Scottish Biometrics Commissioner Bill

The Convener

Our next item of business is to take evidence at stage 1 of the newly introduced Scottish Biometrics Commissioner Bill. I welcome to the committee the Scottish Government’s bill team. This is an opportunity for us to find out more about the purposes of the bill, which we will scrutinise in more detail. We have with us from the Scottish Government Elaine Hamilton, who is the bill team leader; Euan Dick, who is deputy director of the police division; and Louise Miller, who is from the directorate of legal services. I refer members to paper 2, which is a note by the clerk. I ask Elaine Hamilton to make some opening remarks on the bill. We will then move to questions.

Elaine Hamilton (Scottish Government)

The purpose of the bill is to put in place new oversight arrangements for collection, use, retention and disposal of biometric data in the context of policing and criminal justice. By “biometric data”, I mean fingerprints, DNA, other data that are currently being developed, such as facial recognition software, and any other forms of data that might emerge in the future that we cannot even imagine just now.

The oversight arrangements will focus on the creation of a new biometrics commissioner, who will have a range of functions. The oversight arrangements will apply to Police Scotland and the Scottish Police Authority. The bill allows a power for Scottish ministers to insert additional bodies, if that should be required in the future.

To ensure the impartiality of the postholder, the commissioner will be appointed by the Crown on the recommendation of Parliament. The commissioner will be accountable to Parliament for the performance of his or her functions and expenditure.

The need for independent oversight arises from the ethical, legal and human rights considerations that are associated with the use of biometric data. It is vital that the public have confidence in police use of biometric data. Given that biometric data and samples that are captured by Police Scotland may be taken without an individual’s consent, it is all the more important to ensure that there is adequate protection of rights and independent oversight of the police’s powers in that respect. The need for independent oversight has been identified in a number of independent reports—most recently, in the 2018 report, “Use of biometric data: report of the independent advisory group”. The Scottish Government consultation that followed the group’s report also indicated broad support for those arrangements.

I turn first to the commissioner’s general function, which is to support and promote the adoption of lawful, ethical and effective practices in relation to collection, use, retention and disposal of biometric data. That means that the commissioner will keep under review the law, policy and practice relating to biometric data in the context of policing and criminal justice.

The commissioner will also promote public awareness and understanding of biometric data, and of how police powers and duties are exercised, as well as how the powers and duties can be monitored and challenged.

The commissioner will prepare and promote a code of practice. In addition, his or her functions will include carrying out research and making recommendations in relation to any matter relevant to the Commissioner’s function.

In carrying out those functions, the commissioner will be required to promote in particular the interests of children, young people and vulnerable adults.

I will say a bit more about the code of practice. The commissioner is to prepare a code of practice in consultation with a list of prescribed stakeholders including Police Scotland, the Scottish Police Authority, the Police Investigations and Review Commissioner, HM inspectorate of constabulary in Scotland and anyone else whom the commissioner considers to be appropriate. The code must then be approved by Scottish ministers and laid before Parliament. The content of the code can be reviewed at any time, but there must be a report on it every four years.

The bill requires that there be a code, but it does not specify what its content should be. That is important, because it will allow the commissioner to use his or her own judgment and the input of stakeholders to shape the code. We anticipate that the code will provide information and guidance that sets out the standards and responsibilities of Police Scotland and the SPA, with the aims of ensuring good practice, driving continuous improvement and enhancing accountability. The SPA and Police Scotland will be legally obliged to have regard to the code.

To enable the commissioner to perform his or her functions, the commissioner will have the power to request information. Should that information be refused, concealed or destroyed, the commissioner has a remedy to the Court of Session, which would consider the matter. If an order were to be made by the court, it would be contempt of court to ignore it.

Having considered information about collection, use, retention and disposal of biometric data, the commissioner may wish to make a recommendation. Should no response to the recommendation be forthcoming, the commissioner would reference that in a report to Parliament, which would be made public. Therefore, the sanction is to name and shame, so to speak.

In conclusion, we will have a commissioner who will encourage and support the fulfilment by Police Scotland and the SPA of their functions in a manner that respects fundamental rights, the law and ethics. That support will include promoting good practice, identifying systemic deficiencies and providing a measure of transparency, which together will promote public confidence in policing and in the criminal justice system.

The Convener

Thank you for those helpful opening remarks. Before I bring in John Finnie, I want to ask a question about behavioural characteristics. Can you give an example of what those would include?

Elaine Hamilton

Behavioural characteristics would include analysis of, for example, a person’s gait or pattern of speech, such as a stammer—a defining characteristic in their behaviour. For example, if the person twitches or blinks, that could be helpful.

John Finnie

I thank Elaine Hamilton for her summary. I have a couple of questions, in particular about the status of the code of practice. It is very hard to predict the future, but four years on, if things go as expected, what status will the code have, what requirement will there be to adhere to it and what would be the sanction for someone who does not adhere to it?

Elaine Hamilton

The code of practice will set out the standards and responsibilities that will be expected of Police Scotland and the SPA. The expectation is that we will have in place internal systems to ensure transparency in how they exercise their powers, and that those powers will observe human rights and ethical considerations.

If the commissioner felt that Police Scotland or the SPA were not having regard to the code, the commissioner will be able to make a recommendation that they have regard to a certain part of the code. If Police Scotland or the SPA respond, the commissioner will consider that response. If the commissioner felt that they had not responded, that could be reported to Parliament and made public. There is therefore no legal sanction for failing to observe the code, but there is the sanction of reputational damage, which is a powerful one.

I have had discussions with Professor Wiles, the Commissioner for the Retention and Use of Biometric Material for England and Wales, and know that he, too, does not have sanctions in terms of enforcement powers. However, he feels that he does not need enforcement powers and that having them would adversely affect his relationship with police forces. I understand that there might be concerns here about the commissioner not having teeth, but in practice that does not appear to be an issue. The provisions in the bill for naming and shaming appear to be adequate.

John Finnie

Would there be retrospective application?

Elaine Hamilton

No. The code of practice will come into effect on a day that will be set by regulations that the Scottish ministers will lay before Parliament under affirmative procedure.

John Finnie

Have you formed a view of what the public might think about the likelihood of compliance, given the Scottish Information Commissioner’s and many other people’s views of the legitimacy of Police Scotland’s proposed deployment of cyberkiosks, and the fact that Police Scotland nonetheless considers it appropriate to go ahead with that deployment?

Elaine Hamilton

The cabinet secretary was clear when he appeared before the committee on 13 June that the legality of cyberkiosks is a matter for Police Scotland and the SPA. The bill’s proposed remit for the commissioner includes looking at developing technologies and ensuring proper validation of them before they are deployed, and ensuring that human rights and ethical considerations are taken into account.

John Finnie

Okay. I will not push further on that. Thank you.

The Convener

Liam Kerr has a supplementary question.

Liam Kerr

What is driving the process? Have there been breaches—for want of a better word—with regard to what is mandated just now? If so, is how we move forward time critical?

