Scotland publishes first Code of Practice for use of biometric data

The code of practice, which came into force today (Wednesday 16 November), gives guidance to the police on how biometric data and related forensic technologies can be used ethically in a criminal justice setting. 

The use of biometric data – including faces, fingerprints, voices, DNA profiles and other measurements related to the body – is becoming increasingly common in new technologies, particularly those related to facial recognition.

However, these applications have led to civil rights challenges and condemnation from human rights groups, who argue that the technology is often mistaken and biased.

The Scottish framework aims to address these concerns by setting out 12 principles and ethical considerations detailing how biometric data can be acquired, retained, used and destroyed in criminal justice and policing scenarios.

These include equality, lawful authority, ethics, privacy, respect for human rights and encouragement of scientific and technological advances.

Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner must adhere to these guidelines. The code also includes a complaints mechanism and the power of enforcement to ensure compliance. 

The Scottish Biometrics Commissioner, Dr Brian Plastow, said the code represents “a significant human rights achievement” for Scotland, and is something of which the country should be proud.

 “From today, Scotland is the first country in the world to have a national code of practice which gives guidance to the police on how biometric data and related forensic technologies can be used,” he said. “It promotes good practice, transparency and accountability by setting out standards for professional decision-making while matching the needs and responsibilities of policing with important human rights safeguards.

“Its implementation should enhance confidence in our criminal justice system.”

Cabinet Secretary for Justice and Veterans Keith Brown added: “Given the rapid increase in police use of biometric data and technologies in recent years, it is all the more important that we have an independent commissioner who will raise public awareness about rights, responsibilities and standards.

“It is vital that we promote a clearer understanding of these issues in our communities – especially for young and vulnerable people.

“The code of practice prepared by the commissioner symbolises Scotland’s progressive approach to biometrics, particularly in policing and criminal justice.”

The code was approved by the Criminal Justice Committee of the Scottish Parliament without amendment, and regulations were laid which introduced the code on a statutory basis.

Although the guidelines are unique to Scotland, the code sits alongside frameworks that are being developed throughout the rest of the UK.

Earlier this year, an independent review of UK legislation commissioned by the Ada Lovelace Institute called on the government to pass laws that will govern biometric technologies, after finding current legislation to be “fragmented” and “unclear” in this aspect.

Professor Fraser Sampson, the UK government’s Biometrics and Surveillance Camera Commissioner, has voiced similar concerns, and called for “a clear, comprehensive and coherent framework to ensure proper regulation and accountability” with regard to the use of biometrics and surveillance cameras in England and Wales.

Until recently, biometric technologies had been used almost exclusively in policing. The Metropolitan Police and the South Wales Police are some of the forces that have been known to use these technologies. However, they are now used by a growing number of private and public organisations, including employers, schools and shops, to score video interviews, alert staff of theft risks and to verify students’ identities.

Last year, the UK Information Commissioner’s Office (ICO) expressed similar concerns regarding the reckless and inappropriate use of facial recognition in public spaces, banning facial-recognition company Clearview AI and demanding that the company delete all the data it held that related to UK citizens.