur in first or to miss him out completely.

I invite Liam McArthur to speak to amendment 21 and other amendments in the group.

Liam McArthur

I did not realise that the earlier invitation was a once-only opportunity.

I welcome and am supportive in principle of the other amendments in the group, even though the cabinet secretary has expressed one or two misgivings with amendments 35 and 36 that will need to be addressed.

On amendment 21, I heard what the cabinet secretary said, which—to paraphrase—fell into the category of inconsistency and rigidity. Amendment 21 was lodged principally to align the rules around the retention of biometric data. At the moment there is a disparity between the regulation on DNA and fingerprints and that on photos that are held by the police: DNA and fingerprints are regulated under the 1995 act but, as the cabinet secretary acknowledged, photos are not.

The issue was recognised by my colleague Alison McInnes during the passage of the Criminal Justice (Scotland) Act 2016 five years ago. Since then, both HMICS and the independent advisory group have found governance gaps that are a concern. John Scott QC recommended in his review:

“There should be a presumption of deletion of biometric data after the expiry of prescribed minimum retention periods.”

Although Police Scotland has since updated its policy, there is still no legislative requirement for images to be deleted. In recent evidence to the Justice Sub-Committee on Policing, Temporary Assistant Chief Constable Duncan Sloan confirmed that the current rules around what the police can do with images of the public are “not so clear” as the rules around fingerprints and DNA and that new governance arrangements

“would be valued and welcomed.”—[Official Report, Justice Sub-Committee on Policing, 16 January 2020; c 5.]

Similarly, Detective Chief Superintendent Sean Scott of Police Scotland supported the IAG recommendation of

“a presumption of deletion of biometric data”

as the central part of the oversight system that was established by the 2016 act. He stated:

“one of the IAG’s nine recommendations was about the retention periods and a presumption of deletion, and that is absolutely right.”—[Official Report, Justice Committee, 29 October 2019; c 13.]

Research by the Scottish Liberal Democrats revealed at the weekend that more than 375,000 images have been supplied to the police national database from Police Scotland’s criminal history system since 2014, all with no clear legal requirement for their deletion should the individuals concerned be found to be innocent.

Facial recognition may be invaluable for modernising the way in which the police investigate crime but, unregulated, the system poses a potential threat to human rights and civil liberties and, as we have repeatedly heard from Police Scotland, to the reputation of our police.

Liam Kerr

Amendment 21 refers to a period of three years. Where does that figure come from?

Liam McArthur

The three years are required to bring governance arrangements on images in line with those for DNA and fingerprints and to deliver a degree of consistency across the retention periods for biometrics.

Shona Robison

Given that you referred in your opening remarks to an existing disparity, surely consultation on the issue would be required to get the retention periods right? Would it not be better for the commissioner to undertake such a consultation, rather than us deciding now that three years is the right answer? Such a decision would be based on current practice rather than on a consultation on what would be ideal, which would be based on evidence from the stakeholders who deal with the issues at the coalface.

Liam McArthur

I take the point about consistency. However, I do not think that we have heard any concerns about the current retention periods, so having consistency with them would not seem to be an unreasonable proposition. If, in due course, there is a belief that the retention periods are out of alignment with public expectations on the use of the technology, it will certainly be open to the commissioner to look at that. However, with the bill that we are considering, there is an opportunity to bring a degree of consistency to retention policy. As we have heard, not least from Police Scotland, that is desirable and it would be welcome as it would provide clarity.

The Convener

I am happy to support the cabinet secretary’s amendment 20.

The intent of Liam Kerr’s amendment 36 is quite clear. The wording could be improved—that could be looked at at stage 3—but if the committee is minded to agree to the amendment, there is no reason for it not to do so. Agreement to the amendment would send a clear message about the importance of human rights and so on being in the bill.

I turn to Liam McArthur’s amendment 21. If I understand him correctly, the retention period for DNA and fingerprint information is three years, but it might differ for other things. The important point is that there would be a presumption that the information would be destroyed after three years. If there is a good reason for information to be retained after that, that will be clear and the reason will be set out transparently. In relation to human rights and making sure that there are no abuses, that seems to be a sensible way to go.

I ask the cabinet secretary to wind up.

Humza Yousaf

I reiterate my offer to Liam Kerr in relation to amendments 35 and 36. My preference is for him not to move the amendments and to work with the Government on the matter before stage 3. However, if he moves them and the committee agrees to them, the offer will remain.

When Liam McArthur responded to Liam Kerr’s intervention, he said that what he proposes would create an alignment with DNA. However, in some cases—for example, in relation to road traffic offences—the retention period for DNA is two years and not three years, so there would not be an exact alignment under Liam McArthur’s amendment. Also, I do not think that he addressed the fact that in certain cases—this is particularly pertinent to sexual offences—a sheriff may choose to extend the retention period for the purpose of advancing justice.

Liam McArthur

Will the cabinet secretary take an intervention?

Humza Yousaf

Of course.

Liam McArthur

I think that the convener picked up on the point that we are talking about a presumption in relation to the retention periods. I do not think that there would be any expectation that that would override legitimate concerns where there was a sound case for retaining images, as happens with DNA and fingerprints.

Humza Yousaf

I take your point about it being a presumption and not a flat-out, explicit, fixed retention period. I suppose my concern about the proposal is that there is no doubt that the code of practice, without impinging on the independence of the commissioner, will look at things such as retention periods. That is why I believe that it is preferable to have the flexibility that will be afforded by a code of practice being introduced through regulations, as opposed to having something included in the bill.

Liam McArthur mentioned in his remarks on a previous amendment the fast-paced, quickly evolving nature of the technologies that we are discussing. None of us, probably, could predict what the data will look like in five, 10 or 15 years’ time, let alone what it will look like in 20 years’ time. The approach of having retention periods in the bill would create an inflexibility and rigidity that will not be created if they are in the code of practice. I reiterate my concerns about including retention periods in the bill, and I ask Liam McArthur not to move amendment 21.

Amendment 20 agreed to.

Amendment 35 moved—[Liam Kerr].

The Convener

The question is, that amendment 35 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 35 agreed to.

12:15  



Amendment 21 moved—[Liam McArthur].

The Convener

The question is, that amendment 21 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 21 agreed to.

The Convener

Amendment 22, in the name of the cabinet secretary, is grouped with amendments 23 and 25 to 29.

Humza Yousaf

Taken together, the amendments in this group seek to provide enhanced arrangements for Parliament to scrutinise the first code of practice that the commissioner produces. To accommodate the new step in the process, it has been necessary to restructure section 6 and to amend sections 8 and 9 but, ultimately, this set of amendments responds positively to a recommendation that the committee made in its stage 1 report, which sought more time for Parliament to scrutinise the content of the first code of practice and a process that would allow it to do so separately from its scrutiny of the regulations to bring the code into effect.

Amendment 26, which is the principal amendment in the group, seeks to insert a new section that provides for a further process on the first code of practice. Having gained ministers’ approval for a draft of the code, the commissioner must lay it before Parliament for its consideration, and they must have regard to any representations that are made to them within 60 days of the draft being laid. Representations can be made to the commissioner by anyone, including members of the Scottish Parliament and members of the public. In calculating the 60-day period, no account will be taken of instances when Parliament is in recess for more than four days or when it has been dissolved.

The proposed procedural step, which will apply in relation to the first code, is in addition to the existing requirement that any code can be brought into effect only by the Parliament approving affirmative regulations under section 9. That is always the final step in the process.

The other amendments in the group are consequential. Amendments 22 and 27 simply adjust the location of some provisions to allow sections 6 to 9 to set out the enhanced process in chronological order. Amendments 23, 25 and 28 adjust cross-references and text in the light of the restructuring, and amendment 29 simply ensures that reporting on the code of practice will start running from the date of the first code.

I hope that the committee will recognise that this group of amendments fulfils its wish for additional time and procedure to consider the first code of practice carefully. I make it clear that later iterations of the code would not be sent to Parliament for 60 days; rather, they would follow only the second part of the parliamentary approval process. However, that is in line with the committee’s recommendation, and it would still ensure that later iterations of the code would be approved by regulations under the affirmative procedure.

The important point here is that the commissioner will draft the code in consultation with stakeholders. After the code has been approved by the Scottish ministers, the final step is that it will be considered by Parliament, which will decide whether and when to bring it into effect. That way, we will have a code that has achieved broad consensus. In the case of the first code, there will now be the added guarantee of an additional period for parliamentary scrutiny, which will be separate from the scrutiny of the regulations to bring the code into effect.

I move amendment 22.

Amendment 22 agreed to.

Amendment 23 moved—[Humza Yousaf]—and agreed to.

Section 6, as amended, agreed to.

After section 6

Amendment 36 moved—[Liam Kerr].

The Convener

The question is, that amendment 36 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 36 agreed to.

Section 7—Effect of the code

The Convener

Amendment 6, in the name of John Finnie, is grouped with amendments 8, 37, 9, 12 and 38 to 42.

John Finnie

Amendment 6 deals with a subject that exercised the committee during the scrutiny that led to our stage 1 report. It seeks to replace the term “have regard to” with a requirement to “comply with” the code of practice.

People might find it a little strange that we have such a proposed law in front of us. In section 7(3), which is covered by my amendment 8, the bill says:

“Failure to have regard to the code of practice does not of itself give rise to grounds for any legal action.”

The legislation that we put in place needs to be robust, and those at whom it is targeted need to have due regard to it. I do not doubt the willingness of Police Scotland, as it is currently configured, to follow it, but I cannot see a difficulty with what I propose. We put in place professional oversight of important pieces of legislation that have significant impact on citizens’ human rights, and it is only right for those who make judgments to “comply with” what is in the code of practice, rather than just to “have regard to” it. That sums up amendments 6 and 8.

On the cabinet secretary’s amendment 41, I note that allowing revocation of compliance at any time would seem to fly in the face of what we should be doing, so I will not support it. I hope that members will support my amendment 6.

I move amendment 6.

Humza Yousaf

I support John Finnie’s amendments 6, 9 and 12, which seek to replace the words “have regard to” with the words “comply with” in connection with how the code of practice is to be observed. Those amendments complement my amendments in the group, and I ask members to support them as well as mine.

My amendments 38 to 42, taken together, will enhance the commissioner’s power to deal with failures to comply with the code of practice. In lodging the amendments, I have been mindful of the committee’s desire to see stronger enforcement in the bill. That was a common theme—it was almost a constant theme—in the stage 1 debate, and I said at that time that I would reflect carefully on what had been said on the issue by John Finnie and almost every other member who spoke. I believe that the new provisions that I propose represent the best means of ensuring compliance with the code.

Amendment 38, which strengthens the commissioner’s powers, operates in conjunction with John Finnie’s amendment 6. Amendment 38 will enable the commissioner to issue a compliance notice to a person whom they consider has failed or is failing to comply with the code of practice. That could be done instead of or as well as reporting on such a failure under the existing powers in the bill for the commissioner to name and shame.

Amendment 39 specifies the content of a compliance notice, stating that it must include matters such as the steps that must be taken to address the breach of the code and the timescales for doing so.

Amendment 40 will allow the commissioner to vary a compliance notice in order to allow more time for compliance or, with the consent of the person to whom the notice was issued, to change the steps that are required to be taken.

Amendment 41 will allow the commissioner to revoke a compliance notice. To respond to the concern that John Finnie expressed, I note that it is about the commissioner having flexibility. It could not be done unilaterally by anyone else.

Amendment 42 will allow the commissioner to report to the Court of Session a refusal or a failure without reasonable excuse to comply with a compliance notice. It will allow the court, after hearing evidence or representations on the matter, to make an order to enforce a compliance notice, or to deal with the refusal or failure to comply with the notice as if it was contempt of court—an issue that I note the committee will come to later. As the committee may recall, the court may also do both of those things in relation to a failure or refusal to comply with an information notice under section 12.

On compliance with the code of practice, my view is that the commissioner’s existing powers to make recommendations and to follow up by reporting to Parliament on those matters are sufficient for all but the most extreme cases. I therefore hope that the additional powers that are set out in my amendments will be used rarely, if ever. However, I recognise the committee’s concerns and I wanted to provide reassurance that further enforcement action can be taken.

Amendment 37 changes section 7(3) as a consequence of amendment 6, such that all references are to complying with the code of practice. If amendment 37 is agreed to, section 7(3) will state:

“Failure to comply with the code of practice does not of itself give rise to grounds for any legal action.”

John Finnie’s amendment 8 seeks to remove section 7(3). I wish it to remain because, when read with section 7(2), it will make it clear that, although a court or tribunal

“must take the code of practice into account when determining any question to which the code is relevant”,

a failure to comply with the code will not in itself give rise to grounds for legal action. Section 7(3) is there as part of a package with section 7(2).

It is common for acts to expressly provide, for the avoidance of any doubt, that breach of a code does not in itself give rise to criminal or civil liability. Indeed, the committee approved that in relation to the stop and search code under the Criminal Justice (Scotland) Act 2016.

