Official Report

 

  • Justice Committee 01 October 2019 [Draft]    
    • Attendance

      Convener

      *Margaret Mitchell (Central Scotland) (Con)

      Deputy convener

      *Rona Mackay (Strathkelvin and Bearsden) (SNP)

      Committee members

      *John Finnie (Highlands and Islands) (Green)
      *Jenny Gilruth (Mid Fife and Glenrothes) (SNP)
      *James Kelly (Glasgow) (Lab)
      *Liam Kerr (North East Scotland) (Con)
      *Fulton MacGregor (Coatbridge and Chryston) (SNP)
      *Liam McArthur (Orkney Islands) (LD)
      *Shona Robison (Dundee City East) (SNP)

      *attended

      The following also participated:

      Detective Chief Superintendent Patrick Campbell (Specialist Crime Division, Police Scotland)
      Al Duff (Edinburgh Napier University and NO2ID Edinburgh)
      Deputy Chief Constable Will Kerr (Police Scotland)
      Dr Ken Macdonald (Information Commissioner’s Office)
      Matthew Rice (Open Rights Group)
      Judith Robertson (Scottish Human Rights Commission)

      Clerk to the committee

      Stephen Imrie

      Location

      The Mary Fairfax Somerville Room (CR2)

       

    • Decision on Taking Business in Private
      • The Convener (Margaret Mitchell):

        Good morning and welcome to the 24th meeting in 2019 of the Justice Committee. Agenda item 1 is to decide whether to take business in private. Do members agree to review in private the evidence that will be heard under agenda item 3, on Brexit contingency planning, and to consider in private agenda item 6, which is consideration of our forward work programme?

        Members indicated agreement.

    • Scottish Biometrics Commissioner Bill: Stage 1
      • The Convener:

        Agenda item 2 is an evidence session on the Scottish Biometrics Commissioner Bill. I refer members to paper 1, which is a paper by the clerk, and paper 2, which is a private paper.

        I welcome our panel of witnesses: Dr Ken Macdonald, head of ICO regions, Information Commissioner’s Office; Al Duff, professor of information policy at Edinburgh Napier University and member of NO2ID Edinburgh; Matthew Rice, Scotland director, Open Rights Group; and, last but not least, Judith Robertson, chair of the Scottish Human Rights Commission.

        I thank the witnesses for going to the trouble of making written submissions. I cannot tell you how invaluable it is for the committee to see written submissions before we take formal evidence.

        I will ask the first question. Are members of the panel in broad agreement that the proposal to introduce a Scottish biometrics commissioner is a timely one, and do they think that the Government has got it right? Who would like to start? That is a fairly easy question to start with.

      • Judith Robertson (Scottish Human Rights Commission):

        I would be happy to start.

        I am the chair of the Scottish Human Rights Commission, which generally supports the direction of travel of the bill. We have worked alongside John Scott QC and the independent advisory group to consider the issue. We have been involved for a couple of years, but we know that a huge amount of important work was done prior to that process that recognised the need for clarity around regulation in relation to biometrics in Scotland and for human rights to be engaged—particularly article 8 of the European convention on human rights, which is on the right to private and family life. That recognition is clear and explicit in the proposed legislation, and we welcome that process.

        We have some concerns. We would like the legislation to be strengthened in various ways—obviously, the evidence session will explore that in more detail—but we think that it is a start in the process.

      • The Convener:

        That is helpful. The question was about timing. Is this the right time for the proposal, or could it have been later?

      • Matthew Rice (Open Rights Group):

        Since 2017, the Open Rights Group has been involved in the policy debates on the creation of a biometrics commissioner in Scotland, and throughout, we have been consistent in supporting the creation of such a commissioner. To answer the question specifically, we are in broad agreement with the direction of travel and think that the bill is a timely addition to the landscape in Scotland, but we think that there are specific areas that can be improved on.

      • Al Duff (Edinburgh Napier University and NO2ID Edinburgh):

        I represent NO2ID, which is an organisation that is opposed to identity cards in any form and to the growth of the database state. We support the bill, which is a step in the right direction, but we are looking for something rather different from what the bill has in mind. We are looking for a fully fledged information protector for Scotland.

      • The Convener:

        Are you content on the timing specifically?

      • Al Duff:

        The timing is absolutely right.

      • The Convener:

        Okay.

      • Dr Ken Macdonald (Information Commissioner’s Office):

        As members will be aware, I served on the independent advisory group whose report led to the bill. Obviously, I am content that the bill is going through. I represent the United Kingdom Information Commissioner, and I see the bill as complementary to our work. Concerns have been raised that there might be overlap. However, we have experience of working with the UK biometrics commissioner, from whom the committee heard last week, and anything that helps to clarify the way in which biometric information, which can be quite intrusive information, is held and used in Scotland has to be welcomed.

      • The Convener:

        Thank you for that. To drill down a bit further, the Scottish biometrics commissioner’s general function, according to the bill,

        “is to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data”

        by Police Scotland and the Scottish Police Authority. It is good just to get that on the record at the beginning. Are the witnesses satisfied that that general function is sufficiently fit for purpose? If not, what changes should be made to ensure that it is?

      • Al Duff:

        We think that we need a lot more than someone who covers just police use of facial recognition and biometric data. We want to see a fully fledged rather than part-time information champion who would be a privacy champion for Scotland to supplement the role of the Scottish Information Commissioner, whose remit should be freedom of information. The information polity requires someone to champion the other side of the coin, which is privacy and data protection. We therefore have in mind a fully fledged privacy commissioner who would look at not just facial recognition data but any kind of cameras or data, whether that comes from the police, the secret services, the public sector or the private sector. The commissioner would be an ombudsman, a port of resort for inquiries, and someone who would engage in and commission research on privacy and would be a champion for privacy in the Scottish public sphere.

        The issue goes well beyond that of facial recognition. We think that the bill is far too narrow. It is a part-time position, and that never really works. We are looking for someone who can take the bull by the horns and cover privacy in every respect. For example, cameras in school toilets and classrooms are not at the facial recognition level; they are closed-circuit television cameras, and we think that that is a problem. Police filming of innocent football crowds on a routine basis is not necessarily about facial recognition, but we think that it is wrong. We need something much bigger than what is proposed in the bill that would show that the Scottish Government and the Scottish Parliament are ahead of the curve as we head into the global information society.

      • The Convener:

        What you propose would clearly involve a huge piece of work. Rather than have no legislation at this time, is not the bill a step in the right direction?

      • Al Duff:

        I do not see why the bill cannot be redrafted. That would not be a lot of extra work, and the person would not have to be tied to any particular law. The person we have in mind would deal with not just data protection law but other laws relating to privacy, so they would have a freewheeling role and would not be tied to any particular act. I do not see why you cannot go back to the drawing board a little. You have done a lot of good work, and facial recognition is the top issue at the moment, but you are in grave danger of producing an anomaly and something that does not address all the issues. There is an opportunity now for the Scottish Parliament to do something new. It would be reported all around the world if you funded a privacy commissioner. I know of only one country in the world that has both an information commissioner and a privacy commissioner: Canada, which has led the way. In many respects, we should be emulating Canada on the issue.

      • The Convener:

        Okay. Ken Macdonald is next. Members may ask supplementary questions once we have heard from all the panellists.

      • Dr Macdonald:

        I must clarify the legal situation. As I said, I represent the UK Information Commissioner’s Office. Although the ICO is headquartered in Wilmslow, just south of Manchester, we have a small office here, in Melville Street, and we also have offices in Belfast and Cardiff, which I head up.

        Data protection is a reserved matter. Although I can understand the concerns of Professor Duff, at present it is not within the legislative competence of the Scottish Parliament to legislate on the data protection side of things. Therefore, there is no opportunity to have a privacy commissioner of the sort that he suggests.

      • The Convener:

        Thank you. That is helpful. I will bring Professor Duff back in once other members of the panel have had a shot and we have had some supplementaries. There might be some questions for him.

      • Judith Robertson:

        I would like to answer your specific question about the role of the commissioner in general. We have some concerns about that, in that the bill does not principally define the commissioner as a body with powers to scrutinise the police in relation to their use of biometrics; rather, it defines the commissioner as having a

        “general function ... to support and promote the adoption of lawful ... and ethical practices”.

        From our perspective, that is problematic, because it detracts from what we consider should be the primary role of promoting and investigating compliance with a code of practice in relation to the collection, use, retention and disposal of biometric data. We think that making that very explicit in the bill would afford the strongest protection against intrusion into people’s rights. We must make sure that that is the purpose of the commissioner.

      • The Convener:

        In other words, the bill lacks teeth when it comes to enforcement.

      • Judith Robertson:

        At the moment, it does.

      • Matthew Rice:

        We have some concerns about the scope of the commissioner’s role. Although we would not go as far as Professor Duff, we think that the use of biometrics is an issue of high public concern, but the matter does not end with law enforcement—it is clear that there are applications of biometrics in private sector and other public sector bodies that the public are concerned about. We feel that it is unhelpful that the bill is slightly narrow in that respect.

        I agree with Judith Robertson and the Scottish Human Rights Commission on the need to put the commissioner on a stronger footing with regard to investigating and maintaining compliance with the statutory code.

      • The Convener:

        Liam Kerr has a supplementary question.

      • Liam Kerr (North East Scotland) (Con):

        Professor Duff mentioned the fact that the commissioner will be a part-time role—0.6 full-time equivalent, I think. When the committee raised that concern previously, it was given assurances that the strength of the team that will back up the commissioner will ensure that the part-time status of the role will not be a problem. Do you disagree with that?

      • Al Duff:

        Yes, I strongly disagree with that. We envisage the individual having a wider and much greater role. It would have to be a full-time position. If that does not happen, that would suggest that the Scottish Government and the Scottish Parliament are not taking privacy seriously.

      • The Convener:

        As we move on, there will be other opportunities for people to speak more fully about any issues that they think have not been covered.

