Facial Recognition and the Biometrics Strategy

Stuart C McDonald Excerpts

Wednesday 1st May 2019 Westminster Hall

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

It is a pleasure to serve under your chairmanship, Sir Roger. I thank the hon. Member for Bristol North West (Darren Jones) for obtaining the debate. I can testify to his expertise on such issues, having served with him on the Committee that scrutinised the Data Protection Act 2018. I claim no such expertise, so I am grateful to him for succinctly explaining the operation of facial recognition technology in particular. It has been a useful debate. It is a shame that we have clashed with the climate change debate because, as the hon. Member for Stretford and Urmston (Kate Green) said, even if the issue does not cause concern among many of our constituents at the moment, it ought to. There are some important questions that we have to debate and address.

The use of biometrics by police and law enforcement is of course not remotely new, but it is clearly evolving exponentially. It can and does make a huge contribution to detecting and preventing crime; it also has an important role in eliminating innocent individuals from inquiries, and it can help to trace missing and vulnerable people, but as all the hon. Members who spoke highlighted, it poses a range of serious ethical and human rights questions. It has the potential to be hugely invasive of privacy, largely because of the possibility that the systems will operate while requests for the consent of those caught up in them will be limited; there could be impacts on freedom of assembly and association, and the operation of the systems raises significant questions about data protection. In many forms of fast-developing technology, it is a challenge for the legal system to keep pace with changing use. Understandably, there has been particular concern about automatic facial recognition technology.

All the different legal systems in the United Kingdom and beyond face those challenges, and of course Scotland is no different. We kick-started our debate on the issues in 2016 with the report of Her Majesty’s inspectorate of constabulary in Scotland. It concluded that Police Scotland had been making

“proportionate and necessary use of Facial Search within PND”

and that it had been operating in accordance with its own policy, Home Office policy, and College of Policing guidance. However, it identified similar concerns to those that have been raised in the debate, and the need for improved legislation, a statutory code of conduct to govern Police Scotland’s use of biometric data, and better independent oversight.

The main legislation relating to biometrics in Scotland dates from 2010. The hon. Member for Bristol North West mentioned 2012 legislation being out of date already, and I absolutely accept that the 2010 measure is now too old. It predates the time when Police Scotland started to upload photos on to the police national database, in 2011. I understand that the facial search functionality of PND became generally available in March 2014. We do indeed have some catching up to do to make sure that issues to do with images and facial recognition technology are properly covered in legislation.

Following the inspectorate report, the Independent Advisory Group on the Use of Biometric Data in Scotland was established to produce more detailed proposals for plugging some of the gaps and setting up a more ethical and human rights-based framework. I thoroughly recommend the group’s report—it is a fascinating read. It draws on a range of expertise, not just from members of the group, but from the police, human rights and data protection groups, and experts such as the Biometrics Commissioner, the Forensic Science Regulator and the Biometrics and Forensics Ethics Group, which advises the Home Office. The report found that

“those involved in this field in Police Scotland...appear to work to very high standards of international repute, with a good grasp of the ethical and human rights implications of their work”.

It also made several recommendations about enhancing the legislative framework and oversight. Specifically, it recommended a Scottish biometrics commissioner and an ethics advisory group. It recommended a new legislative framework, accompanied by a code of practice, and made more detailed policy recommendations that I will come to shortly. I am pleased that those recommendations have been accepted by the Scottish Government. A public consultation has been held, and a biometric data Bill will soon be introduced to implement them. That is the right approach, and hopefully it will deliver the comprehensive framework that hon. Members have argued for today.

Let me turn to two of the most controversial aspects of the debate. In Scotland, 2010 legislation allows Police Scotland to retain fingerprints and DNA data from convicted individuals indefinitely. Data from individuals prosecuted for certain sexual and violent offences may be retained for three years, regardless of whether there is a conviction, and the chief constable can apply to the sheriff court for a two-year extension. More generally, data from individuals who have been arrested for an offence must be destroyed if they are not convicted or if they are granted an absolute discharge. Usual practice for photographs also follows that regime, which is slightly different from what happens in England and Wales, particularly with regard to the disposal of photographs of those who have not been charged or convicted.

Is that the perfect approach? I do not think we can answer that conclusively; we must be led by the evidence as it develops. It is perfectly legitimate to question whether a blanket policy of the indefinite retention of biometrics after every conviction is reasonable, because, as the advisory group pointed out, there is no abundance of evidence to suggest what degree of retention has proved the most useful. Biometric data is likely be more useful in identifying the perpetrators of some crimes compared with others, but the risk of offending and reoffending involves a range of factors, including many individual aspects. In an ideal world, the length of time we kept biometric data would be decided for each individual case, but that is not a practical approach, so we must consider the evidence gathered and do the best we can.

The use of automated facial recognition systems is hugely problematic, and our general approach must be evidence led. If such technology is to be used, it must be used only where necessary, and it must be done proportionately and on as targeted and limited a basis as possible. There are huge concerns about the impact of such technology on privacy and freedoms such as the freedom of assembly, and there is a danger of bias and discrimination. Studies have shown that such technology can disproportionally misidentify women and black and minority ethnic people, and as a consequence people from those groups are more likely to be wrongly stopped and questioned.

We must by now have sufficient evidence from forces in London and south Wales to show what automated recognition could look like in practice, what it is capable of achieving, and the price to be paid for that achievement. I will not say that I envisage no circumstances where the use of such technology could be justified—for example, it could be used to counter a specific and serious threat or danger—and I am probably somewhere between Roy and Chris in the range of views set out earlier. Nevertheless, I would be reluctant to see such technology rolled out in Scotland before the new regulatory and oversight regime is in force and before issues of bias and discrimination have been addressed. It seems sensible to stop the use of the technology elsewhere until its implications have been fully assessed and debated, sufficient checks are in place, and there is sufficient public support.

I will end with a quote from the advisory group:

“In this context, it is essential that sensitive personal data are collected only for specific, explicit, lawful and legitimate purposes. In seeking to achieve a careful balance between the needs of citizen and state, there is clearly a need for independent oversight, and for the development of a broad framework of consistent ethical and human rights respecting principles against which all biometric use for policing, law enforcement and public protection purposes in Scotland can ultimately be checked”.

The SNP supports an approach that involves a comprehensive legislative framework and a regularly updated code of conduct. We need strong oversight through a commissioner to ensure that the use of biometrics is proportionate, necessary and targeted, and respects human rights, privacy and data protection rules. I congratulate the hon. Member for Bristol North West on securing this debate. I hope there will be many more to come, with more MPs in attendance, as this important subject requires much more discussion.