John Finnie

With regard to my amendment 8, is it your view that, on a stark reading of subsection 7(3),

“Failure to have regard to the code of practice”

could give rise to legal proceedings?

Humza Yousaf

I refer to the points that I have made. Amendment 8 would remove the certainty without providing for an accessible remedy to apply. As I said, it is not uncommon for the approach to be stated expressly in acts, so there is precedent for it. To be clear, I note that, under the new compliance notice that I propose, a failure to comply with the code will not in itself give rise to civil or criminal proceedings. Instead, as I think John Finnie is aware, it will give rise to a compliance notice. If that is not complied with, it will potentially give rise to legal action in the form that I set out in amendment 42. I hope that that gives John Finnie some reassurance that there is explicit provision for an accessible civil remedy.

I appreciate that John Finnie wants the code to be complied with and to ensure that there can be a consequence for non-compliance. I agree with him on that, but I suggest that my amendments on compliance notices provide for it more effectively. I therefore ask him not to move amendment 8 and to support my amendment 37 instead.

The Convener

There was considerable debate at stage 1 about the “have regard to” provision, and I note that John Finnie has come up with the new wording “comply with”. On the basis that both the cabinet secretary’s amendment 37 and John Finnie’s amendment 6 will strengthen adherence to the code, I think that they are both worth supporting.

I ask John Finnie to wind up and press or withdraw amendment 6.

John Finnie

It is important that due regard is given to the legislation, given the energy that has gone in to compiling it. I hope that members will support my amendment 6, and I press it.

Amendment 6 agreed to.

Amendment 24 moved—[Humza Yousaf]—and agreed to.

Amendment 7 not moved.

Amendment 8 moved—[John Finnie].

The Convener

The question is, that amendment 8 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Kerr, Liam (North East Scotland) (Con)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 2, Against 7, Abstentions 0.

Amendment 8 disagreed to.

Amendment 37 moved—[Humza Yousaf]—and agreed to.

Section 7, as amended, agreed to.

Section 8—Consultation on the code

Amendment 25 moved—[Humza Yousaf].

12:30  



The Convener

The question is, that amendment 25 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Robison, Shona (Dundee City East) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Kelly, James (Glasgow) (Lab)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Finnie, John (Highlands and Islands) (Green)

Against

Mitchell, Margaret (Central Scotland) (Con)
Kerr, Liam (North East Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 25 agreed to.

Section 8, as amended, agreed to.

After section 8

Amendment 26 moved—[Humza Yousaf].

The Convener

The question is, that amendment 26 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Robison, Shona (Dundee City East) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Kelly, James (Glasgow) (Lab)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Finnie, John (Highlands and Islands) (Green)

Against

Mitchell, Margaret (Central Scotland) (Con)
Kerr, Liam (North East Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 26 agreed to.

Amendment 27 moved—[Humza Yousaf].

The Convener

The question is, that amendment 27 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Robison, Shona (Dundee City East) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Kelly, James (Glasgow) (Lab)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Finnie, John (Highlands and Islands) (Green)

Against

Mitchell, Margaret (Central Scotland) (Con)
Kerr, Liam (North East Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 27 agreed to.

Section 9—Bringing the code into effect

Amendment 28 moved—[Humza Yousaf].

The Convener

The question is, that amendment 28 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Robison, Shona (Dundee City East) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Kelly, James (Glasgow) (Lab)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Finnie, John (Highlands and Islands) (Green)

Against

Mitchell, Margaret (Central Scotland) (Con)
Kerr, Liam (North East Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 28 agreed to.

Section 9, as amended, agreed to.

Section 10—Report on the code of practice

Amendment 29 moved—[Humza Yousaf]—and agreed to.

Section 10, as amended, agreed to.

Section 11—Power to gather information

Amendment 9 moved—[John Finnie]—and agreed to.

Section 11, as amended, agreed to.

Section 12—Failure to comply with an information notice

The Convener

Amendment 10, in the name of John Finnie, is grouped with amendments 11, 1 and 2.

John Finnie

Legislation can sometimes be a mystery. I have found section 12(2) confusing. It says:

“The Commissioner may also report the matter to the Court of Session where the Commissioner considers that a person who is mentioned ... is likely to do any of the things”.

That seems to me to be a peculiar way of dealing with matters. For that reason, I seek to remove the provision.

I move amendment 10.

Gordon Lindhurst (Lothian) (Con)

My amendments 1 and 2 relate to section 12. In the stage 1 debate, I raised with the cabinet secretary the possibility of someone being held in contempt of court for failing to comply with an information notice issued by the commissioner. The cabinet secretary kindly wrote to me following the debate in response to the issues that I raised, for which I thank him, so I will not go into my amendments in much detail.

The cabinet secretary has said that there have been a number of similar, if not identical, provisions in acts in the past 20 years. However, the provision in the bill seems to be somewhat draconian, because it relates to a failure to follow through not on a court order, but on an information notice from the commissioner. Even if there are similar provisions in other acts, that is not necessarily the appropriate way to deal with it, because contempt of court is a serious matter. If someone is in breach of an order of a court, one knows what one is dealing with, but if they are just in breach of an information notice from the commissioner, I am not sure that that falls into the same category.

I am interested to know why the cabinet secretary feels that that is the appropriate way to deal with the enforcement of those provisions of the bill and to ensure that they are complied with. I still do not see that it is appropriate to have contempt of court provisions in the bill, and that is why I lodged amendments 1 and 2.

Humza Yousaf

I will address John Finnie’s amendments 10 and 11 before turning to Gordon Lindhurst’s amendments 1 and 2. I recognise that amendments 10 and 11 arise from concerns that were raised in the stage 1 debate regarding how the commissioner could use the power in section 12 to refer matters to the court based simply on their consideration of what a person was likely to do, as John Finnie mentioned in his remarks.

However, the power in section 12(2) is important, particularly in relation to section 12(1)(c). For example, if the commissioner had reason to believe that a person was going to destroy important information, they could use the power in section 12(2) to apply to the Court of Session for an order to prevent that. If the commissioner had to wait until it had happened before they could go to the court, it would be too late. If an application is made to the court, it will hear evidence on the matter and it will need to be convinced that it is appropriate to take action, so it will not be just about what the commissioner believes.

It should also be noted that the power has precedent. Schedule 2 of the Scottish Commission for Human Rights Act 2006 provides the Scottish Human Rights Commission with the same ability to refer a matter to the court for consideration where it considers that it is likely that its equivalent information notices will be breached. I hope that members are reassured by my explanation of why the provision is included in the bill, and I ask John Finnie not to—

John Finnie

Will the cabinet secretary take an intervention before he concludes?

Humza Yousaf

I will.

John Finnie

The cabinet secretary rightly mentioned section 12(1)(c), which includes the wording

“alters, suppresses, conceals or destroys, without reasonable excuse”.

Those are clearly serious matters, and that shows the importance of the legislation, so I welcome the cabinet secretary’s explanation. It is important to get on the record the seriousness of the issues that could give rise to use of the power. That is why I am pleased that we have agreed that people will have to “comply with” the code, rather than just “have regard to” it.

Humza Yousaf

I thank John Finnie for his remarks and the work that he has done in relation to strengthening the provision so that the code of practice must be complied with, as opposed to people having regard to it. Given everything that I have said, I hope that he will not press amendment 10 and not move amendment 11.

I turn to Gordon Lindhurst’s amendments 1 and 2. I acknowledge the concerns that he has raised. I reflected carefully on and discussed with my officials the issue of holding someone in contempt of court. As Gordon Lindhurst mentioned, I wrote to him—as well as to Liam Kerr, who also raised concerns about the matter—on 21 January to offer further clarification. I recognise that the amendments have been lodged despite my reassurances, and I know that Gordon Lindhurst is still seeking some reassurance about what he considers to be a heavy-handed approach, so I will try to provide that.

The first thing to say is that it will be for the court alone, after hearing any evidence or representations on the matter, to find someone to be in contempt for failing or refusing to provide information. There is no suggestion that it would be for the commissioner to find someone to be in contempt of court. It is envisaged that a person would be found to be in contempt of court only where there had been an egregious failure to provide information to the commissioner—it would happen only in cases of really serious breaches.

Contempt of court is an important sanction in relation to situations where someone has already destroyed information that they were required to produce. Perhaps this point will answer Gordon Lindhurst’s question directly. In cases in which someone has destroyed such information, it is extremely unlikely that the court would grant an order for the production of that information, because it would know that the information had already been destroyed. How could the person produce it? The court therefore needs to have some form of sanction available to it, or people would potentially be able to destroy information with impunity.

Gordon Lindhurst

Is the cabinet secretary saying that it would only be in cases where the court had issued an order in relation to an information notice that the sanction of contempt of court could be used, or could it be used where the commissioner had issued a notice but the court had not issued an order in relation to that?

Humza Yousaf

It would happen on the back of the issuing of a compliance notice by the commissioner, rather than by the court. It would then be for the court to determine, after hearing representations and evidence, whether the person was in contempt of court.

As I said in my letter to Gordon Lindhurst, the proposed sanction is not unusual. It is a power that the court would be trusted to use responsibly, and it is one for which there is precedent. Such powers exist under the Scottish Commission for Human Rights Act 2006 and the Freedom of Information (Scotland) Act 2002. In those cases, the court has the power to deal with the matter as contempt. The court is in a similar position in relation to obstruction of the Scottish Public Services Ombudsman under section 14 of the Scottish Public Services Ombudsman Act 2002.

I hope that Gordon Lindhurst is reassured by my explanation of why such a provision is included in the bill, and I ask him not to move amendments 1 and 2.

John Finnie

The discussions that we have had this morning have been helpful. We have strengthened the bill, particularly with regard to the requirement to comply and the status that has been afforded to that. I thank the cabinet secretary for his helpful comments on my amendment 10, in the light of which I do not wish to press it.

Amendment 10, by agreement, withdrawn.

Amendment 11 not moved.

Amendments 1 and 2 not moved.

Section 12 agreed to.

Sections 13 and 14 agreed to.

Section 15—Reports and recommendations

Amendment 30 not moved.

Amendment 12 moved—[John Finnie]—and agreed to.

Amendment 13 not moved.

Section 15, as amended, agreed to.

Sections 16 and 17 agreed to.

After section 17

Amendments 38 to 42 moved—[Humza Yousaf]—and agreed to.

Sections 18 to 22 agreed to.

After section 22

The Convener

Amendment 31, in the name of Liam McArthur, is in a group on its own.

Liam McArthur

I am conscious of time, so I will try to be as brief as possible.

The independent advisory group recommended that an ethics advisory group be established as part of the oversight arrangements. The remit of the group would be to work with the commissioner and others to promote ethical considerations in acquisition, retention, use and disposal of biometric technologies and biometric data.

The Scottish Government accepted that recommendation and committed to developing proposals for its remit and membership in discussions with stakeholders, drawing on the connections and relationships that have been developed through the work of the IAG.

However, the bill does not provide for that. The Scottish Human Rights Commission said that that is “regrettable” and that

“the IAG report rationalised the need for such a group quite clearly. They drew on evidence of the success of the Biometrics and Forensic Group in England and Wales”.

The cabinet secretary has said that he will form an independently chaired reference group to deal with ethical issues, which

“will be established at around the same time that the new biometrics commissioner”—[Official Report, Justice Committee, 16 November 2019; c 16.]

takes office. That is welcome, as far as it goes, but the centrality of questions about ethics to ensuring public confidence in the framework and the oversight arrangements that we are putting in place demands the establishment of an ethics advisory group on a statutory footing—as is proposed in my amendment 31, the debate on which I look forward to.

I move amendment 31.

12:45  



John Finnie

I warmly welcome amendment 31. As Liam McArthur said, an ethics advisory group was the independent advisory group’s recommendation. I agree with the Scottish Human Rights Commission that it is, for a number of reasons, “regrettable” that that recommendation has not been taken up. This is an opportunity to understand the role that bodies such as the commissioner play in how the police might go about deployment of, for example, digital triage devices—so-called cyberkiosks. Such a group would be a good and inclusive way of ensuring that a broad range of views would be taken on board. I strongly support amendment 31.

Fulton MacGregor

I have some sympathy with amendment 31. It is probably fair to say that everybody on the committee would want the same outcome. However, I will not support the amendment because I am not sure, at this stage, that having such a group in legislation is required, although I hear what Liam McArthur and John Finnie have said. Would we be legislating on something about which we have already had assurances from the cabinet secretary? Perhaps bringing such a group into legislation would blur boundaries and roles. In a bill to establish the commissioner, we should give that person the full role of picking the remit for an ethics advisory group.

I will not support amendment 31, based on my not being sure whether its proposed provisions should be in legislation at this stage, but I am not opposed to the premise of the amendment.

The Convener

I believe that the committee unanimously supported the recommendation at stage 1. I am interested to hear the cabinet secretary’s views.