      • Liam McArthur (Orkney Islands) (LD):

        Good morning. I want to raise an issue that we covered at last week’s meeting. We were given assurances by the Commissioner for the Retention and Use of Biometric Material, who covers England and Wales, that the proposed role is broad ranging enough and that the proposed powers are extensive enough. However, we have heard concerns about the extent of the role from the witnesses and from others who have supplied written evidence. For example, even in the criminal justice system, the Scottish Prison Service will not be covered by the bill’s provisions.

        Although initially the commissioner might be a part-time role, are there ways in which the powers that the bill provides could be extended almost incrementally? I would like us to establish where the areas of priority are and how we might move forward to a more all-encompassing role in due course.

      • Judith Robertson:

        One way in which the bill could be strengthened that would enable that process to take place incrementally over time would be to establish the code of practice that was developed by the independent advisory group on a statutory basis. That would involve putting the code of practice in the bill and making it an explicit statement.

        The code of practice could be reviewed. The bill allows for that, but it gives the authority to do so to the commissioner.

        We think that the code of practice should be included in the bill, because that would provide absolute clarity for the commissioner, the police and the authorities that will be bound by the proposed legislation. That would also provide a model of good practice. The general principles and parameters on how biometrics should be dealt with generally would be made very clear, and that would provide an opportunity for the model to be applied on a more general basis to the other spheres and areas of concern.

        We, too, recognise that the bill is a step in the right direction, but it does not cover everything that potentially needs to be covered by biometrics legislation.

        10:15  
      • Liam McArthur:

        Would it need to explicitly refer to the Scottish Prison Service or private companies gathering biometrics on behalf of the police or the Scottish Police Authority? Would that need to be explicitly set out in the legislation, or would putting the code of practice on a statutory footing, as you suggest, allow the commissioner oversight in those areas?

      • Judith Robertson:

        We would probably need to extend which authorities the legislation was intended to cover. The code of practice, as written by the independent advisory group, was developed with Police Scotland and the SPA in mind. It was heavily consulted on, and evidence was taken from across the different sectors. If you were to extend the scope of the legislation, you might have to extend the scope of the consultation to ensure that the code of practice was broad enough to cover those other authorities. The code of practice was not developed for that purpose, as far as I understand it.

      • Liam McArthur:

        I do not want to create any false choices, and there does not necessarily need to be an either/or choice but, in the order of priorities, is putting the code of practice on a statutory footing more imperative for you at this stage than expanding the reach of the provisions?

      • Judith Robertson:

        I think that you have just created a false choice. [Laughter.] It is really important to put the code of practice on a statutory footing. I would also argue that it is important to extend the scope of the legislation. I do not think that those are alternatives.

      • Liam McArthur:

        Absolutely.

      • Matthew Rice:

        Specifically on whether you can amend and add to the code, section 7(4) of the bill, which is on the effect of the code, allows for the Scottish ministers

        “to add a person or description of person”

        to the persons that the code has an effect upon. Currently, the code has an effect on

        “constables and police staff of the Police Service of Scotland”

        and the Scottish Police Authority. You could conceivably see an opportunity to add the Scottish Prison Service to those persons.

        However, I go back to the problem with adding a private body, for example. The general functions of the commissioner would still relate to criminal justice and policing purposes; there may be other purposes for which biometrics would be used that would not necessarily be covered or deemed legitimate to add to the bill.

        You would need to return to the functions to see whether you could add biometric data in the field of public bodies and its use by private bodies in relation to the general public. At that point, section 7(4) of the bill would allow ministers a little bit more flexibility.

        However, in terms of the code of practice, the commissioner’s role would still be more the role of a champion and promoter than a regulator.

      • Liam McArthur:

        Would you have any anxieties about spreading the reach of the commissioner as well as putting the code of practice on a statutory footing? In terms of the establishment of the commissioner, you have essentially required more of the commissioner from the get-go so, in a sense, more things could go wrong or not work as effectively as they might.

      • Matthew Rice:

        One of the lessons that should be learned from the commissioner in England and Wales is that they started off with a narrow problem and they found a narrow solution but that problem was never narrow to begin with. There is now a commissioner in England and Wales who regulates the use of fingerprints, DNA and even footprints—much to his own hilarity, it seems—but whose role does not cover these second-generation biometrics although the real crux of public concern is around gait recognition and facial recognition. The anxieties are more around fixing that narrow issue. Although the issue is profound in a law enforcement context, we are not future proofing for what the public needs.

        The bigger anxiety, for me, is that the public will see a commissioner and expect something of them that they may not be able to deliver, which would result in a loss of public confidence and trust in what that commissioner can be relied upon to do.

      • Al Duff:

        I agree. I reiterate that we need a rounded, holistic approach to privacy. Threats to privacy come from all directions. Facial recognition is just the latest iteration, and there will be things after it. We need someone who can grab the bull by the horns and run with it. To take up Dr Macdonald’s point, it is still the case that data protection is not devolved and is covered by the Information Commissioner’s Office in London. Should that be the case? Should the Scottish Government not be pushing to have data protection devolved? I would suggest that the Scottish National Party should be forcing that issue and enabling a situation in which all aspects of data, whether it is high-resolution facial recognition or grainy CCTV, comes under the remit of a Scottish privacy commissioner, who would be completely future proofed.

      • Dr Macdonald:

        With regard to the code of practice, we have a number of statutory codes that we find are a useful tool in our work. They give us flexibility as the landscape changes, because we can amend them—of course, we need to get such amendments approved by the Westminster Parliament. I certainly urge that, if the bill is passed, the codes of practice that the biometric commissioner has should be put on a statutory footing.

      • Liam McArthur:

        Matthew Rice made the point that it is very difficult to start narrow and go wide, but that if you start wide, there is a better opportunity to broaden the scope in due course. Do you agree with that?

      • Dr Macdonald:

        That is right. The codes give you the flexibility to adjust as change takes place. As Matthew Rice also said, the Scottish biometrics commissioner’s terms are a lot more future proofed than those of Professor Wiles. We saw that under the previous data protection regime, which did not allow at all for the electronic and biological advances that have now really been taken in under the general data protection regulation. That is where there is an overlap between the work of this commissioner and my commissioner.

      • Rona Mackay (Strathkelvin and Bearsden) (SNP):

        I would like to probe a wee bit on the earlier part of Liam McArthur’s question regarding the list of those who should be consulted about the code of practice. Judith Robertson, you said that the list could be widened a bit, and that there should maybe be a further consultation. What issues should a consultation with stakeholders cover?

      • Judith Robertson:

        The draft code that was produced by the independent advisory group has been widely consulted on. As I understand it, that consultation was on the basis of it focusing on the criminal justice system. If the scope of the legislation were to be broadened into health, education and other areas where biometrics might be in use, I would contend that the scope of the consultation would have to be broadened to ensure that the job of work that the code of practice does, as it is currently framed, is appropriate and fit for purpose for the broadened scope. That is one aspect.

        The recommendation of the advisory group was that the code of practice should be in the bill, which would have meant that it would have been consulted on as the bill was going through Parliament, in the way that any other bill is consulted on during the legislative process. In addition to the consultation that took place prior to the code being drafted, the code would have been subjected to the general and robust scrutiny that is undertaken as a bill is considered. That has not happened, and therefore an opportunity has been missed to engage a wider audience and the wider public in a debate about the code of practice. Therefore, in the context of the PANEL principles—participation, accountability, non-discrimination, empowerment and legality—which the commission promotes and which underpin human rights law, an opportunity for scrutiny to be undertaken has been lost. That is not to say that the code of practice cannot be included at stage 2 of the bill, when there will be further scrutiny. That would strengthen participation.

        Does that begin to answer your question? Does it get to what we are thinking about?

      • Rona Mackay:

        Yes. It sounds as though the extended remit that you talked about would require more than a part-time commissioner.

      • Judith Robertson:

        Sorry, I did not respond to that bit of the conversation. I completely agree. It might be appropriate for a part-time commissioner to fulfil the function as it is described in the bill.

        There are two ways of looking at the issue, and ultimately it comes down to resources. If a part-time commissioner had a strong code in legislation, to which they were working, and a general understanding was established so that they did not have to do the promotion, which is potentially expensive, it is possible that a part-time role might be enough, because what the commissioner was monitoring and the scope of the actions of the public authorities that they were monitoring would be very clear.

        As soon as that remit is broadened, the scope of the role is massively extended, so there are resource implications. I cannot say more—I am slightly stretching my mandate as human rights commissioner. From my experience, I can say that my role has an extremely broad mandate and full time is not enough.

      • Rona Mackay:

        Does anyone else want to comment?

      • Matthew Rice:

        You asked who should be consulted. Expanding the provisions to include public authorities would engage the Convention of Scottish Local Authorities and its network. We recommend that that be done.

        Although the independent advisory group’s terms of reference specifically focused on law enforcement, the group acknowledged that there were questions—mostly brought up by us, I guess—about the need to consider wider application. I think that the Scottish Government said that it would explore with COSLA and other local and public bodies the potential for voluntary adoption. I do not know whether that recommendation has been followed up or how far such conversations have progressed. COSLA would be the body that one would immediately go to.

        The part-time role issue is tricky. The biometrics commissioner in England and Wales is part time and regulates 40 or so police forces. What is proposed in the bill is a 0.6 FTE who regulates one central police authority. It could be argued that more bodies could be added without stretching the role into a full-time one.

        We should bear in mind that behind all commissioners there are fantastic support staff, who work full time—such as Lucy Bradshaw-Murrow, who works for the biometrics commissioner in England and Wales. It is not as though making the role part time means that the office is unstaffed on Thursdays and Fridays; a team is there, although the figurehead might not be.

        There is a tricky issue to do with how the nature of policing in Scotland maybe changes the regulatory landscape a little.

      • Rona Mackay:

        Given the commissioner’s proposed remit, are there glaring omissions of stakeholders who should be consulted? Police Scotland, the Lord Advocate and the Scottish Human Rights Commission are included in the bill.

      • Matthew Rice:

        Nothing jumps out at me. Paragraph (j) in section 3 most likely refers to broader civil society, and we hope that it does not need to be written in the bill that the commissioner should consult wider members of the public and interested parties. I hope that it is implied that it would be appropriate for the commissioner to go to groups such as the Open Rights Group, so I have no immediate concerns.

