Volume of images held for policing purposes concerning, says Biometrics Commissioner

Dr Brian Plastow said he estimates that there are at least three million images being held by Police Scotland alone.

His concerns were raised in a report laid before the Scottish Parliament on Monday (March 25) that “sheds light on the usage of images within the scope of policing”.

The report consolidates for the first time the law, policy and practice behind the use of images and provides detailed volumes of images.

The report highlights several key findings and strategic conclusions aimed at enhancing governance, transparency and maintaining public trust in the use of biometric data in Scotland.

The report points out good practice by Police Scotland, the Scottish Police Authority (SPA), and the Police Investigations and Review Commissioner (PIRC) and identifies opportunities to strengthen their strategic governance arrangements concerning all biometric data types, including images.

While acknowledging the lawful and effective deployment of images in enhancing law enforcement and community safety, the report underlines the complex storage systems and databases housing this type of biometric data, unlike DNA and fingerprints which are held in defined databases.

Dr Plastow said: “This assurance review highlights that the volumes of images held by Police Scotland, the SPA and the PIRC is currently unknown by each agency resulting in significant governance challenges.

“A key finding from this review is that the volumes of images held are significantly higher than the total volumes of all other biometric data types combined. And while the total number is not possible to determine, I would estimate that there are at least three million images being held by Police Scotland.”

The report stresses the importance of compliance with the SBC Code of Practice and data protection laws, particularly concerning the storage of images in the existing databases.

Without effective governance, there is a risk that images could be retained longer than necessary, said Dr Plastow.

He said the issue of retention will be further examined in the upcoming Review of the Laws of Retention of Biometric Data in Scotland, which is being conducted in partnership with the Scottish Government. The review is scheduled to report in October 2024.

Dr Plastow’s report notes the “lack of information” provided to data subjects, whether arrestee, victim or witness when biometric data is taken.

The report also emphasises that none of the agencies reviewed hold meaningful management information on image volumes, including any metrics pointing to their effectiveness.

Dr Plastow says there needs to be further transparency and accountability by the reviewed bodies.

Of significant concern, he added, was the potential erosion of public confidence in the police use of biometric data in the UK, particularly due to the abolition of the Biometrics and Surveillance Camera Commissioner for England and Wales, and the recent statement made by the Policing Minister for England and Wales regarding access to passport and driving licence images for bulk surveillance, a practice not endorsed by the Commissioner in Scotland.

Dr Plastow said the release of this report underscores the “commitment to transparency and independent accountability” in the use of biometric data within Scotland’s criminal justice system.

Moving forward, the Commissioner recommends Police Scotland, the SPA and the PIRC to consider what additional management information on images, and other biometric data could be safely placed in the public domain to better inform public understanding and enhance public trust.

The Commissioner also wants Scottish ministers to consider whether the functions of the Commissioner and protections of the Code could be extended to include a range of other actors in criminal justice beyond Police Scotland, the SPA and the PIRC.