Humza Yousaf

Although I understand the good intentions of amendment 31, I cannot support it in its current form.

The way that amendment 31 provides for the ethics advisory group to function is somewhat convoluted, with decision making on issues relating to membership being split between the commissioner, Scottish ministers and Parliament. For example, the regulations that would be made by ministers—and, therefore, scrutinised by Parliament—would specify the number of members. However, the commissioner would then appoint the members. Given that the commissioner is to be an independent office holder who will be accountable to the Scottish Parliamentary Corporate Body, I am not convinced that it is appropriate for ministers to be involved at all. The amendment would leave a host of matters to be decided in regulations by ministers.

In addition, the amendment specifies the matters that the group is to provide advice on. In principle, I agree that that is reasonable. However, in terms of future proofing, that could be restrictive or confusing. For example, amendment 31 calls the group the “Ethics Advisory Group” and tasks it with oversight on ethics. However, in proposed subsection (3)(b), it then requires the group also to advise on legal issues that might arise.

As it stands, amendment 31 gives a mixed message about the remit of the proposed group. There is also no ability for the remit to be adjusted in the future, because the regulation-making powers that are set out in proposed subsection (6) are not wide enough to cover the remit.

In my response to the stage 1 report, I explained to the committee that I fully support the formation of an advisory group and will honour the public commitment that was made to establish such a group. I was, however, not convinced by calls that were made during stage 1 that the group should be placed on a statutory footing, and the independent advisory group on biometric data previously made no such recommendation. I would prefer that the commissioner, once in post, consults and secures a broad range of views on such matters in order to allow proper discussion. The commissioner could then decide which matters he or she needs advice on, given that any such group should report directly to the commissioner. That would allow the necessary flexibility in how the group should operate.

Finally, there are a number of technical issues with the amendment—principally about the consistency of language and cross-references to the source of the regulation-making power, which is found in proposed subsection (6), not proposed subsection (7). I therefore ask Liam McArthur not to press amendment 31, but am happy to make him the offer—considering the technical challenges and the challenges that are presented by mixed messages about the responsibilities of Parliament, the commissioner, and ministers—to work with him to agree a suitable amendment ahead of stage 3.

Liam McArthur

I start again by thanking everybody who has contributed to the debate. Convener—you were right when you reminded the committee of the unanimous recommendation that it made at stage 1, and of the recommendation from the advisory group.

John Finnie was right to flag up cyberkiosks, which brought into stark relief issues of ethics and the legal framework. There is an overlap in that the language that the cabinet secretary suggested is slightly “confusing” captures very well some of the issues that have been thrown up by the proposed roll-out of cyberkiosks.

We have had assurances from the cabinet secretary about implementing measures to reflect what he understands to be the recommendation from the advisory group, but by putting the recommendation on a statutory footing by including it in the bill, we would set it firmly at the centre of how we believe governance and oversight need to function. Although I welcome the offer from the cabinet secretary to work with me during the next few weeks, ahead of stage 3, to tidy things up, it is important that the committee agrees to amendment 31 at stage 2. On that basis, I press amendment 31.

The Convener

The question is, that amendment 31 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Mitchell, Margaret (Central Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Finnie, John (Highlands and Islands) (Green)

Against

Robison, Shona (Dundee City East) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 31 agreed to.

Section 23—Meaning of “biometric data”

The Convener

Amendment 32, in the name of the cabinet secretary, is grouped with amendments 33 and 34.

Humza Yousaf

In its stage 1 report, the committee asked me to consider how the definition in section 23 could keep pace with future developments in biometrics. I believe that the definition is already broadly drawn. However, amendment 33 will insert a power for Scottish ministers to change or clarify the meaning of “biometric data” by regulations. Amendment 34 will make that power subject to affirmative procedure, which will allow Parliament to scrutinise fully any changes that the Scottish ministers propose to make to the definition.

Amendment 32 will make a minor amendment to the definition to clarify that it includes not only photographs or other recordings of an individual’s full body, but of any part of the body—for example, an arm that might have a distinguishing mark, such as a tattoo.

I move amendment 32.

Amendment 32 agreed to.

Section 23, as amended, agreed to.

After section 23

Amendment 33 moved—[Humza Yousaf]—and agreed to.

Section 24 agreed to.

Section 25—Regulations

Amendment 34 moved—[Humza Yousaf]—and agreed to.

Section 25, as amended, agreed to.

Sections 26 and 27 agreed to.

Schedule 2 agreed to.

Sections 28 and 29 agreed to.

Long title agreed to.

The Convener

That ends stage 2 consideration of the bill. I thank the cabinet secretary for attending.

We have gone on a little bit longer than expected in order to get through all the stage 2 amendments. On that basis, does the committee agree to take the outstanding agenda items at our next meeting, which will be advised by the clerks?

Members indicated agreement.

Meeting closed at 12:55.  



Delegated Powers and Law Reform Committee's Stage 2 report

Scottish Biometrics Commissioner Bill with Stage 2 amendments

Additional related information from the Scottish Government on the Bill

More information on the powers the Scottish Parliament is giving Scottish Ministers to make secondary legislation related to this Bill (Supplementary Delegated Powers Memorandum)

Stage 3 - Final amendments and vote

MSPs can propose further amendments to the Bill and then vote on each of these. Finally, they vote on whether the Bill should become law

Debate on the proposed amendments

MSPs get the chance to present their proposed amendments to the Chamber. They vote on whether each amendment should be added to the Bill.

Documents with the amendments that were considered at the meeting on 10 March 2020.

Video Thumbnail Preview PNG

Debate on proposed amendments transcript

The Presiding Officer (Ken Macintosh)

We turn to stage 3 proceedings on the Scottish Biometrics Commissioner Bill. Members should have with them the bill as amended at stage 2, the marshalled list and the groupings of amendments.

As normal, the division bell will sound and proceedings will be suspended for five minutes for the first division of the afternoon. The period of voting for the first division will be 30 seconds. Thereafter, the period of voting for the first division after a debate will be one minute.

Members who wish to speak in the debate on any group of amendments should press their request-to-speak buttons as soon as I call the group.

I turn to the bill and the marshalled list.

Section 2—Functions

The Presiding Officer

Amendment 19, in the name of John Finnie, is grouped with amendments 23 to 26.

John Finnie (Highlands and Islands) (Green)

As we know, the pace of technological change in the field of biometric technologies is rapid. That is why it is vital that biometric technologies are expressly mentioned in the bill.

I thank the Cabinet Secretary for Justice for working with me to refine my stage 2 amendments. My amendments now make it clear that biometric technologies are as much a part of the commissioner’s scrutiny arrangements as biometric data, as I shall explain.

Amendment 19 requires that, when reviewing the law, policy and practice relating to biometric data, or promoting public awareness of powers and duties that relevant policing bodies have in relation to biometric data,

“the Commissioner is to have regard to the technology used or capable of being used for the purpose of acquiring, retaining, using or destroying biometric data.”

The phrase “capable of being used” is very important, as it includes technology that is available for use but not yet deployed, such as facial recognition technology. The legal and ethical use of technology by Police Scotland is, of course, a matter that I and other members view as being of great importance, given its impact on human rights, such as the right to privacy. It is therefore important that the new commissioner is able to provide views on such matters through reviews, the code of practice, reports and recommendations.

With that in mind, amendment 23 makes it explicit that, in a report that is issued under section 15, the commissioner may make a recommendation in relation to technologies that are used or are capable of being used to collect, retain, use or destroy biometric data.

Amendment 24 provides that, where such a recommendation is made, the commissioner “must” rather than “may” impose a requirement to respond on the relevant policing body. That is important for promoting transparency and accountability.

The amendments work with the existing provisions in section 16 so that the person on whom a requirement to respond is imposed must provide a written statement to the commissioner that sets out the action that they are taking or not taking in response to the recommendation. Thereafter, the commissioner is required to publish the written statement and lay it before Parliament, as is already provided for in section 17.

Amendment 25 clarifies that, where a recommendation that is issued under section 15 does not relate to biometric technologies, the commissioner can choose whether to impose a requirement to respond.

Amendment 26 is a minor consequential amendment associated with amendment 24.

Taken together, the package of amendments will make for stronger scrutiny arrangements and greater transparency around the use and potential use of biometric technologies.

I move amendment 19.

The Cabinet Secretary for Justice (Humza Yousaf)

At stage 2, John Finnie agreed to work with me to refine his intended amendments, which aimed to make explicit reference in the bill to biometric technologies. I am pleased that we have been able to build on Mr Finnie’s original amendment to make it even more effective in its coverage and relevance as far as the commissioner’s general functions are concerned. I particularly highlight the fact that, as Mr Finnie has just explained, amendment 19 now covers both technology that is in use and—this is important—technology that is capable of being used. Mr Finnie has already referred to facial recognition technology, which is not currently deployed by Police Scotland but certainly will be available for use and could be deployed by it in the future. The commissioner could include guidance on facial recognition technology in the code of practice or carry out a review of the law that relates to the use of that technology.

I very much support this group of amendments and I urge other members to support them, too.

The Presiding Officer

Does John Finnie wish to add anything further?

John Finnie

I have nothing to add.

Amendment 19 agreed to.

The Presiding Officer

Group 2 is on minor and technical amendments. Amendment 20, in the name of the cabinet secretary, is grouped with amendments 21, 9, 22, 12, 27 and 28.

Humza Yousaf

The amendments in the group in my name make minor and technical changes to the bill. Amendments 20 and 21 adjust section 2(7), to move the definition of “children and young persons” from after the definition of “vulnerable persons” to before it. That simply allows the list to be arranged alphabetically—we know that civil servants love ordering lists alphabetically. The definition itself remains unchanged, and the amendments are for tidying-up purposes.

In a similar vein, amendments 22 and 27 make minor adjustments to references to the code of practice at various points in the bill.

Amendment 28 adjusts paragraph 11 of schedule 1 so that the commissioner must obtain the consent of the Scottish Parliamentary Corporate Body in relation to the number of staff that the commissioner may appoint. The amendment provides a means for the SPCB to manage staff numbers to assure the efficiency of the commissioner’s office.

Amendments 9 and 12, in the name of Liam Kerr, are technical amendments that I am happy to support. Section 6A lists a number of issues that the commissioner is to have regard to in preparing the code of practice. Those matters are currently termed “principles”, but they are not framed as principles. Therefore, amendments 9 and 12 replace the reference to “principles” while ensuring that regard is to be had to the importance of those matters. The amendments also remove the reference to revised codes of practice so that revised codes are dealt with in a consistent way in the bill, as provided for by my amendments 22 and 27.

I thank Liam Kerr for agreeing at stage 2 to work with me and my officials on the amendments and for getting to a very constructive space in that regard.

I move amendment 20.

The Presiding Officer

I call Liam Kerr to speak to amendment 9 and the other amendments in the group.

16:30  



Liam Kerr (North East Scotland) (Con)

I thank the cabinet secretary for indicating his support for amendments 9 and 12 in my name. As the group title suggests, they are technical amendments that refine my stage 2 amendments to section 6A.

At stage 2, I inserted a requirement for the commissioner to “have regard to” certain important, high-level principles when preparing a code of practice. New section 6A was inserted into the bill as a result. Through amendment 12, I propose to change the opening words in section 6A so that it provides that, when preparing

“a draft code of practice, the Commissioner must have regard to the importance of”

the matters that are listed in that section—instead of referring to those matters as “principles”. That is because I recognise, as the cabinet secretary has said, that the matters that are listed in that section are not actually framed as principles.

Amendment 12 preserves the importance of the matters that are listed, including

“promoting and protecting human rights”

and

“ensuring the safety of individuals and communities”,

and it still requires the commissioner to “have regard to” them when preparing a code of practice.

John Finnie

The member will recall that at stage 2 we amended the bill to replace the phrase “have regard to” with the phrase “comply with”. He will remember all the arguments about strengthening the bill in that regard.

I am not persuaded that moving to a situation where we have

“regard to the importance of”

matters is anything other than a downgrading of a principle. It might just be about semantics, and I do not mean to be pedantic with the member on the issue. However, it seems to me that protecting human rights and the individual’s right to privacy are core principles, rather than matters that someone should simply have regard to. Will the member clarify that, please?

Liam Kerr

Yes, of course. Section 6A, as originally drafted, spoke to “principles”; it stated that the commissioner had to

“have regard to the following principles”.

However, the items on the list of matters that were designated as principles were not in fact framed as principles. Amendment 12, which redrafts the section, sets out that what follows are not to be considered to be principles—because they are not. It is a semantic point. They are, in fact, statements of what must be complied with. Does that make sense to Mr Finnie? Have I explained that reasonably well?

John Finnie

Yes—to a point. However, surely it is a sound principle that we should all be promoting and protecting human rights, rather than having

“regard to the importance of”

them. I am genuinely trying to understand this, because I want the process to be consensual.