      • Rona Mackay:

        Thank you. Sorry—I see that Judith Robertson wants to come back in.

      • Judith Robertson:

        I was just going to say, on reflection, that if you are really thinking about people’s engagement with their article 8 rights to privacy, home and family life, the widest engagement is recommended, because the public really need to understand what is at stake here. I think that that is poorly understood at the moment.

        Whether we are talking about people’s understanding of their article 8 rights, current practice on the retention of data or what consent might imply in these processes, there is a range of aspects that the draft code of practice unpicks—indeed, it is quite explicit about many of those issues.

        For me, making that much more explicit in the bill would mean that the public could identify the code and go straight to it, knowing that it had a basis in law and was supported in that way.

        Obviously, civil society organisations are very good benchmarks and routes into the public, but the Parliament’s having a robust debate about article 8 and the balance and protection of those rights is a really important part of the process.

        10:30  
      • The Convener:

        The commissioner is to be appointed by the Parliament, but the code of practice is to be approved by the Scottish ministers. Do you have a comment to make on that?

      • Judith Robertson:

        You are right. That is absolutely what the bill says, and that is potentially a weakness. If the code was debated, approved and understood by the Parliament and its implications were interrogated through the parliamentary process, that would give better protections. Placing it on a statutory footing would mean that it would be an integral part of the parliamentary process.

      • The Convener:

        Are there other views from the rest of the panel?

      • Matthew Rice:

        I concur with Judith Robertson’s assessment.

      • Al Duff:

        No comment.

      • Dr Macdonald:

        I certainly agree that the code should be approved by the Parliament rather than the Scottish ministers.

        On the consultation on the code, there is a fairly comprehensive list of those to be consulted as the bill stands, and there is some flexibility. The commissioner can choose

        “other persons as the Commissioner considers appropriate.”

        The code certainly needs to go to full public consultation at some stage, as Judith Robertson said. However, in the initial drafting of the code, there is a need to ensure that the commissioner properly consults bodies that have a direct interest in it.

      • The Convener:

        Does Liam McArthur want to follow up that issue?

      • Liam McArthur:

        No. I wove my question into my earlier questions.

      • The Convener:

        Okay. Sorry about that.

      • Fulton MacGregor (Coatbridge and Chryston) (SNP):

        Good morning. What are your views on how the code could address legal issues about where biometric data is held in databases outside Scotland? That issue has been touched on, but only a wee bit. It came up in the previous evidence session last week. I am trying to follow that up.

      • Matthew Rice:

        Will you expand a little on what you mean by information that is held outside Scotland?

      • Fulton MacGregor:

        If biometric data is held within Scotland, it will, obviously, be the responsibility of the commissioner, but what if it is held elsewhere—perhaps in England, another part of the UK or somewhere else in Europe?

      • Matthew Rice:

        Stepping into an already developed legislative environment needs to be handled discreetly. Although the commissioner in England and Wales does not have a role to play in policing in Scotland, they have a role to play in national security in Scotland and in information that would be held by the National Crime Agency specifically. How best to manage that situation is a tricky issue, and I do not have an immediate answer to that. There is the supplementary question of data held in Europe that would be transferred across to the British Transport Police, for instance, such as under the passenger name directive or under anything that might imply people travelling and crossing borders with biometrics attached to it which might be used for law enforcement purposes.

        I hope that the Scottish commissioner would be welcomed into the landscape. There are plenty of advisory groups, including strategic advisory groups, that Professor Wiles and the Information Commissioner’s Office are part of. I cannot say definitively where that would be best placed in the bill, but I hope that the Scottish commissioner would be welcomed into the wider landscape.

      • Dr Macdonald:

        If I recall correctly, the discussion last week was about the Scottish police putting data into the national crime database and the retention periods. In strictly legal terms, that will come down to who the data controller is. I would expect that, in most cases, it would be the Scottish organisation, where it is considering Scottish biometric data, and therefore the Scottish rules of retention ought to apply, even if those data are being held for the organisation’s use by an authority outside Scotland.

      • Fulton MacGregor:

        That is helpful. Does anyone else want to comment?

      • Matthew Rice:

        That is a very good point from Dr Macdonald. Changes are being undertaken in England and Wales in the retention of data in police systems in particular. The police national computer and the police national database are both currently being reviewed; the Open Rights Group is contributing to that process as part of our UK work.

        It is key that Scotland has a really important voice in that process. Responsibility currently sits within the Home Office, and my contributions are as much as I can give in terms of a UK focus. Her Majesty’s Inspectorate of Constabulary in Scotland needs to get more involved in the process, with a focus on Scotland’s good reputation in the retention of biometrics versus the situation in England and Wales.

        As I understand it, the changes that will be taking place are going in a positive direction, so I have fewer concerns about how the approach will transfer over. Ultimately, Police Scotland, as the data controller, would retain governance and control in respect of being able to delete the data, which is obviously an important aspect. The independent advisory group has raised the idea of a presumption in favour of deletion. The key point is that when we move to a UK system, Scottish bodies and policing bodies in particular must be able to delete that data, and it must be deleted rather than replicated on a wider UK system with a different retention period.

      • John Finnie (Highlands and Islands) (Green):

        Good morning, panel. We are looking at legislation, and words are very important. There has already been reference to the code of practice. The bill states that Police Scotland and the SPA

        “must have regard to the code of practice”,

        but goes on to say that

        “Failure to have regard to the code of practice does not of itself give rise to grounds for any legal action.”

        Would you comment on that aspect, please?

      • Judith Robertson:

        We do not consider that wording to be strong enough. The greatest protection would be provided if those bodies had a duty to comply with the code of practice. If the code was on a statutory footing and in the text of the legislation, it would be very clear what they had a duty to comply with, and if the commissioner deemed something to be a deviation from the code, there would be some kind of sanction.

        A discussion on sanctions would be important—I do not know whether we will come on to that. With regard to giving the greatest possible protection to citizens and to the bodies that implement the code, sanctions would ensure that people were held to account appropriately if the code was not applied or if the commissioner deemed there to be problems with the way in which it was being instituted. That would give the commissioner some teeth in the process.

        There are many examples of regulators having sanctions at their disposal. The Information Commissioner’s Office is a strong example, as that body has the capacity to issue a fine. A range of potential sanctions could be added to the bill to strengthen the commissioner’s capacity in that regard. At present, I regard the wording as not strong enough—it could be a lot stronger.

      • Matthew Rice:

        As I understand it, the wording in the bill is “have regard to” because that would not place a requirement to comply on a statutory footing; instead, the code will be considered under secondary legislation or in guidance. As Judith Robertson pointed out, the code of practice is not currently in the bill.

        If we cannot get the code on to a statutory footing, the wording is likely to remain as “have regard to”, rather than providing for a much stronger duty to comply. That takes us back to the point about whether the code of practice can be included in the bill in some form.

      • Al Duff:

        If the committee accepts my premise that we need a fully fledged Scottish privacy commissioner, I think that it might be missing a golden opportunity if it does not revisit the bill to enable something much greater than what is currently in mind.

        That champion of privacy in Scotland would have to have regard to many laws relating to privacy and data protection. In some cases, there would have to be a legal obligation; in other cases, there would not have to be a strict obligation, because a privacy commissioner would be able to shame malefactors—that is, those who abuse data or privacy. There would not have to be legislative machinery. The person would be in the public domain, championing privacy. They would not only be a functionary of one law and they would not just look at technicalities; they would look at the bigger picture. I am shifting the paradigm completely.

      • Dr Macdonald:

        One has to have to regard to rather than follow the codes of practice that are produced by the Information Commissioner. However, I think that there is a distinction between the issues that we face and those that the biometrics commissioner would face. We have to give guidance and highlight good practice on every type of processing of personal data, including biometric and electronic, across the private and public sectors. It is impossible to have a prescriptive code of practice for all situations. However, with the biometrics commissioner’s responsibilities, we are looking at a much more precise and narrow focus of processing. Therefore, I agree with Judith Robertson that the code needs to be prescriptive—it needs to go beyond people having regard to it; it needs to have a statutory basis.

      • Matthew Rice:

        Even if we accept that the secondary legislation would be strong and have good rhetorical flourish, another tricky element is that the primary legislation—the backstop on which the code of practice would rely—does not cover all biometrics. The Criminal Procedure (Scotland) Act 1995 allows for fingerprints or other relevant physical samples that it may be deemed necessary to take, but that does not cover photographic images. If we cannot put on to a primary legislative footing the strong definition of what biometrics means in relation to the commissioner’s role, we will create a strange two-tier system. There will be very strong secondary legislation setting out what biometrics means: it is the function of identifying an individual based on physical or physiological characteristics. However, when we go back to see what a body has responsibility to comply with, we will see that photographic images are not covered. There will be a strange disjunction between the two. If we put a definition in some form on a primary legislative footing, and that definition applied to the 1995 act, we would have future-proofed primary legislation.

      • John Finnie:

        My next question is on a subject that has been alluded to briefly. The bill specifically mentions Police Scotland and the SPA, but it does not mention the British Transport Police, the National Crime Agency, or—nervous though it makes people—the security services, which, of course, operate in Scotland in conjunction with Police Scotland and the BTP. Is there a gap in that respect?

      • Al Duff:

        NO2ID thinks that there is a gap: we believe that the secret services should be accountable, as far as possible.

        We are calling for there to be a Scottish privacy commissioner, but we would not want that to be a stick with which to beat the press; we would want the press to be protected and supported. Indeed, it is historically proven that the press is often the greatest champion of privacy. They have exposed various wrongdoings by the secret services, including extraordinary rendition, in which Scotland was involved because Prestwick airport was used for that purpose. Let it be said that extraordinary rendition is when the US farms out people for torture at black sites, and such things must be stopped. Even if you settle for the proposed narrow role that is set out in the bill—and I suggest that you do not—any commissioner should have that under their remit.

      • Dr Macdonald:

        Some of the issues that John Finnie raises come down to what is devolved and what is reserved. National security is a reserved matter; as Professor Wiles said at last week’s meeting, he has that responsibility UK-wide. It will be difficult to contain those UK-wide elements in the bill without going through other legislative mechanisms, which you are more familiar with than I am.