Elaine Hamilton

There have not been such breaches. The Scottish Government’s position is that Police Scotland and the SPA work to very high standards, and that there is no suggestion that the commissioner is required because of deficiencies in their performance.

As I mentioned in my introductory comments, there have been a few independent reports in recent years, including the independent advisory group’s report in 2018 and a report by HMICS in 2016, both of which called for independent oversight arrangements. There have been independent oversight arrangements in England and Wales for a number of years now, so it is felt that there is a gap in Scotland.

If we consider the times in which we live, so many processes are now propelled by technology, particularly biometric technology, and the Scottish Government understands that the public will naturally be concerned about issues including privacy and the security of data. There has, therefore, been alignment of a number of factors here that make creation of the post of commissioner all the more appropriate.

11:15  

Daniel Johnson

I would like to ask a supplementary before moving on to my substantive question. It follows on from the convener’s question about behavioural characteristics. My question is about the definition of “biometric data” in the bill. I accept that the list of types of data that is provided in section 23(2) is a “may include” list, but it does not include behavioural characteristics.

A more important concern stems from the fact that much machine learning does not codify behavioural characteristics in terms of information, as such. There is a system that can identify such behaviours, but it cannot articulate what information is being held by people. I am concerned that the definition might not capture all the means by which people are identified by their behavioural characteristics. To what extent has the bill team looked into and covered off that issue? Are you confident that the definition is comprehensive?

Elaine Hamilton

The definition of “biometric data” was considered very carefully by the bill team. We wanted to offer a very broad and comprehensive definition that would allow future proofing, given the fast pace of technology. Ultimately, the definition that is provided in the bill is not meant to define biometric data generally; rather, it is provided for the purposes of the bill and for setting out the scope of the commissioner’s remit.

To be clear, in the bill,

“‘biometric data’ means information about an individual’s physical, biological, physiological or behavioural characteristics”

that may establish their identity either on its own, or when it is combined with other information. When we talk about information about a person’s physical characteristics, that would include facial recognition. Information about biological characteristics would include a DNA profile, which can be derived from blood, saliva, hair and so on. Information about physiological characteristics would include vein patterns. As I mentioned earlier, information about behavioural characteristics could include a person’s gait or speech pattern.

In offering the definition in the bill, we have tried to be as broad as possible. We have made the definition broader than existing definitions of biometric data, such as in the general data protection regulations, which focuses more on data that has undergone some sort of chemical process.

Daniel Johnson

The area is one that I would like to examine further as scrutiny of the bill progresses. There is an important difference between data and information, particularly when it comes to machine learning.

I will move on to my substantive question. The committee has taken evidence on the preliminary report on the handling of complaints against the police. Four bodies oversee or are involved in policing; indeed, if HMICS is included, it could be argued that we have five such bodies. The bill would introduce a sixth one. I note that the policy memorandum says that consideration was given to whether the functions of the proposed commissioner could be given to another body, such as the Police Investigations and Review Commissioner.

Is there concern that we are creating a crowded landscape for police governance? What steps have been taken with the bill to avoid that? Why was the idea of giving the functions in question to the PIRC, the Scottish Police Authority or some other body rejected in favour of creating a separate commissioner?

Elaine Hamilton

The regulatory landscape in Scotland includes the roles of HMICS and the PIRC. It is the policy of the Scottish ministers not to create a new public body unless there is an absolute need for it and the functions cannot be carried out by an existing body. To that end, a robust options appraisal was undertaken in May of last year, which considered existing bodies such as HMICS and the PIRC.

HMICS and the PIRC are certainly well established in their respective areas of expertise, but they do not have a remit across all areas of biometrics. If we were to widen their remit, that could lead to a loss of focus for them, and it could negatively impact on their perceived authority and credibility. On that basis, using an existing body was not considered to be optimal. To have added to the remit of either of those bodies would have represented a fundamental shift in their purpose.

Undoubtedly, HMICS and the PIRC have valuable roles to play, but the options appraisal identified that they were not ideally placed to take on an additional function such as this. The need for a new parliamentary commissioner was based on having a fresh approach to supporting improvements in the setting, monitoring and enforcing of standards. The option of a new body scored the highest for benefits realisation, particularly around strengthened oversight and accountability of public services. It also offered the value of ensuring a proportionate and effective approach to biometric data and additional capacity to support world-class innovation research and development.

A new parliamentary commissioner would also function independently, with no perception of undue influence from policing-related bodies.

Those are a number of reasons why it was felt to be inappropriate to use HMICS or the PIRC, and why the optimal solution was to have a completely new parliamentary commissioner.

The Convener

When will the code of practice be available, even in a draft form?

Elaine Hamilton

The provisions of the bill are such that the code of practice is to be prepared by the biometrics commissioner in consultation with a list of prescribed bodies. The whole point of having an impartial commissioner is they will not be under the direction of Parliament or the Scottish ministers. It is therefore difficult for me to say exactly when the code of practice will be produced. I hope that it will be the new commissioner’s top priority but, as I say, there is a requirement for the commissioner to prepare the code in conjunction with stakeholders, which always takes time. The code will then have to be approved by the Scottish ministers and laid before Parliament. There is therefore a time element to it.

There is existing material that could be drawn on to form the code. The Scottish Government prepared a concept of operations code that was part of its consultation last year, and the new commissioner could also choose to draw on the existing standards from the forensic science regulator, for example. One would therefore hope that the commissioner will not be starting off with a blank sheet, but we have to respect the postholder’s impartiality, so I would not like to estimate when the code might be produced.

The Convener

It will be after the bill is passed and it will be introduced by secondary legislation.

Elaine Hamilton

Indeed.

The Convener

You mentioned raising awareness. Could you clarify whether that is about the role of the new commissioner or about the legislation itself and say how it is intended to raise public awareness?

Elaine Hamilton

Yes. One of the functions of the new commissioner will be to raise public awareness of police powers and duties in respect of biometric data. Because the post is impartial, it will be for the commissioner to decide how he or she will go about that. We would expect the commissioner to liaise with parliamentarians, with various representative groups and with the media in order to raise awareness of rights and duties in respect of biometric data.

The Convener

That is quite a grey area. It sounds very good, but the detail of how you raise awareness in practice is not so clear. Is there a budget for doing that?

Elaine Hamilton

Yes. The financial memorandum sets out the costings for the bill. That particular part of the commissioner’s role has been costed. There is a budget for publications and a budget for travel and subsistence, which will cover the costs of the commissioner travelling around the country, attending conferences or public meetings to provide information. There is a costing for that but not one specifically for public awareness raising—that is wrapped up in the travel and subsistence budget, the salaries and other administration costs.

The Convener

What is the budget?

Elaine Hamilton

The budget for travel and subsistence is £4,000 per annum. The administrative costs are £2,000 per annum. Do you wish to know the salary or remuneration costs?

The Convener

Why not?

Elaine Hamilton

The commissioner’s remuneration is estimated at £57,000, and the staff salaries at £167,000, based on three full-time equivalents.

The Convener

Thank you—that is helpful.

That concludes our questioning. I thank the bill team for providing evidence today.