Liam Kerr

I am grateful to Mr Finnie, because this is an important point. Section 6A originally referred to the commissioner having “regard to the following principles”. But the matters referred to in sections 6A(a) to (d) are not in fact principles; they are not in the form of principles as such. It would, therefore, be semantically wrong to keep referring to them as “the following principles”, because they are not principles. It is entirely a semantic point. Amendment 12 tidies that up so that, in preparing

“a draft code of practice, the Commissioner must have regard to the importance of”

the following things, which are not principles, because they have not been drafted as principles. I guess that I am asking Mr Finnie to trust me on this one.

The reason for the change is a semantic one. As drafted at stage 2, the provision referred to “principles”, which are not principles. We will see whether Mr Finnie goes with me on this one.

Amendment 12 also deletes the specific mention of revised codes in order to allow them to be dealt with in a uniform way across the bill, as the cabinet secretary proposes. Crucially, however, it remains the case that regard must be had to the importance of matters that are set out in section 6A when a revised code of practice is being prepared.

Amendment 9, on the other hand, is a consequential change. Because the reference to “principles” would be removed from section 6A, the reference to “principles” in section 6(1) would also be removed.

I thank the cabinet secretary for working with me to refine the provisions. I ask members to support amendments 9 and 12.

The Presiding Officer

I call the cabinet secretary to wind up on this group.

Humza Yousaf

I have no further comments.

Amendment 20 agreed to.

Amendment 21 moved—[Humza Yousaf]—and agreed to.

Section 5—Duty to comply with directions

The Presiding Officer

Group 3 is on an advisory group. Amendment 6, in the name of Liam McArthur, is grouped with amendment 18.

Liam McArthur (Orkney Islands) (LD)

I hope to continue the generally consensual tone of previous contributions. Amendments 6 and 18 seek to put the advisory group on a statutory footing. The recommendation to do so was unanimously supported by the committee, as well as by many of the stakeholders and witnesses who gave evidence, yet it appeared nowhere in the bill as it was originally drafted—an omission that the Scottish Human Rights Commission described as “regrettable”. At stage 2, the cabinet secretary committed in principle to putting the advisory group on a statutory footing if work could be done to revise the relevant wording. I accepted that proposal, and amendments 6 and 18 reflect our collaborative work.

New section 22A will allow the commissioner to make decisions on the governance, remuneration and membership of the group, with the consent of the SPCB where appropriate. It will also allow for the group to provide advice on all matters relating to the commissioner’s functions. I believe that that better reflects the bill’s approach in recognising the need to respond to the rapidly changing biometrics environment, which John Finnie mentioned.

I thank the cabinet secretary and his officials for their assistance in coming to this point. I look forward to any further debate, and I encourage members to support my amendment.

I move amendment 6.

The Presiding Officer

No other member has indicated that they wish to speak, so I invite the cabinet secretary to respond.

Humza Yousaf

At stage 2, Liam McArthur agreed to work with me and my officials to refine the proposal in his amendment 6, the aim of which is, as he said, to establish an advisory group to provide the commissioner with advice on legal and ethical issues relating to biometric data and technologies. I am pleased that we were able to make constructive adjustments to the stage 2 amendment to simplify how the membership of and remuneration and governance arrangements for the group will be determined. They also allow for greater flexibility in the group’s remit.

I have always supported the setting up of such a group and I recognise the importance of the commissioner being provided with advice that is not only independent, which is crucial, but also well informed. My concern was that, in committing that to legislation, we would risk losing flexibility, but Liam McArthur’s amendment 18 ensures that matters will be kept as open and flexible as they can be. It also removes the opportunity for Scottish ministers to steer the operation of the group and instead places the responsibility for decision making with the commissioner, which is exactly as it should be. It is vital to the credibility of the group that it should remain—and, of course, be seen to be—impartial.

I also agree that there should be a role for the Scottish Parliamentary Corporate Body in overseeing and approving the appointments process, the number of members and the remuneration and allowances of the group, in order to ensure transparency and value for money.

I thank Liam McArthur for the constructive way in which he has approached amendments 6 and 18. We were pleased to come to a resolution on them, and I hope that members will support them.

The Presiding Officer

Does Liam McArthur wish to make any concluding remarks?

Liam McArthur

No, thank you, Presiding Officer.

Amendment 6 agreed to.

Section 5A—Complaints procedure

The Presiding Officer

Group 4 is on a complaints procedure. Amendment 7, in the name of Margaret Mitchell, is grouped with amendment 5.

Margaret Mitchell (Central Scotland) (Con)

Amendment 7 replaces in full the amendment that I lodged at stage 2, which required the commissioner to put in place a procedure by which a person might make a complaint to the commissioner about the handling of their biometric data. My intention was to ensure that members of the public had the ability to complain directly to the commissioner if they believed that such data had not been dealt with properly by police bodies that fall within the oversight of the commissioner. That remains my intention. However, I have listened carefully to the concerns that were expressed by both the Cabinet Secretary for Justice and the Information Commissioner’s Office that it should be clear that complaints that are made via that procedure are to relate to breaches of the code of practice. I have worked with the cabinet secretary so that the provisions now make that clear.

The remainder of amendment 7 is very similar to my stage 2 amendment and it broadly achieves the same aim, as I shall explain. Amendment 7 requires the commissioner to “provide for” a procedure so that it is clear that they are not only to establish a procedure, but to retain it. The procedure is to allow an individual or their representative to make a complaint about a breach of the code of practice in relation to that individual’s biometric data. The procedure is to apply to complaints in respect of any body that is subject to the code of practice under section 7(1). That flexibility will allow the provision to cover any additional bodies that might be made subject to the code later by means of regulations under section 7(4). The procedure is to be available whether or not the individual has already instigated a complaint through the complaints mechanism of the body that they are complaining about.

In determining the procedure, the biometrics commissioner is to consult various persons, including the Information Commissioner. The provision recognises the importance of the Scottish biometrics commissioner and the Information Commissioner’s Office working together to ensure that complaints are directed to the appropriate commissioner. The procedure that is put in place by the biometrics commissioner will deal with complaints regarding failures to comply with the code, while the Information Commissioner’s Office will continue to deal with complaints about infringements of data protection legislation. Amendment 7 therefore sets out comprehensive arrangements to enable individuals to raise complaints relating to the code directly with the commissioner.

Amendment 5 moves section 5A so that it will appear after section 10, among the sections that deal with the code of practice. Given that the complaints procedure will now clearly be about complaints relating to a breach of the code of practice, that is a more suitable location.

I move amendment 7.

James Kelly (Glasgow) (Lab)

I support the amendments in the group. If the biometrics commissioner is to have the confidence of the public, it is important to have in place appropriate processes that will underpin the commissioner’s work. One of the gaps in the bill as introduced was the lack of a complaints procedure, but stage 2 amendments addressed that. I acknowledge the work that has been done with the cabinet secretary’s team, and the stage 3 amendments that Margaret Mitchell lodged refine and clarify the complaints procedure so that it will be clear which complaints will go to the Information Commissioner’s Office and which will go to the biometrics commissioner. The overall package of amendments at stages 2 and 3 make the bill stronger in that area.

Humza Yousaf

As members might know, I did not support the amendment that Margaret Mitchell lodged at stage 2 that required the biometrics commissioner to set up a complaints procedure. At that time, I was concerned that it could lead to duplication or disagreement between the Information Commissioner’s Office and the Scottish biometrics commissioner in relation to complaints about biometric data, because the amendment did not delimit the role of the biometrics commissioner and it would have allowed them to deal with complaints about breaches of data protection law that should properly be dealt with by the Information Commissioner’s Office.

I am pleased that Margaret Mitchell not only took my concerns on board but worked constructively with me and my officials and took on board the concerns of the Information Commissioner’s Office as set out at stage 2. Her stage 3 amendments limit the complaints procedure, quite rightly, to breaches of the code of practice. The amendments in the group also fix a number of technical points. I thank Margaret Mitchell for working with me to refine the amendments at stage 3. I will support amendments 7 and 5 and I urge others to do so, too.

Margaret Mitchell

I welcome the cabinet secretary’s endorsement of the amendments, and I thank him and his officials for working collaboratively with me to improve them. I think that we all agree that there should be a clear process for individuals to complain about breaches of the code of practice that directly affect them. Happily, the amendments that I lodged do precisely that.

Amendment 7 agreed to.

Amendment 5 moved—[Margaret Mitchell]—and agreed to.

Section 5B—Review of the Commissioner’s functions and powers

16:45  



The Presiding Officer

Group 5 is on post-legislative scrutiny. Amendment 8, in the name of Liam McArthur, is the only amendment in the group.

Liam McArthur

Amendment 8 follows my stage 2 amendment allowing for a process of review. Amendment 8 fine tunes what was agreed to at stage 2 by making minor drafting changes and altering the timing requirements so that the reviews can be linked to the commissioner’s strategic plan. If a review is considered unnecessary, my amendment would also require a statement to be made to set out the rationale for that.

As I said at stage 2, new biometric technologies are being developed at a pace that primary legislation cannot match. It is therefore essential to put in place a framework and mechanisms for reviewing and updating. Amnesty Scotland, the Law Society of Scotland, the Open Rights Group and the Scottish Human Rights Commission all raised concerns about the commissioner’s scope in their evidence. That may need to be revisited in due course. For now, I am, again, grateful to the cabinet secretary and his officials for working with me to put in place measures that will at least allow reviews to happen.

As the Law Society said in its briefing, the reviews should be seen not as a drain on resources but as

“necessary checks to ensure the high degree of transparency of the role which is required.”

However, I accept that the most important thing is that the reviews are capable of responding to circumstances. In some cases, that may mean that a review is not required.

I move amendment 8.

Humza Yousaf

At stage 2, Liam McArthur agreed to work with me to refine his amendment to require the Scottish ministers to undertake a review of the commissioner’s remit and functions at recurring intervals.

As I said at stage 2, post-legislative scrutiny is, of course, extremely important. I also said that I do not think that the bill needs to provide for it and that that is a matter better left to ministers and Parliament to determine without being tied to predetermined periods. However, I recognise that the Parliament wants to legislate on that aspect. I respect that, and I was keen to revisit the amendment to ensure that it works sensibly and in a way that achieves the most effective scrutiny possible.

In adjusting the original amendment, I am pleased that Liam McArthur recognises the benefit of linking the timing of the first post-legislative review to the end of the first strategic planning period rather than two or three years after royal assent. That allows the examination of the commissioner’s functions to be more meaningful and to consider whether the commissioner has been able to achieve all that they set out to achieve.

Amendment 8 also recognises that there may be times when it is not necessary to conduct subsequent reviews, in which case the Scottish ministers will be able to publish a statement to that effect and to lay that before Parliament. The amendment allows for a commonsense approach while retaining the need for transparency, as Parliament would be able to question ministers about their decision not to conduct a review.

I support Liam McArthur’s amendment 8, and I urge all members to do likewise.

The Presiding Officer

Does Liam McArthur want to make any concluding remarks?

Liam McArthur

I thank the Government for its support. I press amendment 8.

Amendment 8 agreed to.

Section 6—Code of Practice

Amendment 9 moved—[Liam Kerr]—and agreed to.

The Presiding Officer

Group 6 is on the code of practice and retention periods. Amendment 10, in the name of Liam McArthur, is grouped with amendment 11.

Liam McArthur

Amendments 10 and 11 are, again, a revised version of amendments that I pressed at stage 2. They have been proposed in recognition of the fact that there is a gap in the regulation of retention periods of biometric data.

Although DNA and fingerprints are regulated under the Criminal Procedure (Scotland) Act 1995, photos and other forms of biometric data are not. During the passage of the bill, research by the Scottish Liberal Democrats found that, since 2014, more than 375,000 images had been supplied to the police national database from Police Scotland’s criminal history system. Those images were uploaded without a clear legislative requirement for their deletion in the event of the person pictured being found innocent.

I recognise that facial recognition could be valuable for modernising how the police investigate crime but, unregulated, it represents a potentially serious threat to human rights and civil liberties. I consider that my provisions will provide a safeguard for those liberties and the necessary framework to allow for proportionate and legitimate use of the technologies.

The Ada Lovelace Institute found that

“People fear the normalisation of surveillance but are prepared to accept facial recognition technology when there is a clear public benefit, provided safeguards are in place.”

In evidence to the Justice Sub-Committee on Policing, Duncan Sloan, the temporary assistant chief constable, said that the current rules on what the police can do with images of the public are

“not so clear”

as the rules on fingerprints and DNA. He added that new governance arrangements

“would be valued and welcomed.”—[Official Report, Justice Sub-Committee on Policing, 16 January 2020; c 4, 5.]

Mr Sloan’s colleague, Detective Chief Superintendent Sean Scott, also supported the independent advisory group’s recommendation on a presumption for deletion of biometric data as a central part of the oversight system that is established by the bill. He stated that

“one of the IAG’s nine recommendations was about the retention periods and a presumption of deletion, and that is absolutely right.”—[Official Report, Justice Committee, 29 October 2019; c 13.]