        10:45  
      • John Finnie:

        Does that apply to the British Transport Police?

      • Dr Macdonald:

        The British Transport Police is a slightly different kettle of fish. Last week, Professor Wiles made a reference to retention if the BTP makes an arrest in Scotland. He said that the appropriate retention regime would be the Scottish one. That makes me wonder whether the BTP should at least be added to the list of consultees. We would not have any particular view on whether the BTP should come within the remit of a Scottish biometrics commissioner.

      • John Finnie:

        Does Mr Rice have a view on whether a Scottish citizen would have regard to jurisdiction if they were the subject of facial recognition measures, or if samples were taken from them, by one of those organisations? Should that be important to them, or would they anticipate that this Parliament would regulate how they were treated? I am genuinely not making a constitutional point; I am trying to understand the overlap that exists across the law enforcement agencies that operate in Scotland.

      • Matthew Rice:

        The British Transport Police jumps out as being unsatisfactorily covered in the bill. When it comes to biometrics, the BTP would have quite a lot of passage—a lot of activity is based on the collection and use of biometrics. We have called for an individual complaints mechanism to be put in place that would allow members of the public to raise concerns about how biometrics have been used. If there is a problem, such as a Scottish citizen being detained at Prestwick and having biometrics taken or used in some way, the pertinent point is where their complaint would flow to.

        The remit of a strong commissioner would cover, say, any policing activity that occurred in Scotland—rather than activity related to the security services or national security, which might be best reserved for the time being. That is based on there being, as we suggest, some public-facing front door for the public to come to in order to raise concerns. If we start to make distinctions, particularly around policing—say between British Transport Police and Police Scotland—we will leave the public confused about what they can rely on the commissioner to do.

      • Shona Robison (Dundee City East) (SNP):

        Good morning, panel. We have touched on the technologies before—Matthew Rice in particular got into some of this earlier. It is accepted that biometric technologies are evolving at a rapid rate and it is hard to predict what they will look like in five, 10, 15 or 20 years’ time.

        Does the bill represent a reasonable attempt to keep up with developments in that area? Is the code of practice all that will be required to deal with the increasing use and changing nature of biometric technologies, or will further legislation be required in future? Matthew Rice touched on whether primary legislation is adequate, but would future technologies require further legislation—either primary or secondary—or can we rely on the code of practice being swift and light enough on its feet to cover changing technologies?

      • Matthew Rice:

        In the Open Rights Group’s assessment, three things can change the dynamics: the technology, which can change hugely; bodies, which can change how it is used; and case law, which can change the way in which something is framed.

        On the technology, the definition of “biometric data” in the bill serves quite well as a future-proofing measure, because it does not necessarily refer to a specific biometric attribute that might not be in use; it refers to any biometric attribute that may come into use. For instance, if gait recognition and speech recognition became part of general policing practice, they would still be caught under the definition. However, the definition would apply under a code of practice that has come in through secondary legislation. Therefore, there is still the need to attend to the Criminal Procedure (Scotland) Act 1995 and subsequent acts to ensure that, where those are engaged, there is reference to a more generic definition of biometrics.

        On case law, although there was a judgment in south Wales that said that the use of automated facial recognition is in accordance with the law as it is currently understood, that judgment had a lot to do with the facts that were involved. Litigation led by Big Brother Watch is in train, but other litigation is still pending, such as Gaughran v Chief Constable of the Police Service of Northern Ireland, which has moved past the Supreme Court and may change the nature of what data can be retained for.

        The commissioner needs to be able to respond to changes in case law. As we are part of a common-law jurisdiction, we will have to be able to react to those. Having codes of practice in secondary legislation that ministers bring forward is good, but that is not the best way to start off, because we still need things on a strong primary legislative footing.

        Finally, there are the bodies. The bill binds the commissioner to looking at policing, and it is quite clear that there are practices that go beyond policing and that public concern goes beyond policing. Over the summer, the Ada Lovelace Institute did some very good survey work in a report called “Beyond face value: public attitudes to facial recognition technology”. I recommend that members of the committee pick that up and perhaps contact the Ada Lovelace Institute about it. The institute showed quite clearly that the public’s concern is not just about law enforcement; in fact, the public have a heightened concern about the use of the technology by private bodies and other public bodies.

        We have done okay with the technology, but we have not necessarily figured out with the bill how to react to case law and to the changing nature of who adopts the technology.

      • Al Duff:

        I would like to put my point again. It makes no sense to me to have a facial recognition commissioner who does not cover CCTV. Images are on a continuum. Facial recognition data is simply more high-resolution picture data than a CCTV image has. Therefore, it makes no sense to have someone solely dedicated to facial recognition technology. We need a commissioner who covers all imagery and all intrusive camera work by whatever agency, including the police, the secret services, the public sector and schools, which are abusing the technology—there is research on that, and pupils do not like being spied on.

        There is a disproportionate use of CCTV. We are not against CCTV or, indeed, facial recognition in some contexts, but we are against the growth of the database society and state.

        We think that that crying need, which the public have expressed many times, needs to be properly met with a proper Scottish privacy commissioner. Canada has such a commissioner, who works alongside—sometimes in tension with, and sometimes co-operating with—the Information Commissioner of Canada.

      • Matthew Rice:

        On Professor Duff’s characterisation of the commissioner as being just a facial recognition commissioner, that is clearly not what we are talking about; we are talking about biometric data, which has a much wider generic definition that touches on other forms of identification. Therefore, we are not talking about a facial recognition commissioner, despite the fact that facial recognition is a topic that probably sits at the front of people’s concerns. We understand the issue to be a bit wider than that.

      • Al Duff:

        I agree, but it does not go down the scale to CCTV, so there is a disconnect. That makes no sense. CCTV issues are the slippery slope that leads to facial recognition issues.

      • The Convener:

        We have already heard that point, which you made very well.

      • Al Duff:

        Thank you. I will not mention it again. [Laughter.]

      • The Convener:

        Okay; thank you.

      • Judith Robertson:

        To some degree, Shona Robison’s question highlights the gap resulting from not having the text of the code of practice in the legislation, and it allows us to have a conversation about that issue. Does the code of practice, as covered in the legislation, give us the required protection? We are not in a position to have a detailed discussion about whether the code does that, because it is not in the bill.

        The purpose of the code is to enable clarity on the protection of people’s rights. The code, as drafted, is robust and has been heavily consulted on. It provides clear principles that allow us to look at a range of interventions, among which biometrics are key. It is a principled analysis that allows us to ask whether people’s rights are or are not being breached.

        An issue that has not been highlighted in this evidence session but which may have been highlighted elsewhere is the presumption of non-retention. That crucial protection is not in the bill, because the code is not in the bill.

        If we are going to legislate, we have to very clear about why we are doing that; the principles in that regard also have to be explicit, and they have to be referred to. Without that—if that clarity is not explicit—we get into all sorts of grey areas and mush That is fundamental.

        It is a chicken-and-egg situation. If the code was in the bill, we could comment robustly on whether it would be strong enough to give protections for the future. I think that it is recognised in the draft version of the code that things will change. Ensuring that there is that capacity to review and re-lay the code is really important, because it needs to be fit for purpose, and its purpose is to protect people’s rights. That is another argument for including the code in the bill.

      • Matthew Rice:

        It is worth bearing in mind that the most significant judgments in this field, whether that be S and Marper v United Kingdom or R (RMC and FMJ) v Commissioner of Police of the Metropolis, came down not to the use of biometric data but to the retention of that data. Often, cases have really turned on the nature of retention and how long something is retained for.

        One of the independent advisory group’s great victories was the promotion of a presumption in favour of deletion. That is key, particularly for anyone who might be concerned about the growth of a database state. This is about whether the system is one in which certain data will be retained. In fact, the database state will shrink at a certain point, because the retention periods would lapse. That is a huge issue. Of course, as I have said, the courts are alive to that when deciding on interference in relation to article 8 of the European convention on human rights.

      • The Convener:

        The bill does not provide for an ethics advisory group, but the Cabinet Secretary for Justice has indicated his intention to establish such a group. My understanding is that the bill would not prevent the commissioner from setting up a group, should they want to. Should an ethics group be set up? If so, who would be best to do that?

      • Judith Robertson:

        There should be an ethics advisory group. The territory is evolving, and it is difficult for one individual to hold all the knowledge that they require to do their job. The group should be set up on a statutory basis. It could sit in the biometrics commissioner’s office, but it would have to be independent. It would advise the commissioner and, I presume, the people who use biometrics to deliver their functions.

        If possible, convener, I would like to comment on the specific powers that the bill grants, or does not grant, to the commissioner. I do not know when you are due to finish and I am concerned about whether I will have the time to do that.

      • The Convener:

        Okay.

      • Al Duff:

        There needs to be an ethics committee; no commissioner could work without one. The issues are difficult and it is very hard to balance all the rights—despite everything that I have said, I believe that the police, and the security services and secret services, have rights. There is no way that all the wisdom can reside in the head of any one individual. I imagine that not having an ethics committee would be an impossibility, or else the system would be autocratic.

        11:00  
      • The Convener:

        In the evidence that we heard last week, Professor Wiles said that he was surprised that the Cabinet Secretary for Justice, rather than the commissioner, is going to set up a committee. He said that there should be an ethics committee, and it should be transparent and open in its findings. I suppose the point that was being made was about the separation from Government and what is seen as independent.

      • Matthew Rice:

        I am not fully sure that the cabinet secretary, in his appearance before the Justice Sub-Committee on Policing, was announcing the creation of a permanent ethics group. It seemed to me that he was referring to something closer to the independent advisory group, which was formed for a temporary period to look at an issue and produce recommendations. We have not heard anything since then about what the terms of reference for such a group would be.

        When I read the Official Report of the meeting, I did not think that an ethics advisory group was being formed then and there by the cabinet secretary. A sensible commissioner, when they come into post, would see that there is a wealth of knowledge across academia and civil society in Scotland that could be drawn on to help with those tricky discussions.