11:27 Meeting suspended.  

11:28 On resuming—  

The Convener

Item 2 is consideration of the Scottish Biometrics Commissioner Bill at stage 2. I ask members to refer to their copy of the bill, the marshalled list of amendments and the groupings of amendments, and I welcome Humza Yousaf, Cabinet Secretary for Justice, and his officials. We will be joined by Gordon Lindhurst later, for consideration of amendments that he has lodged.

Section 1 agreed to.

Schedule 1—The office of Scottish Biometrics Commissioner

The Convener

Amendment 14, in the name of the cabinet secretary, is grouped with amendments 15 and 17.

Humza Yousaf (Cabinet Secretary for Justice)

Good morning. Amendments 14, 15 and 17 will make minor and technical changes to the bill. Schedule 1 makes detailed provision on matters such as the appointment, status, terms of office and remuneration of the commissioner. Paragraphs 7(1) and 7(3) provide for the parliamentary corporation to pay or make arrangements to pay the commissioner such remuneration, allowances, pensions and gratuities

“as the Parliamentary corporation determines.”

The parliamentary corporation will have discretion over the amounts that are to be set. Amendments 14 and 15 simply clarify that it will also have discretion as to whether anything is paid at all, in case there is any question about whether it can determine to set an amount at zero.

It will therefore be for the parliamentary corporation to decide whether payments are made and, if payments are made, at what level. That will provide maximum flexibility for the parliamentary corporation to determine matters as it sees fit.

Amendment 17 will simply fix a typographical error in section 2(4)(a).

I move amendment 14.

The Convener

As members do not have any questions or comments for the cabinet secretary, he does not need to wind up.

Amendment 14 agreed to.

Amendment 15 moved—[Humza Yousaf]—and agreed to.

Schedule 1, as amended, agreed to.

Section 2—Functions

The Convener

Amendment 16, in the name of the cabinet secretary, is grouped with amendments 3, 18, 24 and 7.

Humza Yousaf

Amendment 16 adds the Police Investigations and Review Commissioner to the list of persons who are subject to the oversight of a Scottish biometrics commissioner. In line with that, amendment 24 makes a change to section 7(1) to include the PIRC as a person who is subject to the code of practice.

Amendment 18 adds the Commissioner for the Retention and Use of Biometric Material to the list of bodies that the Scottish biometrics commissioner can work with jointly, assist or consult. The committee asked me to do that in its stage 1 report, and I am happy to oblige. The Commissioner for the Retention and Use of Biometric Material has the functions of keeping under review national security determinations that are made by the chief constable of Police Scotland and the retention and use of biometric material by the police for terrorism investigations and national security purposes.

Amendment 18 reflects the importance of the Scottish and United Kingdom biometrics commissioners co-ordinating their activities when carrying out their roles in Scotland by explicitly mentioning the Commissioner for the Retention and Use of Biometric Material in section 3.

Amendments 3 and 7, in the name of James Kelly, seek to include local authorities, health boards, the Scottish Prison Service and external contractors that provide biometric services as bodies that fall within the oversight of the commissioner and which are subject to the commissioner’s code of practice.

I recognise that members are keen to provide the public with the fullest protection against the mishandling of biometric data in a criminal justice and policing context. We all want that. However, as I have said previously, the existing provisions in the bill already go some way towards covering the activity of other bodies. The commissioner’s oversight function would allow the commissioner to review and report on the activities of public and private sector bodies that provide biometric data services to the police, the Scottish Police Authority or the PIRC. Furthermore, the code of practice could require any contracts that those bodies enter into with third parties to be compliant with the terms of the code.

I will consider consulting on including further persons or bodies in respect of their criminal justice or policing functions in due course. However, I will do that only once sufficient time has passed to allow the current oversight provisions to bed in. That would be in line with what the committee recommended. It would be premature to add all those other bodies now, when the commissioner’s office is just getting up and running.

For the avoidance of doubt, if James Kelly’s amendments were agreed to, the expansion in scope that they propose would be no small undertaking, and would have a substantial associated cost. There are 14 regional health boards; the Scottish Prison Service has 15 prisons that, together, hold more than 8,000 prisoners; and there are—as we all know—a total of 32 local authorities. There has been no consultation—none whatsoever—with the Convention of Scottish Local Authorities, the health boards or the Prison Service on the proposal.

In addition, as things stand, the commissioner’s role is due to be 0.6 full-time equivalent. The expansion would require the role to be full time, as well as—undoubtedly—requiring the employment of additional staff. Again, that would all come at huge cost, and without any consultation.

I urge members not to be rushed into expanding the scope of the commissioner’s oversight at this time; instead, they should allow time for proper reflection, discussion, consultation and analysis of the cost with the bodies that would be affected.

I move amendment 16.

James Kelly (Glasgow) (Lab)

Amendment 3 seeks to extend the remit of the commissioner to public bodies, including local authorities, health boards, ministers—in respect of the Scottish Prison Service—and contractors that provide services to those groups. Amendment 7 is a logical follow-on, in that it seeks to extend the remit of the code to cover the bodies that are listed in amendment 3.

I will move my amendments for three reasons: the extension is logical; it is important for public confidence; and it is also important for futureproofing. I welcome the extension that the cabinet secretary has made beyond the original drafting in the bill, but it does not go far enough; it leaves a gap in the provision in relation to health boards, local authorities, the Scottish Prison Service and contractors working with those bodies. There are huge issues around the collection and use of biometric data, and if we are setting up a biometrics commissioner, it is important that they have appropriate scope to cover all those bodies. My approach is supported by the Open Rights Group and Amnesty.

My second reason for moving my amendments is that I believe that the approach is important for public confidence. If we are going to establish a biometrics commissioner, their work should have proper reach. If there are gaps, the public will question why those gaps are not being covered.

Finally, on futureproofing, the committee heard that technology is moving very quickly in this area. It is therefore important that we cover all those bodies because developments in technology and other such issues will come up in future. It is important to get the scope and reach of the commissioner right at this stage.

John Finnie (Highlands and Islands) (Green)

I support the cabinet secretary’s move to include the PIRC in the provisions of the bill. I have spoken previously about the policing function and how it is not exercised exclusively by Police Scotland, so the move is appropriate.

I also support James Kelly’s amendments 3 and 7, for the reasons that he articulated. His amendments are supported by the Open Rights Group and Amnesty. I refer members to my entry in the register of members’ interests, as I am a member of Amnesty.

Public confidence is important, but the committee repeatedly heard calls for a public debate on the issue. I hear what the cabinet secretary says about consultation, but the independent advisory group has referred to that issue.

We have the opportunity to ensure that we futureproof the bill, so I will support the cabinet secretary’s amendments and those in the name of James Kelly.

Liam Kerr (North East Scotland) (Con)

There is merit in the cabinet secretary’s amendment 16, but I remain somewhat concerned about Mr Kelly’s amendments 3 and 7. Mr Kelly talked about the extension being logical and about public confidence, but I am not sure that that makes it practical. The cabinet secretary was right to highlight the possible costs, and I would like to understand a bit more about that.