There needs to be enough flexibility to allow for specific circumstances to be taken into consideration. However, putting retention periods in black and white will strengthen not only privacy rights but public confidence in the use of such technologies. For public authorities, that provides a much better basis on which to deploy those technologies.

I move amendment 10.

Humza Yousaf

As members might be aware, I have committed to conducting a review of retention periods once the new commissioner is in place. Therefore, I was interested in the amendments that were lodged by Liam McArthur at stage 2 that require the code of practice to provide for a presumption of a fixed three-year retention period for all biometric data.

I had a number of concerns about that, as I set out in detail at stage 2. That is why I welcome Liam McArthur’s new and more flexible amendment on retention periods, which I believe allows more nuanced rules to be provided for. In particular, it will allow different periods to be specified in different cases and will avoid our having to settle now on the period that must be specified.

The new amendment will also ensure that the provision that the code of practice is required to make will be focused only on cases where there is an existing legislative gap. That will help to avoid the risk of contradictory legal provision being made, as it will avoid the code being required to set out rules on retention periods for types of biometric data that are already suitably covered by our legislation.

I support Liam McArthur’s amendments 10 and 11, and I urge members to vote in favour of them.

Amendment 10 agreed to.

Amendment 22 moved—[Humza Yousaf]—and agreed to.

Amendment 11 moved—[Liam McArthur]—and agreed to.

Section 6A—Code of practice: principles

Amendment 12 moved—[Liam Kerr]—and agreed to.

Section 15—Reports and recommendations

The Presiding Officer

Group 7 concerns reporting on failures to comply with the code of practice. Amendment 13, in the name of Liam McArthur, is grouped with amendments 14 to 17.

Liam McArthur

Amendments 13 to 17 would mean that, under section 15, the commissioner would be required to “prepare and publish” reports about failures by relevant bodies to comply with the code of practice.

At stage 2, the cabinet secretary maintained that the bill’s strength can be found in the coercive powers of naming and shaming, and he observed that the power of reputational damage should not be underestimated. That always seemed to me to open up too much of a risk—one that some people might be willing to take. I am grateful that Humza Yousaf has come around to that view. In turn, I accept that the reports might be amalgamated, if appropriate, and should certainly recognise a de minimis threshold—not least in order to avoid an undue burden being placed on the commissioner.

I am pleased that the amendments strike a proportionate balance.

I move amendment 13.

Humza Yousaf

As Liam McArthur has already said, this group of amendments in his name will require the commissioner to prepare and publish a report about failures to comply with the code of practice, and will remove the discretionary power to prepare and publish such reports.

It has always been expected that monitoring and reporting compliance with the code of practice will be a key aspect of the commissioner’s role. Therefore, I have no issue with the amendments. I am pleased that, as Liam McArthur as noted, a practical approach is built into them, whereby the commissioner can choose not to report on a failure that involves a minor infraction, and can produce combined reports on failure to comply by more than one person, such as when there is a common theme. I support those provisions and thank Liam McArthur for working constructively with me and my officials to refine the amendments for stage 3. I hope that members will support them.

Liam McArthur

I thank the Government again for its co-operation. I suspect that the workings of the proposed provisions might be reviewed in the future, depending on the evidence that is forthcoming. I very much welcome the support that the Government has given in order to get us to this point.

Amendment 13 agreed to.

Amendments 14 to 16 moved—[Liam McArthur]—and agreed to.

Amendment 23 moved—[John Finnie]—and agreed to.

Section 16—Requirement to respond to reports

Amendment 24 moved—[John Finnie]—and agreed to.

Amendment 17 moved—[Liam McArthur]—and agreed to.

Amendments 25 and 26 moved—[John Finnie]—and agreed to.

Section 22A—Ethics Advisory Group

Amendment 18 moved—[Liam McArthur]—and agreed to.

Section 24—Interpretation

Amendment 27 moved—[Humza Yousaf]—and agreed to.

Schedule 1—The office of Scottish Biometrics Commissioner

Amendment 28 moved—[Humza Yousaf]—and agreed to.

The Presiding Officer

That ends consideration of amendments. As members will be aware, at this stage in proceedings I am required, under standing orders, to decide whether any provision in the bill relates to a protected subject matter; that is, whether it will amend the franchise or the electoral system for Scottish parliamentary elections. In my view, no provision in the bill will do any such thing, so the bill does not require a supermajority for it to be passed at stage 3.

Final debate on the Bill

Once they've debated the amendments, the MSPs discuss the final version of the Bill.

Video Thumbnail Preview PNG

Final debate transcript

The Deputy Presiding Officer (Christine Grahame)

The next item of business is a stage 3 debate on motion S5M-21174, in the name of Humza Yousaf, on the Scottish Biometrics Commissioner Bill. I call Humza Yousaf to speak to and move the motion.

16:58  



The Cabinet Secretary for Justice (Humza Yousaf)

I am delighted to open this stage 3 debate on the Scottish Biometrics Commissioner Bill. I thank my officials for drafting the bill and for working so constructively with members of the Opposition. I also thank members of the Opposition for taking a similarly constructive approach. I have been involved in introducing legislation in Parliament as a minister for just over seven and a half years, but I do not think that I have ever had a bill passed with so much consensus and with no member voting against a single amendment at stage 3. It has taken me only seven and a half years to get there, but I am delighted to have got there on an issue that has been, understandably, quite contentious and often quite controversial.

However, what we have now is an important piece of legislation that speaks to some of the key societal issues of our time, and touches on human rights and ethics as they relate to police use of very personal information. It is a hugely topical issue and one on which, I suspect, members from across the chamber have often been approached by members of the public in their constituencies

The origins of the bill go back a number of years. I take this opportunity to thank John Scott and his independent advisory group on the use of biometric data for shining a spotlight on biometric data in policing and criminal justice. The group’s report in 2018 was very much the inspiration for, and genesis of, the bill.

I also thank the various parliamentary committees that scrutinised the bill and its accompanying documents—in particular, the Justice Committee and its convener, Margaret Mitchell.

The bill has rightly attracted interest from a wide range of organisations and individuals. I am grateful to those stakeholders for the considered views that they offered to the Scottish Government during the preparatory phase of the bill, and to the Justice Committee once the bill had been introduced in Parliament.

I was pleased by the broad consensus in January to agree the general principles of the bill. However, the Justice Committee made a number of detailed recommendations in its stage 1 report; I am pleased to have been able to work with members to address those concerns during stages 2 and 3 in order to get to this important stage today. I welcome the cross-party support for the bill, and the very positive engagement that I have had with parliamentarians to ensure that the new legislation will do what we want it to do.

The bill will go a long way towards delivering greater transparency and accountability in how the police use biometric data, in recognition of how important that is to building and maintaining public trust.

I cannot stress enough how important it is that we equip our police officers with the necessary technology to ensure that they can keep us safe. However, I stress equally how important it is that the public have absolute confidence in those technological advances, and in how their data will be collected, retained and disposed of. The legislation, the new independent commissioner and the code of practice will, I hope, provide members of the public with the reassurances that they require.

I will focus on some key areas of the bill and what we want to achieve through it. First and foremost, the bill will make sure that our approach to biometric data, including from new technologies—such as facial recognition software, which was mentioned in the debate on amendments—is effective, proportionate and, crucially, ethical.

The bill creates an independent commissioner to advise on those issues, and to review the relevant law, policy and practice. The commissioner will oversee Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. The bill includes a power for ministers to add at a later date, should it be required, more bodies that operate in the context of policing and criminal justice. Policing—the police bodies in particular—is the right place to start, because we know that collection and retention of data for policing purposes can be different to collection and retention of personal data or biometric data by any other sector.

The commissioner will also prepare a statutory code of practice that will set out the mandatory standards that those bodies must meet, and the responsibilities that they must undertake, with the aims of ensuring good practice, driving continuous improvement, and enhancing accountability.

The content of the code has deliberately not been specified in the bill. That allows for flexibility and future proofing—we are all aware of how fast technology can move—and will preserve the impartiality of the commissioner, which is crucial to allowing the commissioner to use his or her own judgement in the future. The commissioner will also be able to draw on expertise from the statutory advisory group.

The draft code of practice will be the subject of consultation of specified bodies and will be subject to approval by Parliament before it can come into effect. The code will be published so that everyone can see the standards that are expected of the bodies that are mentioned in the bill.

The commissioner will have powers to obtain information and to make reports and recommendations. I expect that the relationship between the bodies that are subject to the code of practice and the commissioner will therefore be predicated on transparency and accountability. We heard from the biometrics commissioner for England and Wales at stage 1, during evidence gathering, how important that dynamic is.

There will be a complaints procedure, as we heard in the debate on amendments, so that members of the public can raise concerns with the commissioner about failures to comply with the code of practice.

The commissioner will also have substantial powers—they will have teeth—and can report to Parliament failures to comply, as well as issuing compliance notices to require that concerns be addressed. In the most extreme cases, the commissioner can, ultimately, report failures to comply to the Court of Session.

Finally, but importantly, the commissioner will play a major role in raising public awareness about rights, responsibilities, and standards that are used in relation to biometric data and technologies. Given the rapid increase, in recent years, in use of biometric data and technologies, it is absolutely vital that we promote clearer understanding of the issues in our communities, especially among young people and vulnerable people.

Biometrics is evolving rapidly and offers great potential in detection, prevention and prosecution of crime, which will keep our communities safe. However, use of biometric data and technologies also raises ethical and human rights considerations. Therefore, I want to ensure that use of biometric data, including from new technologies such as facial recognition software, is effective, lawful and ethical.

The bill creates a biometrics commissioner whose powers and duties are focused on rights, accountability and responsibilities. Since the bill was introduced, there has been a lot of discussion here in Parliament about biometric data. However, now is absolutely the time to have a national discussion about the ethics and human rights issues that are associated with police use of biometric data, and for the new commissioner to lead that discussion from the forefront.

If Parliament agrees to pass the bill today, that will place Scotland at the forefront of driving forward transparency, accountability and improvement in relation to biometric data for policing and criminal justice purposes.

I thank members once again for working extremely constructively to get us to this stage.

I move,

That the Parliament agrees that the Scottish Biometrics Commissioner Bill be passed.

17:06  



Liam Kerr (North East Scotland) (Con)

I am very pleased to open the stage 3 debate on the Scottish Biometrics Commissioner Bill on behalf of the Scottish Conservatives. I confirm that we will vote to pass it at decision time tonight.

The underlying principle of the bill is to address ethical and human rights considerations in Scotland in relation to the collection, use, retention and disposal of biometric data in the context of policing and criminal justice. It seeks to do that by establishing the post of a Scottish biometrics commissioner, who will draw up a code of practice governing how biometric material should be used, gathered and so on. That is a significant role.

The bill also seeks to underpin public trust in how the police use biometric data. That trust is recognised in the bill’s policy memorandum, in which being seen to promote the confidence of the public is essential in relation to the commissioner’s functions. It requires that

“governance arrangements for the Commissioner must be, and be seen to be, transparent, accountable and free of any undue influence.”

We all, no doubt, hope that that can be achieved. Ultimately, whether or not it is will, at least partly, be around the resourcing. As the Law Society of Scotland said:

“resources need to include funding for research, public consultations, marketing and legal advice ... Promoting and knowledge of the Commissioner’s role is going to be very important”.

The committee’s report was stark. It stated:

“Other SPCB supported officeholders have faced resourcing issues as a result of changes or expansion to their role and powers over time, or as a result of growing demand for activity.”

Given that, the committee’s conclusion that

“the Financial Memorandum may not sufficiently estimate the resources which may be needed to support the delivery of the Commissioner’s functions”

remains a concern—not least because, as I read with interest, the supplementary financial memorandum projects an extra couple of hundred thousand pounds due to the stage 2 amendments. Although I note what section 22 says about the preparation of an annual report, it does not mandate an explicit requirement to report on the adequacy of resources. That remains a concern, and I hope that we see the commissioner going wide in the interpretation of section 22 to include those issues of resources.

The code of practice, which is set out in section 6, is fundamental. It has been a major area for amendment—and rightly so. During the process, the cabinet secretary amended the bill to provide greater parliamentary scrutiny of the first code of practice by ensuring that the commissioner must lay a copy of the first—draft—code before Parliament for representations. That is a good development, which should help towards the desired public trust and accountability.

The committee agreed that the promotion and protection of human rights, privacy, public confidence and community safety are crucial within that code of practice. Noting that, I inserted at stage 2 a requirement for the commissioner to have regard to those factors when preparing a code of practice. I am very pleased that Parliament agreed to my further amendments earlier this afternoon and that John Finnie trusts me that the section is as tight as it can be. On that note, Liam McArthur’s points on his amendments around the code of practice retention periods were particularly well made, and the greater nuance that we built in this afternoon is welcome.