      • The Convener:

        I suppose that it is for us to drill down into that with the cabinet secretary. Does anyone have anything to add?

      • Dr Macdonald:

        The subject of data ethics is becoming increasingly important, given the growth in personal information and the way that it is collected. We would certainly support an independent ethics panel that the commissioner—it would be the commissioner, rather than the minister—can speak to and debate issues with.

      • James Kelly (Glasgow) (Lab):

        One of the commissioner’s jobs is to raise awareness in relation to biometrics and the roles and powers of Police Scotland and the SPA. How can that best be achieved so that the public have confidence in the system?

      • Judith Robertson:

        To be perfectly honest, if you want the public to have confidence in the system, the commissioner needs powers in more areas than simply awareness raising. Awareness raising is useful and important, and it enables people to understand the terms of the debate and what is at stake. It would raise awareness of the discussions that an independent ethics advisory committee would have, which is important.

        However, in my view, that is not sufficient. In order for the public to have confidence in the system, the commissioner would need more powers than a simple awareness-raising power. They would need the power to compel evidence; to enter specific places; to investigate and inquire; and potentially to inspect in a similar way to HMICS. A range of other powers could be explored. We need to ask what will give people confidence that the commissioner has the teeth to be able to ensure that the authorities in question are fulfilling their duty to comply with the code of practice. That would be my first answer to your question.

        As a commission itself, the Scottish Human Rights Commission has a duty to raise awareness. It does a huge amount to raise awareness of human rights, and it is clear that a whole range of tactics come into play in that respect. Awareness raising is important, but it is not sufficient. I would absolutely include it in the commissioner’s mandate but I would strengthen the powers of the commissioner considerably.

      • Al Duff:

        It would be an important part of either the reduced role for the commissioner that you have in mind or the expanded role that I have in mind.

        Raising public awareness of privacy issues is absolutely vital. The Scottish Information Commissioner has shown good practice in that regard. Indeed, as we sit here, Paul Mutch from the Scottish Information Commissioner’s office is lecturing to my 50 undergraduate journalism students, because I am missing the lecture to appear before the committee. He kindly agreed to speak about freedom of information to them, as he has done over several years.

        The Scottish Information Commissioner’s office has done tremendous work to raise awareness of FOI. We need a comparable level of commitment to raising the standard for privacy in Scotland. The biometrics commissioner should definitely have a budget for that.

      • Matthew Rice:

        We can look at another commissioner and how their role is formed. The UK Information Commissioner’s Office runs campaigns such as the your data matters campaign, which is a fantastic way to raise awareness and has shown real returns in terms of the public’s understanding. I feel as if I am speaking on behalf of Dr Macdonald in talking about the ICO, but it is merely as an illustration.

        As part of the ICO’s strategic role, it considers individual complaints mechanisms as an aspect of raising public confidence. Enabling public access to the ICO has been key to its success in raising awareness and confidence. We maintain that having a front door—some kind of way by which an individual can approach the commissioner to raise a concern, with a way to enable the commissioner to address, look at and respond to those concerns—is one of the key functions that gives the public real confidence that they have a commissioner who is not just on their side but on the side of rights and enforceability.

      • Dr Macdonald:

        I welcome what Matthew Rice said—it is good to hear a stakeholder speak up for what the ICO has been doing.

        With regard to our responsibilities on data protection, it is key for individuals to know how their data is being handled, to whom it might be passed on and for how long it might be retained. It is a message that all data controllers, and all organisations that collect data, should give to the data subjects: the people involved. Anything that improves their understanding of what is happening to their information has to be welcomed. What we are discussing is just another element of that.

      • James Kelly:

        To build on Mr Rice’s specific point about raising public awareness and the ability of the public to raise concerns, the bill does not currently contain any mechanism for raising complaints. Should that be examined as the bill goes through the amendment process? That question is also for the other panel members.

      • Judith Robertson:

        Yes. That is one of the means by which you could increase engagement with the commissioner and reinforce their ability to perform what we feel should be their function, which is to monitor and regulate the use of biometric data by Police Scotland and the SPA. That would depend on the purpose of the commissioner’s role being strengthened as well.

      • Dr Macdonald:

        There is potential for misunderstanding between the role of the biometrics commissioner and the role of the Information Commissioner’s Office. We would be the body to which people would come if their information rights had been violated in any way or if they had any concerns that there had been a breach of their rights, whereas the biometrics commissioner would have other responsibilities in reviewing policy and practice. People need to know which is the correct place to go to.

        It is more than 10 years since the Scottish Information Commissioner’s office was set up—it was in 2005, which is 14 years ago, so time is passing—but there is still confusion among people who really should know better. I am talking about civil servants, senior public authority officials and so on confusing the roles of the Scottish Information Commissioner and the UK Information Commissioner’s Office.

      • The Convener:

        We have covered that pretty well. Liam McArthur wants to come in briefly. We will finish at a quarter past 11 at the very latest.

      • Liam McArthur:

        Excellent. I thank Dr Macdonald for not including MSPs in his list of people who may have confused the two roles, as I am sure he was keen to do.

      • Dr Macdonald:

        I could not reveal any personal information about members around the table. [Laughter.]

      • Liam McArthur:

        Living the dream.

        I appreciate that the ICO perhaps provides an example of how individual engagements can help to raise public awareness, although I am sure that you are aware that the previous Children and Young People’s Commissioner got into a lot of difficulty regarding the expansion of that commissioner’s role by advocating a move in that direction, but with very little detail on the implications for resources and staffing. Is there a clear understanding of what such a proposal would be likely to entail for the biometrics commissioner regarding individual engagements and the resulting impact on resources?

      • Dr Macdonald:

        The act governing the Children and Young People’s Commissioner was quite vague as to the areas that the commissioner was to cover—basically, it was anything that had been excluded from anywhere else. That led to debate, and I remember that we raised a number of concerns about that during the passage of the Commissioner for Children and Young People (Scotland) Bill.

        The Scottish Biometrics Commissioner Bill is clearer. There is still potential for dispute between a Scottish biometrics commissioner and ourselves, but you can consider the experience that Professor Wiles related to you last week regarding his engagement with my commissioner. We have a good working relationship. The commissioners meet at senior level and they meet informally at less senior levels on a regular basis.

        To date, there has been no need for any form of memorandum of understanding or anything like that, although we are aware of a couple of issues coming up because of Brexit and exchange between the UK and the other European Union countries that may involve some agreement between us as to where the exact roles differ.

      • Liam McArthur:

        I was just about to commend you for getting to the end of the evidence session without mentioning Brexit. You almost managed it—although you actually mentioned it before the meeting started—but now you have blotted your copybook. That response was helpful, however.

      • Judith Robertson:

        There are a range of ways in which the commissioner’s powers could be strengthened. An individual complaint mechanism is one way. For the commissioner to fulfil the duty of investigating, monitoring or ensuring compliance with a code of practice, they would require more powers than the bill currently gives them. It is a matter of adopting that strengthening perspective and acknowledging the resource implications. To be honest, there are resource implications from any power that is attributed to an authority such as ours, as we know.

        The important thing for the Scottish Human Rights Commission is that the commissioner has a range of tools in his or her toolbox, depending on the circumstances. Over time, we would be able to see which tools have had the most impact, which ones have been most effective and which ones the commissioner has been able to employ to hold authorities to account and to enable monitoring, data gathering, understanding, the facilitation of an independent advisory group and so on. All of that has resource implications.

        I agree with you about the individual mechanism, but there are a range of ways in which it could be strengthened, and it would be good to see some of those in the eventual legislation.

      • Liam Kerr:

        Concerns have been raised about the accuracy of biometric technologies, in particular facial recognition. How valid are those concerns, in your view? What steps would you envisage the commissioner taking to ensure that the biometric technologies that are used are fit for purpose?

      • Matthew Rice:

        That is a well-documented issue. The systems are trained on data sets, so there is a question about what data we are putting in to make the decisions before the technology is even released for use with the wider public. Accuracy issues should be dealt with in the development of the systems, rather than improvements being made when they are being used with the general public. Fantastic work has been done by those focusing on the Metropolitan Police roll-out, which has many false positive rate issues.

        11:15  

        As for what the bill might address, the independent advisory group looked at accuracy as a principle that needs to be embedded in the code of practice. That could be done in a specific way, through what we might call a technological kitemark that would say that a system could not go out unless it had been trained on a data set that had, say, a particular level of diversity. For the independent advisory group, the important point was that it would carry a principled view in relation to determining accuracy.

        At the moment, assessments in England and Wales are less about the accuracy of a measure than they are about its proportionality. Therefore, that principle has not been embedded in the use of facial recognition by South Wales Police and the Metropolitan Police. Accuracy has not been a determinative factor there, because it is not actually in play. The fix there is that accuracy is a principle for the commissioner to address.

      • Al Duff:

        It is not long since facial recognition software determined that 20 members of the US Congress were criminals—although those were all false positives, I hasten to add. However, the level of accuracy is changing. We must be aware that, sooner or later, all cameras will be fully accurate. There might be difficulties now, but we are moving towards a position in which there will be complete accuracy. Therefore I do not think that we can currently frame any legislation on the basis of accuracy.

        We must assume that, sooner or later, there will be complete recognition and we will be completely exposed. We must envisage that destination when we set up laws and codes of practice now. It is only a matter of time before all such technicalities will be resolved.

      • The Convener:

        As members have no further comments, that concludes our questioning. I thank the panel for a very worthwhile evidence session.

        I suspend the meeting for a change of witnesses and a comfort break.

        11:17 Meeting suspended.  11:21 On resuming—  
    • Contingency Planning (Brexit)
      • The Convener:

        Item 3 is an evidence session with senior officers from Police Scotland on their contingency planning in response to the UK’s departure from the European Union. The committee has received written submissions from the Cabinet Secretary for Justice, the Crown Office and Procurator Fiscal Service and the Scottish Prison Service. I refer members to paper 3, which is a paper by the clerks, and paper 4, which is a private paper.

