‘Thorough review’ needed on retention of biometric data by Police Scotland, says new report
Police Scotland needs to conduct a “thorough, evidence-based review” of its retention policies for biometric data, a new report has said.
The Scottish Biometrics Commissioner says while the retention of fingerprints, DNA and other biometrics is currently undertaken in a “lawful, effective and proportionate manner” in Scotland, there is no distinct Police Scotland policy in place in relation to the retention of biometric data.
The report, jointly published on Thursday (October 31) by the Scottish Biometrics Commissioner and Scottish government, recommends Police Scotland improves the collection of management information to support any need for future legislative change.
Scottish Biometrics Commissioner Dr Brian Plastow said: “Police Scotland does not have a bespoke policy in relation to the retention of biometric data such as DNA, fingerprints, images and recordings taken for policing and criminal justice purposes in Scotland. Instead such data is retained under a separate policy relating to the retention of entire criminal records.
“This means that, in some cases, biometric data is being retained for longer than necessary and that it is not being subjected to periodic reviews to ensure that ongoing retention in any individual case is both proportionate and strictly necessary.
“Biometric data is invaluable in the detection of crime – bringing perpetrators to justice and exonerating the innocent. But society is increasingly concerned about how this data is managed and seeks assurance that the police follow lawful, ethical, effective and proportionate methods.
“I expect that the report published today, in partnership with the Scottish government, will provide the impetus for Police Scotland to develop distinct policy on biometric data that is consistent with the statutory Code of Practice in Scotland, which mandates compliance with UK data protection law and adherence to The European Court of Human Rights judgment in the case of Gaughran v The United Kingdom.”
The Review of the Retention of Biometric Data provided under sections 18 to 19C of the Criminal Procedure (Scotland) Act 1995 contains six recommendations, four of which are made to Police Scotland. Its aim is to look at the legal provisions, the current policies and procedures adopted by police for the retention of the data.
A key recommendation is that Police Scotland conducts a thorough, evidence-based review of its retention policies, including a specific policy which expressly prohibits indefinite retention without periodic review. Effectiveness, proportionality and necessity should be taken into account, and based on evidence, when determining the retention periods.
The review wants options for the new policy, consultation and its implementation to be complete within a year.
Other recommendations within the report relate to improved management information about data retention within Police Scotland, the speeding up of an ongoing review of volunteer data retention and assessment of the practicality of the one month timeframe for DNA samples to be obtained from convicted persons.
The Commissioner warns that the current Police Scotland approach to biometric data retention comes with possible legal and ethical risks.
“Its alignment to crime record data policy can lead to excessive retention periods which vary according to the convicted case data or the production evidence schedule. This gives rise to concerns about the lawfulness, proportionality and necessity of the prevailing biometric retention policies,” said Dr Plastow.
A recent EU judgment deemed that retention until death, or beyond, without meaningful review was ‘indefinite retention’, which is contrary to human rights.
As Police Scotland’s current policy for destruction of DNA is based on a person’s 100th birthday or date of death plus three years, a review of policy is required by Police Scotland.