At stage 1, many committee members raised concerns about the need for a complaints mechanism and the possible impact on public confidence of not having one. Initially, the bill did not contain any provision whereby a member of the public could raise concerns about the use of their biometric data by the police or a breach of the code of practice with the commissioner. The committee therefore recommended that a complaint mechanism be included in the bill.

Margaret Mitchell amended the bill to include a complaints process, which we have further amended today. She will talk in greater detail about it later, but I believe that it is welcome that the commissioner is required to establish, and retain, a complaints procedure that allows people to make a complaint to the Scottish biometrics commissioner about a breach of the code of practice. The amendment also states that the commissioner is to publicise the procedure, which will help to raise public awareness of their rights relating to the use of biometric data by the police and the justice system.

It is trite to say that biometric data is developing all the time and changing. None of us can possibly know what the category “biometric data” will comprise in the future; therefore, building in future proofing with regard to the commissioner’s role and functions is essential. That is why Liam McArthur’s section 22A amendment at stage 2, regarding an ethics advisory group, was welcome. He has, of course, further amended that today to create an advisory group that will allow the commissioner more flexibility.

At stage 2, Mr McArthur inserted section 5B, which will allow the powers and functions of the commissioner to be reviewed three years after the bill receives royal assent and at the end of five years after a review under that section. His amendment today, which tightened that provision up and linked it to the publication of the commissioner’s strategic plan, makes sense and should be welcomed.

This is a good bill that has been subject to considered and sensible amendments throughout the legislative process, following extensive and exhaustive evidence taking at the committee stage. There followed reflective and collaborative working, which was mentioned by the cabinet secretary, and what has emerged is a strong piece of legislation that achieves its stated aims:

“to establish the office of Scottish Biometrics Commissioner and to provide for its functions in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes.”

For that reason, we shall support it at decision time this evening.

17:12  



James Kelly (Glasgow) (Lab)

I am pleased to open the stage 3 debate on behalf of Scottish Labour, and I confirm that we will support the bill at decision time. I have enjoyed this afternoon’s very consensual proceedings.

With regard to the advance of technology, John Finnie was right to separate out technology and data when he spoke earlier on one of his amendments. There have been dramatic advances in technology that have ensured that much more data can be collected and that data can be held more easily. That is of great advantage in the criminal justice system, and it helps the police and prosecutors to do their jobs in bringing people to justice and giving victims reassurance when they have suffered unjustly as a result of crime.

However, the other side of the advance is an ethics and human rights aspect, as the cabinet secretary said. A lot more data is being held, and we have to ensure that the ethics that underpin that situation are robust and that people’s human rights are not undermined. Against that backdrop, the objectives of the bill are absolutely correct in setting up a biometrics commissioner to oversee the collection and retention of biometrics data.

The process has been interesting. The Government has worked collaboratively with all parties and with the committee, and we have seen the bill strengthened as it has gone through stages 2 and 3. That is how the parliamentary process should work. With regard to compliance, in particular, the original draft of the bill stated that people need “to have regard to” the work of the biometrics commissioner. The committee members had a great debate about whether “have regard” was strong enough; I certainly argued that there should be stronger compliance than “have regard”. Amendments on that theme were agreed to at stage 2, which has made the compliance aspect much stronger.

There was a gap in the original drafting of the bill regarding the complaints process. It was well intentioned, as it was felt that the Information Commissioner could deal with any complaints. However, as a number of members have said, it is important to ensure public confidence. That could have been undermined by the lack of a process for complaining directly to the biometrics commissioner if people felt there were issues about how their data was being held. The amendments that were addressed at stage 2 and refined at stage 3 build in a proper complaints process and give clarity about which complaints would be relevant to the Information Commissioner and which would go to the biometrics commissioner.

The advisory group is also important. The Law Society said in its submission that

“future proofing in this area is very important to take account of new developments in technology, and it is important to be able to draw on relevant expertise.”

Setting up an advisory group will make that process much more robust. Being able to keep all of that under review, including the issue of resources, will also ensure that all those issues are taken into account.

The process has been a good and positive one for the Parliament and for the Government, which has taken the bill through Parliament and has built on the discussions and evidence. The end product is a robust one, which Parliament and the public will have confidence in.

17:17  



John Finnie (Highlands and Islands) (Green)

I am sure that there will be a lot of similarity in what we are all going to say. I agree with the cabinet secretary about the good work that has been done by John Scott QC and his committee to get us to this point. I hope that we are going to pass—the Scottish Green Party will certainly support it—a piece of legislation that will establish a new biometrics commissioner.

The explanatory note is very specific. It says that the commissioner will

“support and promote the adoption of lawful, effective and ethical practices in relation to biometric data in a policing and criminal justice context,”

by keeping

“under review the law, policy and practice relating to the acquisition, retention, use and destruction”

of data.

As others have said, public confidence in our criminal justice system is vital. The bill started as a sound enough piece of legislation and there has been extremely positive engagement, which—dare I say it?—was a fine example of how the committee system can work. The engagement with the cabinet secretary and his colleagues was appreciated, and the bill is stronger as a result.

The policy memorandum talks about a rapidly evolving area of work. It is right to strike a balance and to say that it offers

“great potential in the detection, prevention and prosecution of crime”.

We all see that. We know that, in the past 30 years, DNA testing has been central to solving serious crimes such as murder and sexual offences. In that period, we have seen laptops, phones, CCTV, security cameras, road cameras and automatic number plate recognition collecting, storing and using large volumes of biometric data. The Justice Committee was right to say in the stage 1 report that the legislation is “timely and necessary”.

There will be oversight of facial recognition, which has been referred to, but also of facial search technology; gait and movement recognition technology; eye, iris and retinal identification; voice recognition software; and data from social media. All of those things are capable of providing biometric sources to the police—I am advised that they are known as “second-generation biometrics”.

It is important that that commissioner functions independently, as was said in the report, with no perception of overt influence from policing-related bodies.

The amendment at stage 2 that brought in a requirement to comply is significant. I had a look at what the police told us, and they were relaxed about the phrase “have regard to”. They said that that was similar to recommendations from Her Majesty’s Inspectorate of Constabulary in Scotland, which they generally work to implement. There cannot be discussions about that. These are very important matters, and one of the bill’s objectives is to improve the accountability of the police.

I am pleased that the bill will cover the British Transport Police and that the Police Investigations and Review Commissioner is involved, given its pivotal role in policing in Scotland. The independent advisory group talked about having a complaints mechanism in the bill, and I support our convener in the important amendments that have been made in that regard.

Liam McArthur’s amendments on putting the advisory group on a statutory footing are important, as is the advice and information resource that the group can provide.

The Scottish public is under heavy surveillance and it is important that we get things right. I particularly thank the Scottish Government for working with me on the technology amendments. This is a good piece of legislation, and we will support it at decision time.

17:21  



Liam McArthur (Orkney Islands) (LD)

I echo the comments of others in confirming that the Scottish Liberal Democrats warmly welcome the bill and will support it at decision time. I thank all those who helped the committee during our scrutiny of the bill. Like the cabinet secretary and John Finnie, I pay particular tribute to John Scott QC and his colleagues in the advisory group for their work in laying the foundations.

I also thank the cabinet secretary for the constructive approach that he adopted in relation to the bill. Given how combative our exchanges on policing can get in the chamber, it is nice to have had that experience.

The case for establishing a biometrics commissioner to oversee the collection, use, retention and, importantly, deletion of biometrics is well made and widely accepted. Biometrics is an area of policy that is complex and highly technical, and one in which technology and its use are evolving at an astonishing pace. A robust regulatory framework and the specific expertise to oversee it are non-negotiables if we are to retain public confidence, while allowing our police and the justice system to have access to the tools that they will increasingly need.

Thanks to legislation that was passed in 2006 and 2010, we already have a legal framework governing the use of DNA and fingerprints. In 2015, however, it emerged that pictures of 330,000 Scots who had been taken into custody had been made available to users of the police national database. Many of the individuals concerned had done nothing wrong. That prompted my colleague Alison McInnes to spearhead a campaign for effective regulation of biometrics. She wrote to the First Minister at the time to demand a review of facial recognition technology, which lead to HMICS undertaking an assessment.

During consideration of the Criminal Justice (Scotland) Act 2016, Alison McInnes lodged amendments to make biometric information subject to the same rules as DNA and fingerprints. She recognised the importance of consistency, including around the timely deletion of images. Although unsuccessful, her efforts paved the way for my own amendments, which Parliament agreed to this afternoon. Those amendments achieve a consistency that is in the interests of not only individuals and the wider public but the police, who have been clear about their belief in the need for both consistency and clarity, albeit with some flexibility to deal with specific circumstances, as the cabinet secretary mentioned earlier.

I acknowledge the support from the Scottish Government for those changes, as I do its support over moves to put the proposed advisory group on a statutory footing. As I said in moving my amendments, putting that on the face of the bill sends a strong signal about the importance of the group’s work in helping to underpin all that the commissioner does. That better reflects the recommendations of the independent advisory group, and I hope that it addresses what was described by the Scottish Human Rights Commission as a “regrettable” omission from the bill as introduced.

Likewise, we have made progress on the question of enforcement powers. I appreciate that some stakeholders may wish that we had gone further, while the Government argued that the threat of naming and shaming was sufficient by way of a deterrent. However, by agreeing to ensure that breaches are made public by the commissioner—save for in the most minor of circumstances—I believe that we increase the likelihood of encouraging good practice and reduce the risk of individuals or organisations seeking to chance their arm.

The final area in which I think that an important step in the right direction has been taken today relates to the way in which we ensure that the legislation keeps pace with the development of biometrics. Putting in place a robust regulatory framework is essential, as is ensuring that that framework is overseen by those with the necessary expertise. However, there is no getting away from the fact that biometrics are rapidly evolving. We need to make sure that reviews are built in so that the public can have confidence that the framework and safeguards remain fit for purpose. Again, I welcome the support of the Government and the Parliament for my amendments to allow for such a review mechanism.

The Metropolitan Police Commissioner, Dame Cressida Dick, observed that although the police should take advantage of new technology to improve policing, it is not for the police service to draw up the rules by which that technology is used. She is right, but so, too, is Amnesty International, when it warns that

“use of biometrics has the potential to breach human rights such as the right to privacy, freedom of association and the right to peaceful assembly”.

That is why we need a robust regulatory framework and a biometrics commissioner with the necessary powers. I believe that the bill gets us much of the way there. On that basis, the Scottish Liberal Democrats will support the bill at decision time.

17:25  



Rona Mackay (Strathkelvin and Bearsden) (SNP)

As deputy convener of the Justice Committee, I am glad that we have reached the final stage of this important bill in, as the cabinet secretary said, a largely consensual way.

I thank the clerks and the bill team for their hard work, and the many excellent witnesses for helping us with their expertise in this field. A lot of work and a lot of listening have gone into getting the bill to a stage where, thankfully, we have achieved cross-party support. I agree with Liam McArthur that it is now a much better, more balanced bill.

The bill will ensure that the use of biometric data in policing and criminal justice is effective, lawful and ethical. It is vital that the public have confidence in the bill and that the ethics—the human rights aspects—of the bill have been addressed. The scope of the bill covers the acquisition, use, retention and disposal of biometric data, including fingerprints, DNA and emerging techniques such as iris recognition.

The ultimate goal is to keep communities safe while respecting the rights of the individual and improving the accountability of the police. Those are important elements in maintaining public confidence in police use of biometric data. Biometrics are hugely important in the prevention and detection of crime, and in prosecuting crime.

Of course, the use of biometric identification by police is not a new phenomenon. In Scotland, police services have been using criminal history photographs and fingerprints for more than 100 years. Over the past 30 years, the use of human DNA testing has become a central tool in detecting and prosecuting crime, particularly in the case of serious crime such as murder and sexual offences.

The need for a commissioner who is independent of Government, the police and the criminal justice system was a key recommendation in both the 2016 HMICS review and the 2018 independent advisory group report. The proposal to create such a role was widely welcomed by all witnesses who gave evidence to the committee.

The Commissioner for the Retention and Use of Biometric Material, Professor Wiles, stated that the bill places Scotland at the forefront of legislating for the oversight of biometric data in the field of criminal justice. He said:

“Many other countries are quite interested in what Scotland is doing, because they are all aware that they have similar issues.”—[Official Report, Justice Committee, 24 September 2019; c 2.]

Important amendments were made at stage 2, and the Government has worked with members across the chamber to incorporate their requests to shape the bill in the best possible form. Much of what I will say has already been said, but here is a sample of some of the amendments that were agreed to at stage 2.

The bill was amended to enable the Scottish ministers to change or clarify the meaning of biometric data by regulations. That will allow Parliament to scrutinise any changes that Scottish ministers propose as technology advances at pace. The committee also agreed to an amendment to allow for further process in the approval of the first code of practice, with that being done by Parliament, as recommended by the committee.