        I welcome our witnesses to the meeting, who are Deputy Chief Constable Will Kerr and Detective Chief Superintendent Patrick Campbell of the specialist crime division, both of Police Scotland. I thank them for providing written evidence in advance of our meeting. That includes a report on Brexit planning that Police Scotland previously provided to the Scottish Police Authority board and has now submitted to the committee, which is extremely helpful.

        DCC Kerr, I understand that you would like to make a short opening statement. Is that correct?

      • Deputy Chief Constable Will Kerr (Police Scotland):

        With your indulgence, convener.

        Good morning, members of the committee. Thank you very much for the opportunity to come and speak to you today. At the outset, I make the fairly obvious point that, although there is a complex set of planning assumptions around what has become known as Brexit, and operational plans exist to mitigate the risks that are associated with it, there are still a lot of unknowns, so it is very difficult for us to predict all the scenarios that we would like to. Not being able to predict everything with the degree of certainty that we would like is an uncomfortable position for us in policing.

        I have three very brief observations, which I hope will set out the general context. First, Police Scotland’s planning for and operational response to Brexit has highlighted the benefits of having a single national service. The ability to plan across the country, and to set up intelligence support provisions and the operational assets that we need—including a force reserve of 300 officers that can move flexibly to any part of the country, supported by local, visible community teams that are still strong—has been a bonus for us over the past six to 12 months as we have been planning for Brexit. It has given us capacity and flexibility. One of the biggest operational risks that we have—not least at this time of year, as we enter the winter season—is what we call operational concurrence, which just means a lot of things happening at once. I would be very happy to talk about those risks in detail later in the meeting if members wish me to do so.

        We also recognise the public concern that clearly exists around the UK’s exit from the EU. As you highlighted in your introduction, convener, every month, we go to our accountability body, the SPA, to talk as openly as we can about what the police service is doing, our concerns, what we are planning and the mitigations that we are putting in place to protect communities across Scotland.

        Secondly, I am now in my 31st year in policing and have been very fortunate to have worked in many different parts of these islands, including in Northern Ireland and London, before I came to Police Scotland. I can say, without hesitation, that the partnership arrangements in Scotland are more mature than the ones that I have experienced in other jurisdictions. Those include the strategic resilience partnership that is chaired by the Deputy First Minister, the local resilience partnerships and the arrangements and relationships among local authorities, police and other category 1 responders under the Civil Contingencies Act 2004.

        That becomes important as we try to manage the relationship between operational plans and practical delivery. It is easy to have a plan on a piece of paper; it is a lot more difficult to ensure that it works in practice. Those plans have been regularly road tested over the past six months. The multi-agency co-ordination centre, which is housed in a police facility at Bilston Glen, is a very good example in that context, and I would be happy to talk about that in detail if members want me to.

        Finally, one of our biggest concerns is the unpredictability of the environment that we currently face in respect of the reaction of the public to rapidly evolving and changing events. In that rapidly changing environment, words and behaviour matter, and the importance of temperate and responsible language and behaviour from people in positions of civic leadership—politicians and anybody who has leadership responsibility in Scotland and more widely—cannot be overstated. People are entitled to express strongly held views, and it is obvious that there is a range of strongly held views on Brexit. Police Scotland will protect the right to express strongly held views, but those views must be expressed peacefully and lawfully.

        I end with that obvious point because some of the issues that we have seen recently and some of the language that has been used make it more difficult to police the environment. It is very important that we have an open and transparent debate about that issue, as well.

      • The Convener:

        We will go straight to questions.

      • John Finnie:

        Good morning, panel. Thank you for that update, DCC Kerr, and for your written submission, which is, as the convener said, very helpful.

        I know that colleagues are going to ask about deployment. Will you set out for the committee the background to the force reserve and the number of officers involved in that, and say whether that reserve was specifically set up as a response to Brexit?

      • Deputy Chief Constable Kerr:

        Obviously, in our planning arrangements for Brexit, we were concerned about the increased likelihood of disruption or disorder—I hope that there will not be the latter—and the need to have a flexible asset that we could move about the country as and when we needed to do so. Therefore, I decided earlier in the year to create a force reserve, which has 300 police officers who are formed into 12 public support units. Those are self-contained public order units that can be moved flexibly across the country as the need arises and they are forward based in the east, the west and the north of the country at Jackton, Redford barracks, Oakley, Dundee and Aberdeen. I stood them up in February and March this year and again with effect from 5 August, principally to deal with Brexit-related matters. We have not had any Brexit-specific disorder to date—thank goodness—so they have been gainfully employed carrying out a range of other duties, such as policing parades and associated issues in Govan, dealing with environmental protests and dealing with normal serious crime warrant execution. They were deployed more than 500 times in August alone—that is covered in the submission.

        There is a bit of a trade-off for us, because we are abstracting from local police divisions to create a force reserve that is used to police events that we would have had to police and abstract for anyway. What we wanted in Police Scotland was the flexible facility of having a large reserve that we could move about to keep different parts of the country safe as and when the need arises. We have pushed around 120 officers out from middle and backroom functions to work in front-line policing again to try to minimise the impact of the force reserve on local police divisions.

      • Liam Kerr:

        I want to stick with John Finnie’s line of questioning, if I may. You talked about 500 deployments of the reserve in August. Can you say at this stage whether any of those deployments were Brexit related?

      • Deputy Chief Constable Kerr:

        Only tangentially and not directly. There was a range of other duties. I suppose that the difficulty at the moment is that there is a growing range of protest activity across the country, and issues can sometimes be conflated. We end up with environmental protests, protests for and against independence, and protests on a range of other issues, and there may sometimes be some protesters on Brexit-related issues in those groups. We police the event, but it is sometimes hard to discern, decipher and disaggregate what the cause or the issue is. Sometimes that is more obvious than it is at other times. However, the straight answer to the question is that there has been very little Brexit-related demand for the force reserve to date, but it is there as an asset in case we need it.

        11:30  
      • Liam Kerr:

        Should Brexit result in the force reserve being used specifically to deal with related incidents, what would be the impact on day-to-day policing across the country?

      • Deputy Chief Constable Kerr:

        We have been very concerned about that issue. As I indicated to John Finnie, we have been pushing out some officers from middle and backroom functions to support local policing. I cannot in all honesty sit here and say that, if there were a protracted period of disorder and disruption, that would not impact on local policing. Of course there would be an impact—common sense tells us that.

        By setting up the force reserve, we are trying to get ahead of the curve and manage that resource so that, with a single central command and control function—we have set up a multi-agency co-ordination centre at Bilston Glen—we can move that asset about the country as and when we see fit. We have already seen a lot of operational dividends from that approach, whether in relation to extension rebellion protests in Edinburgh or in dealing with parade-related disorder in Glasgow in the past couple of weeks. There has been significant operational benefit from having that function available.

      • Jenny Gilruth (Mid Fife and Glenrothes) (SNP):

        Good morning. I will follow up Liam Kerr’s line of questioning on Brexit. DCC Kerr alluded to recent sectarian incidents in Glasgow. It has been suggested that Brexit is acting as a catalyst to fuel such behaviour. Terrorism expert Kevin Toolis said:

        “Somehow Brexit has unleashed these forces that were dormant. The tragedy of Brexit is that we have lost a national consensus.”

        What communication has Police Scotland had with colleagues in Northern Ireland about that issue?

      • Deputy Chief Constable Kerr:

        A lot. I spent the first 27 years of my policing career in Northern Ireland, and I still have a lot of professional contacts in the country.

        There is always a risk at a time of political uncertainty and fragility that those at the extremes will look to exploit that situation, and we have seen evidence of that recently. We established at the outset and are still maintaining an EU exit intelligence cell, so that we can do what you would expect us to do on your behalf, such as open-source monitoring, looking at social media commentary and looking at some of the groups that may be on the extreme fringes and may be more inclined to get involved in disorder. Part of that intelligence overview and work involves reaching out daily to colleagues in Northern Ireland to see whether there is any associated risk across the Irish Sea.

        There are some risks. I suppose that we could describe them as proxy symptoms. A rise in hate crime would be one example. We have not seen that in Scotland, unlike our colleagues in England and Wales. We are grateful that that is the case, and we are working very hard to maintain that position.

        Frankly—I hope that this gives you a sense of perspective in answer to your question—it is not the high-end disorder that concerns me most. I hope that I will not be proved wrong about that but, if that happens, we will deal with it, as you would expect. Rather, it is the low-end disruption that might come from people being genuinely annoyed at large queues at the borders and ports. If an image of an empty shelf in a supermarket goes viral, all of a sudden, in two to three days, we could end up with protests or concerns expressed at supermarkets about food or fuel shortages. That stuff is incredibly resource intensive for us to police. That is not high-end disorder; rather, it is just about people who are genuinely worried or concerned. Social media aids that—flash to bang sometimes takes only 12 to 24 hours. We are more concerned about that aspect than we are about anything else.

      • Jenny Gilruth:

        As politicians, we have a responsibility to conduct ourselves appropriately and to use responsible language, which is an issue that you have mentioned. On that point, only yesterday, Conservative Party chairman James Cleverley said that Brexit is a “warning shot” and argued that “democracy breaks” if votes are not respected. You will be aware that the Prime Minister has been criticised previously for his use of language. He has accused those who support remaining in the European Union of betraying the people; he has also described those who are trying to block Brexit as being surrender operatives and the Benn legislation as the “surrender act”. Is that dangerous political rhetoric stirring civil unrest in the background? Is it feeding into the narrative of the low-level behaviour that you have mentioned? Is that spilling out into greater disruption more broadly?

      • Deputy Chief Constable Kerr:

        I will let politicians deal with the political commentary of politicians about other politicians. However, I reinforce what I said at the beginning: we all have a responsibility to use temperate and responsible language. At a time of heightened emotional and political tension, words and behaviour matter. They have an impact on the behaviour of people on the street, and we all have to exercise restraint, caution and responsibility, to make sure that those words do not manifest in behaviour and are not used as an excuse or justification by people in the extremes who are looking to engage in violence or disorder.

      • John Finnie:

        Earlier, you touched on the testing and exercising of command, control and response arrangements with resilience partnerships. Will you expand on that? Who is involved, and what scenarios are being played out at training and exercise events?