Throughout its evidence taking, the committee was also concerned about whether the new commissioner would have sufficient capacity, given the part-time nature of the post and the amount of funding available. If, through amendments, we add in significant extra responsibilities, is there not a risk that we inadvertently overburden the commissioner before we have even discovered whether they have capacity for what was originally included, plus the PIRC?

Fulton MacGregor (Coatbridge and Chryston) (SNP)

I do not necessarily disagree with the premise in amendments 3 and 7, but I feel that they have come out of the blue, unlike the cabinet secretary’s amendment 18, as what it proposes was referred to in the stage 1 report. Amendments 3 and 7 were lodged without any consultation, as has already been said, and I do not feel that we took enough evidence—or any, in some respects—during stage 1 about the issues. We really need to hear the views of the national health service, COSLA and the SPS, among others, on amendments 3 and 7. At this point in time, I cannot support them. They have come a wee bit out of the blue.

11:15  

Rona Mackay (Strathkelvin and Bearsden) (SNP)

I will oppose amendments 3 and 7 on fairly clear grounds, the main one being cost. On the capacity issue that Liam Kerr mentioned, the scope of the role will become far too wide for a part-time commissioner at the start of his post. Our stage 1 report did not recommend adding the extra bodies right now, and the Government has indicated that it may be appropriate to extend the remit in future. Adding them at this stage would be the wrong thing to do, and I will oppose it.

Liam McArthur (Orkney Islands) (LD)

I thank James Kelly for lodging the amendments.

It is right to say that, at stage 1, the committee did not take a firm view on such an extension. However, the purpose of stage 2 is to probe. James Kelly’s points about public expectation, public confidence and futureproofing are right.

If the extension is a bridge too far at this time—and I rather suspect that it is, for reasons that others have articulated—we should at least paint a pathway to the point at which the use of biometrics technology in the areas in question, and potentially others, is achieved. The public would expect us to do that.

Although I am not minded to support amendments 3 and 7 in their current form, they serve a useful purpose in aiding us to move towards where we need to be.

I welcome the cabinet secretary’s extension to the bill to cover the PIRC, as he committed to doing during the stage 1 debate.

Shona Robison (Dundee City East) (SNP)

I oppose James Kelly’s amendments on the very straightforward basis that the evidence that the committee took at stage 1 is not sufficient to support the proposed extension at this stage. There was a lot of discussion of the evidence, and we landed on a phased approach as the best way forward. That has been acknowledged by the cabinet secretary; it might be helpful for him in his summing-up to say a little more about that phased approach.

The Convener

I welcome the inclusion of the PIRC in the commissioner’s oversight.

There has been a good discussion of the issue. The committee should look at futureproofing and whether there are any gaps, but, equally, there are huge implications about how the extension would work in practice, so I tend to agree with Liam McArthur: it is absolutely right to discuss the issue and put it firmly within the cabinet secretary’s sights at this stage. If the proposal is not agreed to, perhaps we should consider how we could look at it at stage 3.

James Kelly

I will address a couple of points.

I do not agree with Fulton MacGregor’s comment that the amendments have come out of the blue. The point was made clearly by the Open Rights group and by Amnesty in their submissions to the committee and ahead of the stage 1 debate. It was also covered in the stage 1 debate; I specifically mentioned it, as did John Finnie.

I acknowledge that there would be additional costs. However, as was said throughout stage 1, we are asking the commissioner to undertake a serious role. We are at stage 2. If the amendments are agreed to, there will be an opportunity at stage 3 to take account of them and to upgrade the commissioner’s role.

Ultimately, capturing data, getting the approach right and ensuring that human rights are observed are serious issues. Therefore, it is right that the scope of the commissioner’s role should be widened and that any consequential costs should be met.

Humza Yousaf

I very much associate myself with the remarks made by Liam McArthur, Liam Kerr, Fulton MacGregor and the convener. It was helpful for James Kelly to lodge the amendments, so that the point could be debated and discussed. I know that his doing so was well intentioned and that the amendments reflect concerns that have been raised by important external stakeholder groups.

However, I will go back to my central point, and will try to give some reassurances. The need to futureproof the bill has been mentioned. It is because of the need to do so that the bill contains a power to amend the legislation to include other bodies. If it was thought that more bodies should be added to the list, that could be done in a phased way. The power to extend the list of bodies already exists.

I want to reassure James Kelly on one particular point that he raised. Section 2(3)(a) instructs the commissioner to

“keep under review ... the acquisition, retention, use and destruction of biometric data by”—

this is the important part—

“or on behalf of the persons”

named in the bill. That means that, if the police are using medical professionals to collect biometric data, the commissioner will examine what those medical professionals do.

The commissioner has a defined and set role, and there is a phasing-in period. If Parliament and others think that the list should be amended to include other bodies, that can be done under the legislation. However, it would be wrong to do that in relation to substantial bodies without any consultation or costings.

Again, I thank James Kelly for lodging his amendments, which have allowed for a good debate.

Amendment 16 agreed to.

Amendment 3 moved—[James Kelly].

The Convener

The question is, that amendment 3 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kerr, Liam (North East Scotland) (Con)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is For 2, Against 7, Abstentions 0.

Amendment 3 disagreed to.

The Convener

Amendment 4, in the name of John Finnie, is grouped with amendments 13 and 30.

John Finnie

Amendment 4 is about the role that the commissioner could play in keeping technologies under review. We heard a lot of evidence about the efficiency of the equipment that has been used and the atrocious success rates—2 per cent, which is ridiculously low when we are talking about people’s human rights and the importance of community safety. If we want to have effective equipment, if it is ever deployed, it is important that the commissioner should have some oversight role in relation to the technology that is used in the acquisition, retention, use and destruction of biometric data. I hope that members will support my modest proposal.

I move amendment 4.

Liam McArthur

I support John Finnie’s amendments, for the reasons that he has set out.

Under section 2, the commissioner will monitor the extent to which the relevant bodies comply with the code of practice. Amendment 30 provides that if, in the course of monitoring the code, the commissioner finds that it is being disregarded, that information must be made public.

Colleagues will recall lengthy discussions during stage 1 about whether the enforcement powers in the bill go far enough. Many, including the Scottish Human Rights Commission and the Open Rights Group Scotland, concluded that they did not. The Government has always maintained that the bill’s strength is to be found in the persuasive powers of naming and shaming or, at least, the threat of that. In that regard, the cabinet secretary said that the power of reputational damage should not be underestimated. Of course, that view is shared by the current UK commissioner. However, I am concerned that, if the commissioner is not required to make breaches of the code public, the risk of reputational damage is one that many people might be prepared to take.

I appreciate that there might need to be a degree of latitude around minor breaches that are quickly rectified once they are identified. However, if the public are to have confidence in the new powers, transparency is key. In that context, amendment 30 is a sensible step in the right direction, and I hope that the committee and, indeed, the Government, will support it.