Importantly, Parliament agreed at stage 2 to add the PIRC to the list of bodies that are subject to the commissioner’s oversight. The committee also agreed to amendments to require the commissioner to set up a complaints procedure and to operate an advisory group. As we have heard, the complaints procedure has featured strongly in discussions, and I am pleased that the convener’s amendment was agreed to.

The committee also accepted Scottish Government amendments to enhance the powers of the commissioner to deal with failures to comply with the code of practice.

The bill has now been amended to establish an advisory group, which was another issue that the committee felt strongly about. The Scottish ministers’ role has been removed and instead the commissioner will be allowed to make decisions about the group’s administration, procedures, membership and remuneration, with the consent of the Scottish Parliamentary Corporate Body. The intention is that that approach will make for a more impartial group, whose remit and membership are tailored to the commissioner’s requirements.

This important bill ensures that the Parliament has future proofed and locked in all the necessary safeguards to enable Scotland to deal with the evolving technology that is now necessary for the detection, prevention and prosecution of crime.

17:30  



James Kelly

I am pleased to close the debate on behalf of the Scottish Labour Party. We will support the passage of the bill at decision time, which comes up shortly. It has been a useful example of a good way for a bill to progress through Parliament and the discussion this afternoon has been consensual. There were differences of opinion at the earlier stages, but they were exchanged in a collegiate manner. I am glad to say that on a lot of the differences of opinion a consensual way forward has been worked out, which is to the credit of the cabinet secretary, the Opposition spokespeople and the Justice Committee for the way that the process has been conducted.

I was struck by John Finnie reeling off all the different technologies that are now available to police and prosecutors for collecting data. It took me back to the first job that I had, which was with Greater Glasgow Health Board in 1982. When I joined, there was only one computer in the whole office. John Finnie reeled off what is now available, with laptops, mobile technology, voice recognition and, of course, the advent of facial recognition technology. The police have a lot more at their disposal, which is good for investigating crime and bringing people who have committed crimes to justice. However, it means that the challenges in relation to ensuring that ethics and human rights are not compromised are greater. From that point of view, the bill has a very important role to play. As Liam Kerr stressed, getting that right is important for winning public trust, and if the public are going to have proper confidence in biometric data, the role of a biometrics commissioner can help. I cannot stress enough that the powers that the police and prosecutors have to collect and retain data is of great advantage to the victims of crime, but they must use them properly and responsibly to ensure that they have the public trust.

The cabinet secretary emphasised the importance of expertise. Some of the changes that have been made as we moved through the process will allow us to draw on that expertise. The setting up of an advisory group and the passing of the amendments that Liam McArthur lodged at stages 2 and 3 will help. The bill, which we will shortly consider at decision time, has been enhanced by the introduction of greater compliance measures. The introduction of a proper complaints process that is streamlined along the proper routes for the biometrics commissioner and the Information Commissioner is helpful. As Liam Kerr pointed out, the issue of resources is important and should be kept under review. The review process that is built into the bill will help in that regard.

I am pleased to support the passage of the bill at decision time. The process has been good and we now have a more robust bill in place that the public will have confidence in.

17:34  



Margaret Mitchell (Central Scotland) (Con)

I welcome the Scottish Biometrics Commissioner Bill. Digital technology has advanced considerably over the past 25 years, and biometrics is one of the most rapidly developing technologies.

Biometric data is both highly sensitive and intrusive. It has evolved from first-generation biometrics, such as fingerprints and DNA, and second-generation technology such as facial recognition software, which presents opportunities and challenges. There is a need for balance between ensuring that the police have the tools that they need to keep the public safe and protecting individuals’ privacy. I thank the justice clerks for their sterling work in assisting the committee to achieve that balance.

The bill provides that the commissioner has several different functions. One is the general role to

“support and promote the adoption of lawful, effective and ethical practices”

in the use of biometric data by the police and criminal justice system. That includes how biometric data is acquired, used, retained and destroyed.

The bill also tasks the commissioner with keeping under review the laws, policies and practices relating to the use of biometric data by Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. Furthermore, the commissioner must prepare, promote and monitor compliance with the code of practice, and promote public awareness and understanding of the biometric data powers and duties of Police Scotland, the SPA and PIRC. The commissioner’s powers ensure that they are able to hold the police and criminal justice system to account for its use of biometrics.

The bill’s code of practice governs the collection, use and retention of the public’s biometric data by the police. After hearing the evidence presented at stage 1, the Justice Committee deemed that the inclusion of a complaints mechanism was essential to ensure that any member of the public could raise with the commissioner concerns about police compliance with, or possible breaches of, the code of practice.

I thank the cabinet secretary for his positive response to my amendment that put in place the complaints procedure and for the collaborative nature in which the Scottish Government and its officials have worked with me to amend and improve that provision. The commissioner will be required to publicise the complaints procedure, which should increase awareness among the public of their rights and bolster their confidence in the use of biometrics by the police.

In its stage 1 report, the committee stressed that the bill needed to be strengthened in order to ensure that the commissioner is able to provide robust oversight. Other improvements were made by John Finnie’s amendments, which future proofed the use of new technologies and provided that Police Scotland, the SPA and PIRC have a duty to comply with the code of practice. Liam McArthur’s amendments introduced a presumption in favour of the deletion of biometric data after a prescribed minimum retention period and provided for the creation of an independent advisory group, which will have open and flexible oversight.

The Justice Committee’s scrutiny of the Scottish Biometrics Commissioner Bill has been an example of effective collaborative and co-operative working between the committee and the Scottish Government, which has ensured that the legislation is fit for purpose. It is one of the best examples of how this Parliament can work effectively to get the best legislation possible. The Scottish Conservatives will have much pleasure in supporting the bill this evening.

17:39  



Humza Yousaf

I am grateful to members for their contributions in what has been a very constructive and consensual debate.

As I said in my opening remarks, the bill has enjoyed strong cross-party support from the start. Members have alluded to the fact that that does not happen by accident; it happens because of the open-mindedness of Opposition members. I hope that they recognise the Scottish Government’s open-mindedness.

I thank those whom we do not often hear about or do not often see at the forefront: the Justice Committee clerks; the officials, who were ably led by Elaine Hamilton, David Scott, Laura Barrie from the parliamentary counsel office and David Murdoch from the Scottish Government legal directorate, and the whole team behind them. On getting cross-party support, I make a special mention of that much-maligned political creature, the special adviser, or SPAD. John McFarlane, who is very well known to each of the Opposition spokespeople, has done an excellent job in working with my officials and me and Opposition members to get the bill to a place at which every single amendment at stage 3 was agreed to by every member. That was a really positive place for the bill to be in.

I take Margaret Mitchell’s point that the bill is not just about consensus, although I am pleased that we have consensus; it is also about effective scrutiny. We saw effective scrutiny by the Justice Committee. There was a range of views from stakeholders, some of which continue to challenge us. The Scottish Human Rights Commission, for example, continues to challenge us, and it will no doubt continue its engagement once the independent biometrics commissioner is appointed.

I will focus on some remarks that members made. Liam Kerr focused his remarks on public trust, which is, of course, hugely important. We can all think of examples of data breaches and leaks and, as I said in my opening remarks, many of us have undoubtedly been approached by members of the public with concerns about data privacy. Public trust must, therefore, be at the forefront of what we do. Having an independent commissioner with oversight of biometric data will help to give reassurance and ultimately strengthen public trust in policing. Whenever I speak to anybody who is involved in policing, particularly the chief constable, they always refer to the fact that the police get their consent from the people. The police do not get consent from the Government or the Parliament; the consent for and legitimacy of policing come from the people. That can happen only when there is public trust. Liam Kerr made that important point.

Liam Kerr also asked about finances and resources, as did James Kelly in his closing remarks. I reiterate what I have said before. It is, of course, right that the Government keep under review any representations that are made by the SPCB, for example, with respect to the resourcing provision of the office of the commissioner as part of the annual budget-setting process. I am confident that the costings in the financial memorandum and the supplementary financial memorandum are comprehensive and represent the best estimates at present. Clearly, however, the commissioner—he or she—will produce the code of practice and we will therefore have to keep that under review. That is important.

James Kelly made some excellent remarks about our having a stronger bill because of collaboration and a stronger commissioner because of the changes to the bill. He referred to the important change that we have made from the policing bodies having regard to the code of practice to their having to comply with the code of practice. I agree that that has led to a stronger bill and I hope that the changes will lead to a stronger commissioner and a stronger regulatory framework around biometrics.

John Finnie was absolutely right to say that the legislation is timely and necessary. I know that, to his credit, he has often been at the forefront in relation to human rights. He pushed the Government very hard on those matters in the committee in particular. I hope that we have met not just his expectations but those of many of the human rights organisations throughout the country.

John Finnie was also right to mention the pace at which technology changes. Dare I say it, but when he first became a police officer in Lothian and Borders Police in 1976—at the age of only five, I should say—and then a dog handler in Northern Constabulary, he could not have envisaged the pace at which technology has advanced. Police officers are now faced with that. That is a really important point.

As the chair of the serious organised crime task force, I know that the police always want to ensure—and they invest to ensure—that they keep pace with criminals. Criminals in serious organised crime gangs do not have to worry about ethics. They do not have to worry about procurement rules. They do not have to worry about legislation. They procure the technology that they require to make criminal transactions through the black market. It is essential that we allow the police the ability to invest in technology in order to keep pace with, or be ahead of, criminals, and at the same time ensure that the public are reassured about their data, about privacy and about the ethical considerations. John Finnie made that important point.

Liam McArthur was also right to reference human rights considerations. It is important to be reminded that the bill did not materialise out of thin air but resulted from a lot of hard work. Much of that was done by John Scott, but Mr McArthur was also right to reference his colleague Alison McInnes. I sat beside her at the Justice Committee many moons ago, where she often kept me right. Like many other members, she was a champion of human rights. The conversations that Alison McInnes had in this Parliament when she was an MSP, right through to the good work that John Scott has done, have meant that the bill represents a cumulative effort by a lot of different actors from a lot of different political parties, including people who are external to the Parliament. We have got to a very strong place, indeed.

Rona Mackay made excellent remarks about the independence of the commissioner. Through the process of the legislation, we have strengthened that independence, for example, with regard to the appointment of the advisory group.

Margaret Mitchell made some excellent points about the complaints process, which she has championed and led on in relation to the bill. She was right to make the point that the Scottish public will look to the Scottish biometrics commissioner when it comes to potential breaches of any code of practice. Therefore, having it in the bill that the complaints process will be a function of the biometrics commissioner is an excellent place for us to be.

We have an excellent bill. I thank all the Opposition spokespeople and the officials who have been involved in getting us to this stage. There has been a very constructive and collaborative approach.

More important than that approach, though, is that we will have a biometrics commissioner with a code of practice that I hope will give members of the public an absolute assurance that, although we want the police and those who are involved in policing to invest in technology in order to keep our streets safe, people’s biometric data will have a regulatory framework around it that will protect their rights and that takes on board the ethical considerations.

I am delighted to recommend the bill in my name, and I hope that it receives unanimous support in a few seconds’ time.

The Deputy Presiding Officer

That concludes the debate on the Scottish Biometrics Commissioner Bill.

Final vote on the Bill

After the final discussion of the Bill, MSPs vote on whether they think it should become law.

Video Thumbnail Preview PNG

Final vote transcript

The Presiding Officer (Ken Macintosh)

There are three questions to be put as a result of today’s business. The first question is, that motion S5M-21170, in the name of Ben Macpherson, on the Local Government Finance (Scotland) Order 2020, be agreed to. Are we agreed?

Members: No.

The Presiding Officer

There will be a division.