      • Deputy Chief Constable Kerr:

        I am happy to give the committee a bit of flavour on that. As I said at the beginning of my remarks, it is hard to predict what might happen under every Brexit scenario. Almost daily, just when we think that we could not be more surprised, a different set of circumstances arises. In my opening comments, I mentioned the relationship between the strategic resilience partnership and the local resilience partnerships in Scotland. A sub-group of the strategic resilience partnership deals specifically with co-ordination and partnership arrangements among the agencies to which Mr Finnie has referred. It is chaired by Assistant Chief Constable Mark Williams, who is one of Police Scotland’s most senior officers, and in the past six months has been working on a range of tools, from risk mitigation templates to preparedness checklists, which are updated regularly.

        Last night, I was reading through the detail from the EU sub-group. It has been testing and exercising in five areas, including information flows, communications and reporting, to ensure that we are sharing information on a timely basis. The value of the multi-agency co-ordination centre is that everybody is housed in the same place, so they can just talk across their desks rather than having to rely on information technology systems that might not be mutually compliant.

        We are looking at the impact of concurrent risks alongside EU exit activation—that is the sort of language that is being used around operational risk mitigation at the moment—because we are worried about lots of things happening at once. We are entering the winter, when there might be bad weather or we could end up with an outbreak of seasonal or pandemic flu. We are also coming up to Halloween, which has associated policing challenges. All those things could be happening at the same time as the UK’s exit from the EU, so they are all concurrent risks that add up to a significant compound risk. We might have to involve health and social care partnerships to ensure that we can protect the vulnerable—not least in rural areas. There will be consideration of the recovery phase and also simple awareness sessions for partners, senior officers and local authorities. Therefore a range of testing is going on in October. For example, on 3 October Scottish Government exercise crossbill will test policy areas, interaction with the Scottish Government resilience room—SGoRR—and the information flow, to ensure that information would start to flow at local level. We will then go through a process of building that up through local authorities in their regions, up to Government and national level, to ensure that those systems and information flows are working as well as they can. Lots of testing is going on, but the situation is still unpredictable in parts.

      • John Finnie:

        I appreciate that the approach is wide ranging. Is the UK Government represented on the resilience partnership?

      • Deputy Chief Constable Kerr:

        It is not represented on the one in Scotland but, as the committee would expect, there is a significant amount of connection and engagement with our partners south of the border. For the purposes of this meeting, I am talking specifically about Scotland’s preparations.

      • John Finnie:

        Are any of the UK agencies represented on that partnership?

      • Deputy Chief Constable Kerr:

        Yes, they are. When we are dealing with health and social care arrangements there is a range of connections with down south. In policing, we have strong connections through the national police co-ordination centre—NPoCC—and we also have daily contact with our respective partners south of the border.

      • John Finnie:

        I ask that because there have been well-documented concerns that information has not necessarily been shared at Government level. What is the impact of that? It would surely have implications for issues such as continuity of medical supplies.

      • Deputy Chief Constable Kerr:

        To give you the honest answer to that question, we have probably been more informed than involved in the mainstream planning assumptions at UK level. As the committee would expect, we have been much more integrated into the approach in Scotland. I say “mainstream” because we have had to reach out to policing and other colleagues in England quite a bit. At times, those assumptions have tended to be centred on London or the south of England. We have constantly had to assert and reinforce the particular needs of Scotland, which has different legal and constitutional arrangements, to ensure that whatever is put into place at UK level reflects those differences, because the assumptions have not always done so.

        We have also struggled at times to get access to the more sensitive elements of those planning assumptions. Last Friday, the chief constable went to a meeting in London at the Home Office, chaired by the permanent secretary, to make that point and to assert our need to get access to all that information. He is flying out to The Hague this morning, with the director general of the National Crime Agency and the commissioner of the Metropolitan Police, to make the same point. We need to assert the needs of Scotland in those planning arrangements, as well as the distinct differences that we have in this country.

      • John Finnie:

        So, there is a genuine concern that the dearth of that information might affect your planning and the ability to provide resilience.

      • Deputy Chief Constable Kerr:

        I do not want to exaggerate and say that it has been a significant concern, but it has been a partial concern, not least around the availability of the more sensitive elements of those planning assumptions and how quickly we get them.

      • Rona Mackay:

        In the event of a no-deal Brexit at the end of this month, we will no longer be members of Europol and we will not have access to the European arrest warrant, which has been used successfully in the past. We have been able to arrest people within four hours in other European countries. How much of a concern is that? Is there anything that could take its place?

      • Deputy Chief Constable Kerr:

        It is a big concern. DCS Campbell will talk you through the details.

      • Detective Chief Superintendent Patrick Campbell (Specialist Crime Division, Police Scotland):

        We have concerns about contingency planning. In the event of no deal, we will lose 36 EU measures and tools. We are now planning for that with other UK law enforcement partners, and that has been on-going for the best part of 18 months. There is no doubt that we will move towards a slower, less effective, more bureaucratic process and a significant reduction in capability.

        On the main headlines, the contingency processes that we have built up with our UK partners are around the loss of the European arrest warrant. Rona Mackay rightly pointed out how successful that has been in the past. In Scotland, we execute between 120 and 150 warrants per year and, throughout the UK, there are about 1,400 to 1,500 per year, so the loss of that capability is significant.

        We have been working with the Crown Office, and we have built in a parallel process around the 1957 European Convention on Extradition, which gives us the power, under Interpol notices, to seek extradition. The process will be far slower than we have with the European arrest warrants. With European arrest warrants, if we put our hands on someone across EU states, it is sometimes days before we can bring them back. With the extradition process, that will take months. It will be slower and more bureaucratic, but we will still have that power. That is what we are preparing for now.

        Come 31 October, we will leave Europol. We will physically leave that building and, thereafter, we will have to apply to get back in. Europol will be a significant loss. I could be underestimating the problems that that will cause us. The facility that we have at Europol, of picking up a phone and speaking to our law enforcement partners across Europe, will go. As I said, we will have to apply for re-admission to Europol. We have been told that it could take weeks or months to get back in there; if we get back in, it would be under third-country status, similar to the USA or Canada. Again, there are challenges with that.

        Another concern is the loss of powers regarding Eurojust; the joint investigations that we have with some of our EU partners will fall at that stage. It is a challenging arena. We would lose access to systems and automatic processes that we have in place with our EU partners. Reduced operational consistency with EU member states is also a concern. We would have no direct access to EU intelligence systems, so we would lose the powers that we have at present.

        Let us be clear: the model that we are moving towards for a no-deal scenario will significantly impact on our ability to keep the communities of Scotland safe.

      • Rona Mackay:

        That definitely sounds like a step backwards in your operational capability.

      • Detective Chief Superintendent Campbell:

        Yes.

      • Rona Mackay:

        Are you aware of any negotiations that might allow us to continue using those tools in the event of a deal—whatever that might be?

      • Detective Chief Superintendent Campbell:

        Yes. If we have a deal, there will be a transition period, so we would keep the 36 EU tools until December 2020, which would give us more time to negotiate the additional processes that we might need to put in place.

        11:45  
      • Rona Mackay:

        That is helpful.

      • The Convener:

        Are there any ways that the issues that you have outlined, which sound extensive, can be mitigated in the event of no deal?

      • Detective Chief Superintendent Campbell:

        Yes. As I said, with our UK law enforcement partners, we have built in processes around contingencies for the loss of all the measures, so there are fallbacks in respect of those measures. However, they are more bureaucratic and far slower, and that is one of the great challenges. One fallback is to use Interpol, so we have put an officer from Police Scotland into Interpol, to give us that additional capacity across Europe as we move forward.

      • The Convener:

        That example is helpful, because the situation sounded bleak and we do not want to be alarmist. We will not be left in a vacuum. There is something, although it is not as good as we have at present.

      • Shona Robison:

        DCS Campbell, what you are saying is concerning and bleak. Are you saying that, in 30 days’ time, in the event of a no-deal Brexit, the ability to arrest criminals within hours will go?

      • Detective Chief Superintendent Campbell:

        Yes. For example, we are looking for a number of criminals across Europe who are wanted on European arrest warrants. With the Crown Office, we have built in a parallel process around the Extradition Act 2003, which allows us still to put hands on and arrest those individuals. The process of bringing them back to Scotland will be more troublesome and bureaucratic, so it will be a lot slower than it is now. For example, with a European arrest warrant, once we arrest people, they are returned to the UK in about 10 days. We anticipate that that will become months.

      • Shona Robison:

        That is concerning.

      • Fulton MacGregor:

        Specifically for Scotland, do you agree that the scenarios set out in the UK Government’s operation yellowhammer document are the worst case?

      • Deputy Chief Constable Kerr:

        There has been a lot of commentary around the operation yellowhammer planning assumptions. They are not predictions. They are based on the worst plausible—not the most likely—manifestation of risks. That might seem like a semantic distinction but it is an important one, not least when it comes to reassuring the public, when they read the list of things that might happen. However, those things might happen, because they are possible.

        For policing purposes, we used the Civil Contingencies Act 2004 to make our definition of a major incident or emergency. We road test scenarios with partners, to make sure that we can respond quickly and effectively in communities across the country.

        Do we think that all those things are likely to happen? No—but some of them might. Therefore, we are trying to mitigate those risks as well as we currently can. As I have said a couple of times, our biggest operational risk is for lots of those things to happen at once—the so-called concurrent risk scenario. It is not a great time to be leaving, because it will be winter. A range of other challenges come with that, such as Halloween. We talked about seasonal pandemic flu and a range of other on-going policing issues.

        We have been trying to mitigate those issues by uplifting our international bureau. Patrick Campbell has talked about some of the tools that we will use. The situation is deeply concerning to us. If people have committed offences against Scottish citizens, we want to get them back into this jurisdiction quickly. We have had to more or less triple the size of our international bureau to more than 40 officers, in order to make sure that we can share intelligence in a timely manner. We have added 25 per cent to our border policing command—another 60 officers—to make sure that we can control the flow or disruption at ports and airports. Those are officers who would have been doing other things, whom we have had to put into those teams in order to mitigate the risks.