Humza Yousaf

I do not consider amendment 4 to be necessary. The commissioner’s review duty under section 2(3)(a) already implicitly includes the function of keeping under review the methods or technologies used to

“acquire, retain, use and destroy”

biometric data. That is because the phrasing is such that what must be reviewed is

“the law, policy and practice relating to the acquisition, retention, use and destruction of biometric data”.

The technologies that are used would relate—very much—to that data.

Furthermore, if amendment 4 is agreed to, it could cast doubt on whether the commissioner’s function as set out in section 2(3)(b) includes the function to promote public awareness and understanding of the power and duties of the police and the SPA in relation to the use of biometric technologies, given that no similar reference to biometric technologies would be added to the provision. I ask John Finnie not to press amendment 4. If the committee wishes to see an express reference to technologies, I would be happy to work with the member on a suitable amendment ahead of stage 3.

Amendment 13 would require persons mentioned in section 2(1) to comply with the commissioner’s recommendations regarding biometric technologies. It would be entirely acceptable to require a person to indicate what steps they were taking in respect of a recommendation by the commissioner and to make those steps known to the Scottish ministers and Parliament. However, I have concerns about the way in which proposed section 15(3C) would require those specified in section 2(1) not to use a technology if the commissioner recommended that it should not be used.

There are several difficulties. First, it would not be acceptable that a recommendation by the commissioner on the use of a certain kind of technology should be binding to the extent that it impinged on the operational independence of the police, given that the SPA and Her Majesty’s Inspectorate of Constabulary in Scotland do not have similar powers. Secondly, such things would not be recommendations at all: proposed section 15(3C) would, in effect, allow the commissioner to make the law on the use of biometric technologies without there being any consultation or approval mechanism in place. I consider that that would subvert the role of Parliament.

Thirdly, the law must be accessible. If the commissioner’s recommendations were in effect to be law, a person would have to trawl through the commissioner’s reports and code of practice as well as the substantive law to find out what technologies they were allowed to use. That would mean that the rules on technologies would not be as accessible as they should be.

Finally, there would be no mechanism in the bill for the recommendations—in effect, prohibitions—to be amended or revoked by the commissioner at a later date.

For those reasons, I ask John Finnie not to move amendment 13.

Amendment 30, in the name of Liam McArthur, to some extent duplicates section 15(1)(a), which provides that the commissioner may prepare and publish reports about whether persons who are required

“to have regard to the code of practice have done or are doing so”.

Amendment 30 makes it compulsory to publish reports about failures to have regard to the code.

As is clear from the bill’s accompanying documents and stage 1, it is anticipated that reporting will be a key aspect of the commissioner’s role. Therefore, I do not consider amendment 30 to be necessary. In addition, the way in which it inserts that duty is slightly confusing, because it does not alter the commission’s discretion to issue reports under section 15. That would mean that, in one sentence, we are saying that the commissioner “must” issue reports on failings but, in the next, that the commissioner “may” issue reports. Therefore, I ask Liam McArthur not to move amendment 30. However, if he is not reassured by my comments and still wishes to make that element of reporting mandatory, I would be happy to work with him to agree a suitable amendment ahead of stage 3.

John Finnie

It was remiss of me not to refer earlier to amendment 30 in the name of my colleague Liam McArthur. I lend support to amendment 30 for the reasons that he outlined.

I do not recognise the cabinet secretary’s characterisation of the intention behind amendment 4. When it comes to something that could impact on citizens’ human rights and have such a level of collateral intrusion, I have no concern about someone having to “trawl through” various information to come up with the appropriate answer. We know from the various information technology projects that it is hugely important to get things right. We do not want to find ourselves in the situation that we were in with the cyberkiosks, where the equipment has already been bought so we have to go along with it because of the expenditure that has already been made. There are several issues around that.

I am happy to engage with the Scottish Government on that point to come up with an amendment that would meet the intention and what we all want to see, which is that quality equipment is correctly deployed. I will not press amendment 4.

11:30  

Amendment 4, by agreement, withdrawn.

Amendment 17 moved—[Humza Yousaf]—and agreed to.

Section 2, as amended, agreed to.

Section 3—Power to work with others

Amendment 18 moved—[Humza Yousaf]—and agreed to.

Section 3, as amended, agreed to.

Sections 4 and 5 agreed to.

After section 5

The Convener

Amendment 5, in my name, is in a group on its own.

In its stage 1 report, the Justice Committee recommended

“that the Scottish Government includes a complaint mechanism within the Bill, to enable the public to refer issues to the Scottish Biometrics Commissioner on the use of biometrics by Police Scotland and the SPA, or on their lack of compliance with the Code of Practice.”

That follows many witnesses, including Matthew Rice from the Open Rights Group, expressing concern that, despite it being one of the key functions of the commissioner to promote public awareness and understanding of the duties and responsibilities of those who acquire, retain, use and delete biometric data, there is no corresponding complaints mechanism whereby a member of the public could raise such concerns with the commissioner.

In his evidence, Detective Chief Superintendent Scott from Police Scotland acknowledged the importance of the public having the right to complain, and Tom Nelson from the SPA said that he thought that the commissioner would want to hear from the public and understand where their concerns were coming from; he also believed that the ability to engage with and speak to the public would allow the commissioner to provide assurance to the public and would ensure that the public and the commissioner could identify any challenges.

Amendment 5 seeks to ensure that the bill provides a complaints mechanism that affords individuals, or someone who acts on their behalf, the right to complain directly to the biometrics commissioner about the acquisition, retention, use or destruction of their data by or on behalf of Police Scotland or the Scottish Police Authority.

Furthermore, amendment 5 also takes cognisance of the concerns that were expressed by the cabinet secretary about the risk of duplicating the role of the UK Information Commissioner if the Scottish biometrics commissioner had a similar function of looking at complaints about the use of biometric data, which can be personal data, which is a reserved matter. The cabinet secretary considered that the relationship between the UK Information Commissioner and the biometrics commissioner should be addressed and said that he was supportive of the Justice Committee’s recommendation that there be a memorandum of understanding between the two commissioners to avoid potential confusion about the two roles and to protect the independence of both offices.

Amendment 5 addresses both those concerns by providing that the biometrics commissioner must consult the Scottish Public Services Ombudsman, Police Scotland and the SPA, as well as any persons or groups that the commissioner considers appropriate, on the commissioner’s proposals for a complaints procedure. The commissioner must keep that procedure under review and must vary it

“whenever, after such consultation, the Commissioner considers it appropriate to do so.”

Late last night, I received a letter on amendment 5 from the UK Information Commissioner’s Office; it was distributed to the committee first thing this morning, and the cabinet secretary’s officials have a copy. It helpfully points out that amendment 5 contains an error—the “Information Commissioner Act 2000”, to which it refers, does not exist. That can easily be rectified at stage 3. In the meantime, the error should not prohibit the passing of amendment 5 today, if the committee is so minded.

Helpfully, the UK ICO confirms that complaints about the way in which the personal data relating to an identified or identifiable person is handled should be referred to the UK ICO. However, biometric data relating to an identified or identifiable person is deemed to be special category data and subject to additional safeguards. If, therefore, the complaints process is confined to compliance with the code of practice, the UK Information Commissioner says that that should be clearly stated in the bill to avoid any ambiguity. The complaints process as laid out in amendment 5 is confined to compliance with the code of practice.