For

Yousaf, Humza (Glasgow Pollok) (SNP)
Whittle, Brian (South Scotland) (Con)
White, Sandra (Glasgow Kelvin) (SNP)
Wheelhouse, Paul (South Scotland) (SNP)
Wells, Annie (Glasgow) (Con)
Watt, Maureen (Aberdeen South and North Kincardine) (SNP)
Torrance, David (Kirkcaldy) (SNP)
Tomkins, Adam (Glasgow) (Con)
Todd, Maree (Highlands and Islands) (SNP)
Swinney, John (Perthshire North) (SNP)
Stewart, Kevin (Aberdeen Central) (SNP)
Stewart, Alexander (Mid Scotland and Fife) (Con)
Stevenson, Stewart (Banffshire and Buchan Coast) (SNP)
Smith, Liz (Mid Scotland and Fife) (Con)
Simpson, Graham (Central Scotland) (Con)
Ruskell, Mark (Mid Scotland and Fife) (Green)
Ross, Gail (Caithness, Sutherland and Ross) (SNP)
Robison, Shona (Dundee City East) (SNP)
Paterson, Gil (Clydebank and Milngavie) (SNP)
Neil, Alex (Airdrie and Shotts) (SNP)
Mundell, Oliver (Dumfriesshire) (Con)
Mountain, Edward (Highlands and Islands) (Con)
Mitchell, Margaret (Central Scotland) (Con)
McMillan, Stuart (Greenock and Inverclyde) (SNP)
McKelvie, Christina (Hamilton, Larkhall and Stonehouse) (SNP)
McKee, Ivan (Glasgow Provan) (SNP)
McAlpine, Joan (South Scotland) (SNP)
Matheson, Michael (Falkirk West) (SNP)
Mason, Tom (North East Scotland) (Con)
Mason, John (Glasgow Shettleston) (SNP)
Martin, Gillian (Aberdeenshire East) (SNP)
Maguire, Ruth (Cunninghame South) (SNP)
Macpherson, Ben (Edinburgh Northern and Leith) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
MacDonald, Gordon (Edinburgh Pentlands) (SNP)
MacDonald, Angus (Falkirk East) (SNP)
Lyle, Richard (Uddingston and Bellshill) (SNP)
Lockhart, Dean (Mid Scotland and Fife) (Con)
Lochhead, Richard (Moray) (SNP)
Lindhurst, Gordon (Lothian) (Con)
Kidd, Bill (Glasgow Anniesland) (SNP)
Kerr, Liam (North East Scotland) (Con)
Johnstone, Alison (Lothian) (Green)
Hyslop, Fiona (Linlithgow) (SNP)
Hepburn, Jamie (Cumbernauld and Kilsyth) (SNP)
Haughey, Clare (Rutherglen) (SNP)
Harvie, Patrick (Glasgow) (Green)
Harris, Alison (Central Scotland) (Con)
Harper, Emma (South Scotland) (SNP)
Hamilton, Rachael (Ettrick, Roxburgh and Berwickshire) (Con)
Halcro Johnston, Jamie (Highlands and Islands) (Con)
Greer, Ross (West Scotland) (Green)
Greene, Jamie (West Scotland) (Con)
Grahame, Christine (Midlothian South, Tweeddale and Lauderdale) (SNP)
Gougeon, Mairi (Angus North and Mearns) (SNP)
Golden, Maurice (West Scotland) (Con)
Fraser, Murdo (Mid Scotland and Fife) (Con)
FitzPatrick, Joe (Dundee City West) (SNP)
Finnie, John (Highlands and Islands) (Green)
Fabiani, Linda (East Kilbride) (SNP)
Ewing, Fergus (Inverness and Nairn) (SNP)
Ewing, Annabelle (Cowdenbeath) (SNP)
Doris, Bob (Glasgow Maryhill and Springburn) (SNP)
Dey, Graeme (Angus South) (SNP)
Denham, Ash (Edinburgh Eastern) (SNP)
Davidson, Ruth (Edinburgh Central) (Con)
Cunningham, Roseanna (Perthshire South and Kinross-shire) (SNP)
Crawford, Bruce (Stirling) (SNP)
Corry, Maurice (West Scotland) (Con)
Constance, Angela (Almond Valley) (SNP)
Coffey, Willie (Kilmarnock and Irvine Valley) (SNP)
Chapman, Peter (North East Scotland) (Con)
Carson, Finlay (Galloway and West Dumfries) (Con)
Carlaw, Jackson (Eastwood) (Con)
Campbell, Aileen (Clydesdale) (SNP)
Cameron, Donald (Highlands and Islands) (Con)
Burnett, Alexander (Aberdeenshire West) (Con)
Brown, Keith (Clackmannanshire and Dunblane) (SNP)
Briggs, Miles (Lothian) (Con)
Bowman, Bill (North East Scotland) (Con)
Beattie, Colin (Midlothian North and Musselburgh) (SNP)
Ballantyne, Michelle (South Scotland) (Con)
Balfour, Jeremy (Lothian) (Con)
Arthur, Tom (Renfrewshire South) (SNP)
Allan, Alasdair (Na h-Eileanan an Iar) (SNP)
Adamson, Clare (Motherwell and Wishaw) (SNP)
Adam, George (Paisley) (SNP)

Against

Wishart, Beatrice (Shetland Islands) (LD)
Stewart, David (Highlands and Islands) (Lab)
Smyth, Colin (South Scotland) (Lab)
Smith, Elaine (Central Scotland) (Lab)
Sarwar, Anas (Glasgow) (Lab)
Rumbles, Mike (North East Scotland) (LD)
Rennie, Willie (North East Fife) (LD)
McNeill, Pauline (Glasgow) (Lab)
McArthur, Liam (Orkney Islands) (LD)
Macdonald, Lewis (North East Scotland) (Lab)
Lennon, Monica (Central Scotland) (Lab)
Lamont, Johann (Glasgow) (Lab)
Kelly, James (Glasgow) (Lab)
Johnson, Daniel (Edinburgh Southern) (Lab)
Gray, Iain (East Lothian) (Lab)
Grant, Rhoda (Highlands and Islands) (Lab)
Findlay, Neil (Lothian) (Lab)
Fee, Mary (West Scotland) (Lab)
Cole-Hamilton, Alex (Edinburgh Western) (LD)
Boyack, Sarah (Lothian) (Lab)
Bibby, Neil (West Scotland) (Lab)
Beamish, Claudia (South Scotland) (Lab)
Baker, Claire (Mid Scotland and Fife) (Lab)

The Presiding Officer

The result of the division is: For 88, Against 23, Abstentions 0.

Motion agreed to,

That the Parliament agrees that the Local Government Finance (Scotland) Order 2020 [draft] be approved.

The Presiding Officer

The next question is, that motion S5M-21174, in the name of Humza Yousaf, on the Scottish Biometrics Commissioner Bill at stage 3, be agreed to.

Because the question is on a bill at stage 3, we must have a division. Members should cast their votes now.

For

Yousaf, Humza (Glasgow Pollok) (SNP)
Wishart, Beatrice (Shetland Islands) (LD)
Whittle, Brian (South Scotland) (Con)
White, Sandra (Glasgow Kelvin) (SNP)
Wheelhouse, Paul (South Scotland) (SNP)
Wells, Annie (Glasgow) (Con)
Watt, Maureen (Aberdeen South and North Kincardine) (SNP)
Torrance, David (Kirkcaldy) (SNP)
Tomkins, Adam (Glasgow) (Con)
Todd, Maree (Highlands and Islands) (SNP)
Swinney, John (Perthshire North) (SNP)
Stewart, Kevin (Aberdeen Central) (SNP)
Stewart, David (Highlands and Islands) (Lab)
Stewart, Alexander (Mid Scotland and Fife) (Con)
Stevenson, Stewart (Banffshire and Buchan Coast) (SNP)
Smyth, Colin (South Scotland) (Lab)
Smith, Liz (Mid Scotland and Fife) (Con)
Smith, Elaine (Central Scotland) (Lab)
Simpson, Graham (Central Scotland) (Con)
Sarwar, Anas (Glasgow) (Lab)
Ruskell, Mark (Mid Scotland and Fife) (Green)
Rumbles, Mike (North East Scotland) (LD)
Ross, Gail (Caithness, Sutherland and Ross) (SNP)
Robison, Shona (Dundee City East) (SNP)
Rennie, Willie (North East Fife) (LD)
Paterson, Gil (Clydebank and Milngavie) (SNP)
Neil, Alex (Airdrie and Shotts) (SNP)
Mundell, Oliver (Dumfriesshire) (Con)
Mountain, Edward (Highlands and Islands) (Con)
Mitchell, Margaret (Central Scotland) (Con)
McNeill, Pauline (Glasgow) (Lab)
McMillan, Stuart (Greenock and Inverclyde) (SNP)
McKelvie, Christina (Hamilton, Larkhall and Stonehouse) (SNP)
McKee, Ivan (Glasgow Provan) (SNP)
McArthur, Liam (Orkney Islands) (LD)
McAlpine, Joan (South Scotland) (SNP)
Matheson, Michael (Falkirk West) (SNP)
Mason, Tom (North East Scotland) (Con)
Mason, John (Glasgow Shettleston) (SNP)
Martin, Gillian (Aberdeenshire East) (SNP)
Maguire, Ruth (Cunninghame South) (SNP)
Macpherson, Ben (Edinburgh Northern and Leith) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Macdonald, Lewis (North East Scotland) (Lab)
MacDonald, Gordon (Edinburgh Pentlands) (SNP)
MacDonald, Angus (Falkirk East) (SNP)
Lyle, Richard (Uddingston and Bellshill) (SNP)
Lockhart, Dean (Mid Scotland and Fife) (Con)
Lochhead, Richard (Moray) (SNP)
Lindhurst, Gordon (Lothian) (Con)
Lennon, Monica (Central Scotland) (Lab)
Lamont, Johann (Glasgow) (Lab)
Kidd, Bill (Glasgow Anniesland) (SNP)
Kerr, Liam (North East Scotland) (Con)
Kelly, James (Glasgow) (Lab)
Johnstone, Alison (Lothian) (Green)
Johnson, Daniel (Edinburgh Southern) (Lab)
Hyslop, Fiona (Linlithgow) (SNP)
Hepburn, Jamie (Cumbernauld and Kilsyth) (SNP)
Haughey, Clare (Rutherglen) (SNP)
Harvie, Patrick (Glasgow) (Green)
Harris, Alison (Central Scotland) (Con)
Harper, Emma (South Scotland) (SNP)
Hamilton, Rachael (Ettrick, Roxburgh and Berwickshire) (Con)
Halcro Johnston, Jamie (Highlands and Islands) (Con)
Greer, Ross (West Scotland) (Green)
Greene, Jamie (West Scotland) (Con)
Gray, Iain (East Lothian) (Lab)
Grahame, Christine (Midlothian South, Tweeddale and Lauderdale) (SNP)
Gougeon, Mairi (Angus North and Mearns) (SNP)
Golden, Maurice (West Scotland) (Con)
Fraser, Murdo (Mid Scotland and Fife) (Con)
FitzPatrick, Joe (Dundee City West) (SNP)
Finnie, John (Highlands and Islands) (Green)
Findlay, Neil (Lothian) (Lab)
Fee, Mary (West Scotland) (Lab)
Fabiani, Linda (East Kilbride) (SNP)
Ewing, Fergus (Inverness and Nairn) (SNP)
Ewing, Annabelle (Cowdenbeath) (SNP)
Doris, Bob (Glasgow Maryhill and Springburn) (SNP)
Dey, Graeme (Angus South) (SNP)
Denham, Ash (Edinburgh Eastern) (SNP)
Davidson, Ruth (Edinburgh Central) (Con)
Cunningham, Roseanna (Perthshire South and Kinross-shire) (SNP)
Crawford, Bruce (Stirling) (SNP)
Corry, Maurice (West Scotland) (Con)
Constance, Angela (Almond Valley) (SNP)
Cole-Hamilton, Alex (Edinburgh Western) (LD)
Coffey, Willie (Kilmarnock and Irvine Valley) (SNP)
Chapman, Peter (North East Scotland) (Con)
Carson, Finlay (Galloway and West Dumfries) (Con)
Carlaw, Jackson (Eastwood) (Con)
Campbell, Aileen (Clydesdale) (SNP)
Cameron, Donald (Highlands and Islands) (Con)
Burnett, Alexander (Aberdeenshire West) (Con)
Brown, Keith (Clackmannanshire and Dunblane) (SNP)
Briggs, Miles (Lothian) (Con)
Boyack, Sarah (Lothian) (Lab)
Bowman, Bill (North East Scotland) (Con)
Bibby, Neil (West Scotland) (Lab)
Beattie, Colin (Midlothian North and Musselburgh) (SNP)
Beamish, Claudia (South Scotland) (Lab)
Ballantyne, Michelle (South Scotland) (Con)
Balfour, Jeremy (Lothian) (Con)
Baker, Claire (Mid Scotland and Fife) (Lab)
Arthur, Tom (Renfrewshire South) (SNP)
Allan, Alasdair (Na h-Eileanan an Iar) (SNP)
Adamson, Clare (Motherwell and Wishaw) (SNP)
Adam, George (Paisley) (SNP)

The Presiding Officer

The result of the division is: For 110, Against 0, Abstentions 0.

Motion agreed to,

That the Parliament agrees that the Scottish Biometrics Commissioner Bill be passed.

The Presiding Officer

The motion has been agreed to, therefore the Scottish Biometrics Commissioner Bill is passed. [Applause.]

The final question is, that motion S5M-21153, in the name of Bill Bowman, on the appointment of the Auditor General for Scotland, be agreed to.

Motion agreed to,

That the Parliament nominates Stephen Boyle to Her Majesty The Queen, for appointment as the Auditor General for Scotland.

The Presiding Officer

I offer my congratulations to Mr Boyle on his nomination. [Applause.]

Scottish Biometrics Commissioner Bill as passed

This Bill was passed on 10 March 2020 and became an Act on 20 April 2020 
Find the Scottish Biometrics Commissioners Act 2020 on legislation.gov.uk

Share this page