Government plans to appoint an independent watchdog to monitor how facial recognition, fingerprints and genetic information are used in Scotland have been criticised by campaigners.
For more than two years, the Scottish Government has been considering how best to improve the way public bodies manage biometric data about people.
Concerns centre around new technologies, such as facial recognition software, that can be used to identify people without their knowledge.
MSPs criticised the the lack of regulation of facial images held by Police Scotland as long ago as June 2015.
This led to a January 2016 report published by HM Inspectorate of Constabulary in Scotland (HMICS) which confirmed that facial images of 334,594 Scottish people held by Police Scotland had been uploaded to the Police National Database (PND).
Not all of the images uploaded to the PND were of people who were found guilty of a crime, but law enforcement agencies throughout the UK have access to the PND.
Police Scotland self-regulation on biometric data ‘must end’
Research by Big Brother Watch found that Police have used facial recognition technology to try to identify people even though the technology was found to incorrectly identify people more than 90 per cent of the time.
On 13 July 2018, the Scottish Government published more detailed plans on biometric regulation for public consultation, including proposals for an independent Biometrics Commissioner and a code of practice.
The commissioner would provide “independent and ethical oversight,” the Scottish Government said but civil liberties group and politicians say the plans do not go far enough.
Mathew Rice, director of Open Rights Group Scotland (ORG), welcomed proposals to appoint a new commissioner, but added: “For some unknown reason the commission has had its enforcement powers cut short.”
He pointed out that the Biometrics Commissioner would have less power than the Scottish Information Commissioner. “While the Scottish Information Commissioner, a similar body but in a different area of public life, could refer a public body who fails to comply with a notice to the courts in Scotland, the Biometrics Commissioner would only be able to refer it to the Scottish Parliament.”
Rice also questioned whether the current plans, which limit the scope of the commissioner to public bodies and “community safety uses” was sufficient, given the increasing use of tools such as facial recognition technology by private companies.
It has been reported recently that Facebook was developing technology that could allow retailers to identify their customers using facial recognition technology at the checkout.
In March, Milnbank Housing Association in Glasgow claimed to have implemented “hi-tech” facial recognition software on its privately managed CCTV cameras.
But Rice said he was concerned that this use may not be covered by the proposed Biometrics Commissioner, as the housing association may not be considered a public body.
“We need effective, modern institutions in Scotland to secure our rights,” he said. “The lines between who has access to this technology, and where it is deployed, are becoming blurred.”
Private companies, such as retailers, were increasingly turning to facial recognition, he pointed out. The potential for misuse was “not hypothetical.”
The Scottish Government “should not avoid the ethical questions posed by this technology… on the technicality that they aren’t a justice or community safety operation,” he concluded.
Concerns over the limited remit of the proposed biometrics commissioner were backed by Liam MacArthur MSP, the Scottish Liberal Democrat justice spokesperson.
He said: “Biometric data is very powerful and there must be no scope for its misuse. We must be careful to ensure the increasing prevalence of biometric systems does not fool us into assuming they are infallible.
“It is important the Biometrics Commissioner will be able to command appropriate authority and have the ability to refer cases to the courts if necessary.
“Biometric technologies are creeping into our everyday lives and now have a presence far beyond the criminal sphere. For the commissioner to have a comprehensive grasp on biometric capabilities their reach must extend to biometrics wherever they are found, be it in education, health or retail.”
John Finnie MSP, justice spokesperson for the Scottish Greens, described the ORG comments as a “useful contribution”. He said: “The use of biometric data such as DNA, fingerprints and facial images deserves better oversight.
“I hope the consultation on the powers of a commissioner results in proper enforcement and protection of human rights.”
The Scottish Government pointed out that the Independent Advisory Group on the Use of Biometric Data in Scotland met eight times between June 2017 and January 2018. Its terms of reference, remit and membership had been published.
“We want to ensure the right balance is struck between the delivery of justice, community safety, privacy, ethics and wider human rights in the use of biometric data and technologies,” said a government spokesperson.
“Our draft proposals have been informed by the Independent Advisory Group’s report on the use of biometrics, chaired by prominent Solicitor Advocate John Scott QC. This public consultation is an early opportunity for people, communities and organisations to have their view and contribute to the development of our proposals. We will carefully consider the results of the consultation once it closes.”