Finally, the cabinet secretary stresses that, in his view, the biometrics commissioner

“should concentrate on ... systemic issues in the criminal justice and policing context”,

with its

“oversight driven by a systematic review of Police Scotland and the SPA’s activities as these relate specifically to biometric data”,

rather than the resolution of individual complaints. However, that fails to recognise that it is only by being aware of and involved in resolving instances in which things have gone wrong that systemic improvements can be made and robust systemic oversight achieved. More than that, quite simply, as the Justice Committee and many others have pointed out, there is a risk to public confidence and transparency if a complaints mechanism is not included in the bill.

I move amendment 5.

John Finnie

Convener, you are aware that, had you not lodged amendment 5, I would have done so. I am therefore happy to lend it my support.

The public would imagine it to be passing strange if there was a public body that did not have a complaints mechanism attached to it. That is a fundamental principle for how the public should engage with public officials. I am very supportive of the proposal.

Rona Mackay

I am not going to support amendment 5. It is unnecessary. The public are already free to make complaints to the commissioner, so I do not think that we need another piece of law to give them permission to complain.

Amendment 5 technically only requires the commissioner to establish a procedure for people to make complaints but it does not require the commissioner to do anything with them. Such a requirement should not be in the bill, and the legislation should not oblige the commissioner to deal with complaints; the mechanism for people going to the commissioner with complaints already exists.

Fulton MacGregor

I agree with my colleague Rona Mackay. Also, I know, convener, that you have taken head-on the fact that the amendment is technically wrong, but it is significant that the UK ICO has taken the time to write to us. I do not think that we fully understand what the consequences of amendment 5 might be. I therefore agree with Rona Mackay and will not support the amendment today, but I politely suggest that speaking to the Government ahead of stage 3 and getting a factually correct amendment on the table might be the best way forward.

James Kelly

I welcome amendment 5. It deals with the issues that were raised in the committee’s stage 1 report. John Finnie made the point about public confidence and how the public might think that it is strange if there were no complaints mechanism in place for the work that the biometrics commissioner is undertaking. I support amendment 5.

Humza Yousaf

I have serious reservations about amendment 5. Let me make a couple of points about it.

Convener, you referred to the letter that came in late last night from the Information Commissioner’s Office—I thank the parliamentary clerks for giving us sight of the letter as we were on our way in. As you said, it refers to the inaccurate reference to the 2000 act. However, the Information Commissioner’s Office’s more substantial point is this:

“I would bring the Committee’s attention to the evidence which I gave during its Stage 1 deliberations where I made reference to the role of the UK Information Commissioner’s Office regarding complaints about the way in which individuals’ personal information is handled. Any complaints about the way in which such data are handled should be referred to the ICO. This separation of locus has worked well south of the border where a Biometrics Commissioner has been in post since 2016.”

In addition, convener, you said that the scope of amendment 5 is confined to the code of practice, as the ICO would wish it to be, but I do not think that that is the case; nowhere in amendment 5 do the words “code of practice” appear.

Moreover, amendment 5 is not necessary. Individuals will be free to make complaints to the commissioner at any time. They do not need the law to give them permission to complain.

The bill does not oblige the commissioner to investigate complaints or set up a process to deal with them. However, if someone were to draw the commissioner’s attention to a relevant and important issue, by way of a complaint, the commissioner could use their powers to look into the matter, for example by requiring a body to produce information. That could lead to the publication of reports and recommendations or to the issuing of a compliance notice.

The commissioner’s function of dealing with complaints about the processing of biometric data, which can include personal data, closely parallels the functions of the Information Commissioner’s Office. Amendment 5, as drafted, does not delimit the role of the biometrics commissioner and would allow the commissioner to deal with complaints about breaches of data protection law that should properly be dealt with by the ICO.

John Finnie

Do you accept that all members in their constituency business and lots of organisations have the facility to signpost individuals if it would not be appropriate to deal with a complaint themselves? I am trying to imagine a website for the commissioner that did not provide for a complaints mechanism. Every other public body has such a mechanism. You must acknowledge that not to have one is passing strange.

Humza Yousaf

People will be able to make a complaint about the commissioner himself or herself in the context of the role that they will fulfil. We should make that obvious.

On your point about signposting, I think that the recommendation of a memorandum of understanding between the ICO and the commissioner is the right way to go. I think that I made that point in the debate. In my capacity as a constituency MSP, I often signpost people. I share an office with the local MP and, if a matter comes to me that I cannot deal with—for example, if the Home Office will not engage with me on an immigration matter—I can signpost the constituent to the local MP. The system works perfectly well. There is, in effect, a verbal MOU between me and the local MP.

John Finnie

I do not want to sound facetious, but you will understand that the public do not go about wondering whether there are memoranda of understanding between different public bodies. The word “complaint” is readily understood, and a complaint should be responded to.

Humza Yousaf

I was trying to make the point that, just as a constituent should be free to come to any elected member on any issue, and that member might choose to refer the case to another body—I used the analogy of an immigration case that is referred to an MP, because the Home Office does not deal with MSPs regularly—nothing will stop a member of the public going to the biometrics commissioner to make a complaint and, perhaps through the proposed MOU, being signposted to the Information Commissioner’s Office.

Setting up a separate complaints mechanism for the biometrics commissioner would create confusion for the public. It would also cut across the clear remedy that already exists, which is that members of the public may make a complaint to the Information Commissioner’s Office in respect of the processing of personal data. I have concerns about our straying into reserved matters in that regard. In any event, it is better to maintain the delineation between the roles, whereby the ICO fully investigates complaints from the public and the new biometrics commissioner will undertake a monitoring role and make thematic reports.

To complement that, I reiterate that there is support for a memorandum of understanding to be drawn up between the biometrics commissioner and the ICO so that there would be a common understanding of their roles. That could be communicated to the public, but it would also be important for the internal purposes of the two commissioners. I understand that the ICO is very receptive to that idea.

11:45  

My final point is on a number of technical issues with amendment 5. We have already discussed its reference to a non-existent act. In addition, as it is drafted, the amendment requires the commissioner only to “establish a procedure” for people to make complaints but not to do anything with them. It also does not take account of the fact that the bodies that are listed in section 2 might change.

For all those reasons, I ask Margaret Mitchell not to press amendment 5.

The Convener

The technical error is a minor defect. It is not unusual for the Parliament to agree to an amendment at stage 2 and to pick up on technical errors at stage 3. It is the thrust of what we want to achieve that is so fundamentally important.

As for the code of practice not being mentioned specifically, the effect of amendment 5 would be to ensure that compliance with the code of practice would be achieved. As the ICO said, that should be stated in the bill.