        We are trying to be sensible. We are working hard to identify a range of risks and work with partners to mitigate them but, if a number of them happen at once and over a protracted period, that will be a challenge for us.

      • Fulton MacGregor:

        It sounds as though you are working hard to put in plans, in a situation that is free-flowing and not of your making. When the plausible worst-case scenarios for the operation yellowhammer document were being developed, was Police Scotland consulted ?

      • Deputy Chief Constable Kerr:

        As I outlined to John Finnie, the honest answer is that we were informed but not consulted about the UK mainstream planning assumptions. As I said, we are closely involved with the Scottish Government planning assumptions that fell out of those broader UK planning assumptions. We got them. As I said, we are concerned that we are not getting access to some of the sensitive tiers of information and, as you would expect, we are pushing hard to make sure that we get that access. In Scotland, the relationships that we have with the partners is as mature as I have seen it in any other place, and I say that after 30 years of doing this job.

      • The Convener:

        In relation to operation yellowhammer, competing demands on Government agencies could put enforcement and response capabilities at risk. You have covered some of the borders issues but what is Police Scotland’s role and what does it envisage doing in response to the examples that have been raised, including illegal fishing and, more generally, smuggling?

      • Deputy Chief Constable Kerr:

        Over the past months, there has been a lot of discussion about the fisheries issue. We have to be pragmatic about what we can realistically do 12 miles off the shore. We are working closely with Marine Scotland on sensible risk assessments and deployment protocols. From 21 October, Marine Scotland is putting a full-time liaison officer into the multi-agency control centre that we set up, so that we can share information and talk to each other as and when we need to. However, as far as fisheries specialist capability is concerned, we have also made it clear that we do not anticipate that we will be putting police officers on trawlers that are 10 or 12 miles off the shore—in the North Sea in November, that is not proportionate or practical. However, we will have to manage those events somehow, not least if somebody reports crimes to us when they come back to shore. A lot of discussion is going on at the moment. In some of those areas, we are trying to balance aspiration with realism.

      • Liam McArthur:

        You talked about the strain on existing resources. The size of our prison population is an area where the strain is already becoming unbearable. I suspect that custody capacity is also under serious strain. In relation to the custody capacity and the knock-on through the courts and the prison estate, what assessment has been done of the potential impact of some of the disorder that you have talked about?

      • Deputy Chief Constable Kerr:

        Over the past couple of months, there have been a lot of discussions, led by the policing division of the Scottish Government, with other criminal sector partners, not least the Crown Office and the Scottish Prison Service, about what we do with people in the advent of mass arrest. We have detailed comprehensive contingency plans in policing, with a menu of tactical options. If we end up with a surge of hundreds of arrests, either planned or unplanned—spontaneous and on the scene—we can move our cellular custody provision around the country. There are things that we can do to mitigate the risk.

        Obviously, at the moment, there is a significant issue with the prison population in Scotland. If we end up with hundreds of arrests, we will have to look at alternative judicial measures to make sure that we do not exacerbate that problem. A range of considerations are being discussed at those meetings to make sure that we can mitigate that.

        I say all that to reassure you that discussions are taking place on what we can sensibly do to manage that risk if it arises. I also need to be honest; if we end up in a position in which there is protracted disruption and disorder and we make hundreds of arrests, of course that will affect somewhere else in the rest of the system. There is no way that we can avoid that. To an extent, we can mitigate the risk but if we end up with a significant period of disorder that we do not foresee and that intelligence does not indicate is likely, it will have an impact on normal business.

      • Liam McArthur:

        However, you believe that, across the country, there is sufficient custody capacity, although individuals could potentially be moved around and accommodated far from where the arrest has taken place.

      • Deputy Chief Constable Kerr:

        Yes, absolutely. We will have to be pragmatic about it.

      • Liam McArthur:

        I would not expect you to speak for the Crown Office, but from your discussions with it, is there an expectation that there would be diversions away from custody for the simple fact that there is not at the moment the capacity in the prison estate to cope with any further bulge?

      • Deputy Chief Constable Kerr:

        Absolutely. Those are exactly the conversations that are going on with the Crown Office at the moment: how can we sensibly deal with the full spectrum of disposals for people involved in low-end disruption or disorder? There may be alternative disposals to prosecution that we can apply, which do not involve custody. As you can imagine, we are having those conversations with the Crown Office every week.

      • John Finnie:

        DCC Kerr, the committee is fully aware of the steps that Police Scotland has taken and we understand some of the background to the centralisation of custody facilities. Are you looking at the reuse of discarded premises as a contingency measure? There are a number of locations that housed prisoners, historically, although it is more centralised now. Is that one of the options that you are looking at?

      • Deputy Chief Constable Kerr:

        Redundant capacity will definitely be one of the tactical options that we will have to dip down into if we end up with hundreds of arrests. That poses its own challenges around health and safety provisions and full compliance with recent HMICS inspection recommendations on custody provision. However, as I have said a number of times, if we end up with hundreds of arrests we will just have to be pragmatic. The short answer to John Finnie’s question is yes; if we end up in that scenario, the tactical options include using some redundant estate, but only what is up to a sufficient level and quality that we will not breach any health and safety rules.

      • John Finnie:

        That is reassuring.

      • Liam McArthur:

        Are you taking advice from HMICS and human rights experts about the use of that redundant estate? Nobody underestimates the challenge that you will face in dealing with potentially serious situations if there is an upsurge in civil unrest. However, the concern is that, if you hold people in custody in facilities that fall below a certain standard, any likelihood of you taking forward cases in due course will be undermined. Are you taking that advice?

      • Deputy Chief Constable Kerr:

        I am not aware of the detail, although I am sure that we are taking that advice. I can give you an absolute assurance that we will not house detained persons in sub-standard accommodation where there is any risk to them.

      • The Convener:

        It is worth saying that the committee received a submission from the COPFS and the prison service that looks at the various scenarios and their impact on our courts and prisons. The committee has found that very helpful.

        James Kelly has our last question.

      • James Kelly:

        Police Scotland stated that £8 million has been spent so far on Brexit. Has that money been allocated to the Police Scotland budget by the Government specifically for Brexit preparations or has it been found from other areas of the budget?

      • Deputy Chief Constable Kerr:

        The figure is £8.9 million, as of yesterday. It has not been specifically allocated to the Police Scotland budget, but we have a welcome undertaking from the Scottish Government that it will pay up to £17 million of additional costs incurred by Police Scotland for Brexit-related duties in this financial year.

      • James Kelly:

        Which areas of the budget has that £8.9 million been drawn down from, given that you have not been given a specific Brexit allocation at this time?

      • Deputy Chief Constable Kerr:

        It has not been drawn down from any other area of the budget. What is happening is that it is growing the deficit this year. Effectively, we have a post-dated cheque from the Scottish Government. We can spend up to £17 million on Brexit-related duties this year, if we need to, and the Scottish Government will cover that bill.

      • Liam McArthur:

        In your response to John Finnie’s first question on the force reserve, you explained its establishment and the rationale behind it and said that, in recent times, it has been deployed in response to Extinction Rebellion protests, other environmental protests and sectarian protests. Is the force reserve establishment and operation included in the calculation of the £8.9 million? To some extent, it would seem counterintuitive to allocate that to Brexit, certainly at this stage, given the deployments over August that you have talked about.

        12:00  
      • Deputy Chief Constable Kerr:

        Absolutely. That is a really important question and I am grateful to you for asking it. There can be some confusion around that issue and we rightly have the discussion every month with the Scottish Police Authority.

        As part of our deficit reduction plan that was agreed through the Scottish Police Authority with the Scottish Government a couple of years ago, it was intended that we would have to reduce capacity in terms of pure numbers by 100 last year and 300 this year, in order to meet the meet the budget deficit reduction target. The chief constable rightly made the decision that, if he dropped the number of officers by 400, he would not have the operational capacity to maintain a resilient police service that would be able to respond to the needs of Scotland during uncertain times and respond to the various challenges and risks that come with Brexit. He therefore made a decision not to downsize Police Scotland by those 400 officers and it is essentially the cost of doing so that has accrued to £8.9 million to date. The cost of those 400 officers annualised over this financial year adds up to about £17 million. Effectively, the cost is the cost of maintaining the capacity in Police Scotland to respond quickly and flexibly to the needs of Scotland as and when there is a risk associated with Brexit.

        Of course, in the interim, and by starting up the force reserve, the police are engaged in lots of other duties across the country. However, the cost is a capacity cost.

      • The Convener:

        That concludes our questions. There is obviously anxiety about what is going to take place, and I thank the witnesses for the measured way in which they have given the reassurance that every possible scenario is being looked at. That is very helpful for the general public, as well as the committee.

        We will suspend briefly to allow the witnesses to leave.

        12:02 Meeting suspended.  12:02 On resuming—  
    • Delegated Powers and Law Reform Committee Consultation (Referral Criteria for Scottish Law Commission Bills)
      • The Convener:

        Agenda item 4 is consideration of a response to the Delegated Powers and Law Reform Committee on its request for views on the procedure for Scottish Law Commission bills. I refer members to paper 5, which is a paper by the clerk. I invite comments from members.

      • John Finnie:

        It is interesting that the DPLR committee wishes to maybe expand its remit. I have not served on the committee, nor would I necessarily want to serve on it. Something was mentioned about the DPLR committee potentially looking at defamation, which would be particularly unfortunate, because we have done the preparatory work in that regard and have held some discussions. Although I understand some of the frustrations around the DPLR committee’s limited remit, we would have to exercise some caution if something that obviously fell within the remit of this committee was not considered by this committee.

      • The Convener:

        The DPLR committee certainly plays an important role in looking at the technical details. Are we broadly content with the status quo?

        Members indicated agreement.

      • The Convener:

        Thank you.

        Our next meeting will be on Tuesday 8 October, when we will continue taking evidence as part of our pre-budget scrutiny of the Scottish Government 2020-21 draft budget, with a focus on funding for the Scottish Prison Service.

        We now move into private session.

        12:04 Meeting continued in private until 12:28.