I am somewhat surprised by members’ comments—especially Rona Mackay’s—on amendment 5. It was the committee’s unanimous recommendation that the Scottish Government should include in the bill provision for a complaints mechanism to enable the public to refer to the Scottish biometrics commissioner issues with the use of biometrics by Police Scotland and the SPA, or about their lack of compliance with the code of practice. For members to say at this stage that they are totally opposed to that I find puzzling. Behind its recommendation lay the committee’s concern that there would be risks to public confidence and to transparency if provision for a complaints mechanism were not included in the bill. That view was shared by the Law Society of Scotland, which agreed that a complaints mechanism should be included to enable the public to refer issues to the Scottish commissioner on the use of biometrics where there is a lack of compliance with the code of practice.

The cabinet secretary is absolutely right to say that systemic oversight should be robust—that is essential. The power to look at people’s personal biometric data is a very important one, and they should have the right to complain if they believe that there has been a breach of the code. That is what amendment 5 seeks to establish.

On that basis, I press amendment 5.

The question is, that amendment 5 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 5 agreed to.

The Convener

Amendment 19, in the name of Liam McArthur, is in a group on its own.

Liam McArthur

As we heard in relation to an earlier grouping, throughout stage 1 there was a lot of debate on whether the bill’s reach went far enough in setting out the commissioner’s remit. It was accepted that, although the use of biometrics in policing requires robust regulation, it is a technology whose reach already extends far more widely. We therefore need to ensure that the regulatory framework and oversight powers meet public expectations.

Given how long it has taken to bring the bill before the Parliament—my former colleague Alison McInnes raised concerns in this area in the previous parliamentary session—it is fair to say that we are still playing catch-up. I suppose that the question is whether we should opt for a phased approach, starting with Police Scotland and a limited range of other bodies that are involved in the delivery of policing in this country, or seek to empower the Scottish biometrics commissioner to take the broadest possible view of the use of such technology. We explored some of those issues in discussing that earlier grouping, and it is clear where the committee currently stands on them. However, given that both the pace of the technology and the ways in which it is being used are changing, it will always be a challenge to ensure that legislation on the subject remains fit for purpose.

Amendment 19 would establish a process for review, which would help to fine-tune the commissioner’s remit as it is currently proposed and leave open the door for expanding its scope in the future, as might be appropriate based on our experience of it in practice.

In their evidence, Amnesty International, the Open Rights Group and the Scottish Human Rights Commission raised their concerns about the proposed scope of the commissioner’s remit. As I said earlier, I have a great deal of sympathy with those concerns. At the same time, there are risks in overstretching the commissioner in the early stages. Establishing the commissioner’s role and function will take time, and it is crucial that the commissioner can demonstrate effectiveness in carrying out his or her duties.

I know from my correspondence with the cabinet secretary that he intends to keep the commissioner’s remit under review. Although I welcome that commitment, it is perhaps a little vague and vulnerable to not surviving his departure from his current role. In that sense, amendment 19 seeks to add a little bit more certainty around that intention.

I look forward to hearing comments from colleagues including the cabinet secretary.

I move amendment 19.

John Finnie

I support my colleague Liam McArthur’s amendment 19. An argument can be made that we can review anything at any time, but making that specific request of ministers will give the review an appropriate profile, given the speed with which technology changes and with which we might have to respond to some of the implications of the proliferation of public surveillance. I am very supportive of amendment 19.

Shona Robison

I have concerns about laying down a timeframe. It is one thing to have a commitment to post-legislative review, which is always good, but requiring that the commissioner’s powers and functions be reviewed

“3 years after the day of Royal Assent”

and at five-yearly intervals thereafter might get in the way of a natural timeframe for review. Why should we set those timeframes, which might not make sense when things are up and running? Those timeframes seem very fixed and inflexible. Would it not be better that, instead of fixed timeframes being set out, review would be based on what made sense at the time and be led by the commissioner’s view of what progress had been made?

Fulton MacGregor

I agree with that point. Although I see where Liam McArthur is coming from, I will not support amendment 19. We have included in the bill provisions for post-legislative scrutiny. I think that we sometimes try to predict what a future Parliament with different members will think about legislation or to mandate what it should do. I hear what John Finnie says about the other side of the argument and about it being our job to look at what might be needed in the future, but I come down on the other side of the argument, so I will not support amendment 19.

The Convener

It seems to me that amendment 19 would strengthen parliamentary scrutiny, which would be a very good thing. In my opinion, it does not seem unreasonable that, after 12 months, we should look at how this important but potentially intrusive legislation is working.

Humza Yousaf

I will stick to remarks on amendment 19 rather than comment on Liam McArthur’s prediction of my political demise.

Although I understand and have a great deal of sympathy with the reasons for his lodging amendment 19, I have some concerns, as Liam McArthur might understand. Those concerns have been articulated well by Shona Robison and Fulton MacGregor. I reiterate that a means of review already exists. Provisions for post-legislative scrutiny do not need to be hardwired into an act. The Parliament or the Government can conduct a review whenever it wishes and at a time that is most appropriate. That is surely preferable to a requirement to conduct a review at a time that is selected in advance and that might not work well because of the load of other things that might be going on at that pre-selected time.

The committee will be aware that the bill already provides for a lot of on-going accountability and reporting to Parliament through strategic plans, budgets, annual reports, other reports and recommendations, and so on. There will also be parliamentary approval of the code of practice and any revisions to it. All of those processes can be triggers for ministers or Parliament carrying out post-legislative scrutiny at any time. That would allow a review to be conducted when we know that there is an issue to be examined, instead of our being required to do it at a particular time even if everybody is content.

On reviewing the scope of the commissioner’s oversight, ministers have already taken powers allowing the list of bodies over which the commissioner has oversight to be added to by means of regulations. Ministers will therefore keep under review whether it is appropriate to exercise those powers.

What the amendment proposes is somewhat unusual compared to other examples of compulsory post-legislative scrutiny in that it would set up a recurring rather than a one-off duty. I question whether it is appropriate to commit time and resource to almost never-ending reviews when everyone might be content that the commissioner’s functions are working perfectly well. Those compulsory recurring reviews might end up draining away resources from other issues that the Parliament and Government agree ought to be a higher priority at the time.

Although post-legislative scrutiny is important and I believe that Liam McArthur’s amendment is well intentioned, I suggest that hardwiring scrutiny arrangements into the bill is unnecessary and unhelpful, so I ask him not to press amendment 19. As always, if he does so, I offer to work with Liam McArthur in advance of stage 3, if necessary.

Liam McArthur

I thank all members who have contributed to the debate for the spirit in which they have offered their remarks. In particular, I thank John Finnie and the convener for their express support for amendment 19. John Finnie suggested that it would raise the profile of something that one might expect to happen, but it is no less important or relevant for that.

I listened carefully to what Shona Robison and Fulton MacGregor suggested, and I understand the anxieties about what appears to be a rigid timeframe. That, in a sense, sets the minimum requirements—it would be a process in which the triggers would be up front and obvious. However, if circumstances were such that an additional review was required because of revelations that gave rise to public concern, nothing in amendment 19 would prevent that from happening.

The cabinet secretary rightly pointed out that it is open to the Government and, indeed, Parliament to carry out post-legislative scrutiny. We have had that power from the get-go, but it has been used in exceptional circumstances rather than routinely.

On the recurring nature of the duty, I understand the anxiety that we might get locked into a process that, over time, becomes less relevant. However, given the nature of the technology involved—we have all talked about the speed at which it is changing—it is unlikely that the need to keep the issue constantly under review will diminish in any way in the foreseeable future. Therefore, notwithstanding that the Government might want to work with me ahead of stage 3 to make further refinements, I am minded to press my amendment.

The Convener

The question is, that amendment 19 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 19 agreed to.

Section 6—Code of practice

The Convener

Amendment 20, in the name of the cabinet secretary, is grouped with amendments 35, 21 and 36.

Humza Yousaf

My amendment 20 is intended to make a clear link between the principle that is set out in the commissioner’s general functions under section 2(1) and the content of the code of practice. The committee asked me to do that in its stage 1 report, and I am happy to oblige.

The commissioner’s general function is

“to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes”.

Anything that the commissioner does, including preparing the code of practice, should be in furtherance of that general function. Amendment 20 therefore makes it clear that the commissioner must prepare a code that is designed

“to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data”.

Amendments 35 and 36 require the commissioner to have regard to specific principles when preparing or revising the code of practice, including the principles of promoting and protecting human rights, privacy and public confidence, as well as the principle of ensuring individual and community safety. I consider the amendments to provide a reasonable balance between specifying what the code should include and preserving the independence of the commissioner to decide what the code should cover.

12:00  

Although I do not think that amendments 35 and 36 are strictly necessary, I am happy to support their general principles if Liam Kerr wishes to proceed with them, despite the comfort that is already offered by amendment 20. I would, however, note some technical concerns, particularly about aspects of amendment 36. For example, the reference to revising a code in amendment 36 is confusing because there is already a default rule in section 6(5) that sets out which sections also apply to revised codes. It would therefore be clearer to apply the general rule to the new section that is proposed by Liam Kerr.

Some of the other language in the amendments will require further consideration. For example, the reference to the principle of ensuring the safety of individuals and communities could be considered to be problematic because that is not something that the commissioner can ensure, although they can recognise the importance of it.

I therefore ask Liam Kerr not to move amendments 35 and 36 at this time. If he wishes to proceed with them, I will be happy to work with him to agree suitable amendments to the technical aspects ahead of stage 3.

Amendment 21 requires the code of practice to include a presumption of destruction of biometric data three years after it was acquired. I fully recognise the member’s concerns that a clear direction should be given by the commissioner regarding retention periods. I do, however, have strong concerns about amendment 21.

If amendment 21 was supported, it would require a change in policy and procedure that is not entirely aligned with the law as set out under the Criminal Procedure (Scotland) Act 1995. A presumption of destruction of data after the expiry of three years, as is suggested in the amendment, does not fully take account of the provisions in the 1995 act, which, in some cases, allow biometric data to be retained for up to two years only. The 1995 act also allows retention periods to be extended by a sheriff in some cases, and it is not clear how the proposed presumption would fit with that power.

It should be noted that the police are already bound by the European Convention on Human Rights and data protection laws regarding retention periods for biometric data. I have previously committed to conducting a review of the retention periods that are set out in the 1995 act once the commissioner is in post. If retention periods are to be set, it would make more sense for the commissioner to consult on them and set them within the code of practice, given that the code will be subject to the consideration and approval of Parliament. That would mean that retention periods would benefit from the flexibility of being set out in the code, and Parliament would be able to approve retention periods when it approved the commencement of the code of practice. It would also mean that the period could be changed to reflect changing circumstances.

However, if amendment 21 was supported, the presumption could not be adjusted to opt for either a longer or a shorter period. Even if the code set rules about retention periods, it would have to be done in a way that was clear and did not appear to contradict existing law. I therefore ask Liam McArthur not to move amendment 21.

I move amendment 20.

The Convener

Liam McArthur will speak to amendment 21 and other amendments in the group—[Interruption.]

I am sorry; I have taken the Liams out of order. Liam Kerr will speak to amendment 35 and other amendments in the group.

Liam Kerr

I am happy to support amendment 20. I am glad that you brought me in first, convener, because I will be interested to hear Mr McArthur’s response to the cabinet secretary’s points on amendment 21.

Amendment 35 simply inserts a reference to the relevant section; that will be required if the committee is with me on amendment 36.

Amendment 36, which is the substantive point, picks up the committee’s recommendation at paragraph 206 of the stage 1 report, which says that

“the principles underpinning the Commissioner’s role and the purpose of the Code of Practice in promoting and protecting”

various items, and the

“principle of delivering community safety”

should be included in the bill. Amendment 36 simply seeks to codify those principles, to which the commissioner must have regard when preparing or revising a code.

I am grateful to the cabinet secretary for his comments. He said that the reference to revision is confusing and that further technical amendments will require consideration at some point. My preference is to move amendment 36, after which I would be pleased to work with the cabinet secretary to amend it to the optimum level at stage 3.

I would be pleased to have the committee’s support for amendments 35 and 36.

The Convener

Are there any questions? [Interruption.] Sorry—I seem to be determined to get Liam McArthur in first or to miss him out completely.

I invite Liam McArthur to speak to amendment 21 and other amendments in the group.

Liam McArthur

I did not realise that the earlier invitation was a once-only opportunity.

I welcome and am supportive in principle of the other amendments in the group, even though the cabinet secretary has expressed one or two misgivings with amendments 35 and 36 that will need to be addressed.

On amendment 21, I heard what the cabinet secretary said, which—to paraphrase—fell into the category of inconsistency and rigidity. Amendment 21 was lodged principally to align the rules around the retention of biometric data. At the moment there is a disparity between the regulation on DNA and fingerprints and that on photos that are held by the police: DNA and fingerprints are regulated under the 1995 act but, as the cabinet secretary acknowledged, photos are not.

The issue was recognised by my colleague Alison McInnes during the passage of the Criminal Justice (Scotland) Act 2016 five years ago. Since then, both HMICS and the independent advisory group have found governance gaps that are a concern. John Scott QC recommended in his review:

“There should be a presumption of deletion of biometric data after the expiry of prescribed minimum retention periods.”

Although Police Scotland has since updated its policy, there is still no legislative requirement for images to be deleted. In recent evidence to the Justice Sub-Committee on Policing, Temporary Assistant Chief Constable Duncan Sloan confirmed that the current rules around what the police can do with images of the public are “not so clear” as the rules around fingerprints and DNA and that new governance arrangements

“would be valued and welcomed.”—[Official Report, Justice Sub-Committee on Policing, 16 January 2020; c 5.]

Similarly, Detective Chief Superintendent Sean Scott of Police Scotland supported the IAG recommendation of

“a presumption of deletion of biometric data”

as the central part of the oversight system that was established by the 2016 act. He stated:

“one of the IAG’s nine recommendations was about the retention periods and a presumption of deletion, and that is absolutely right.”—[Official Report, Justice Committee, 29 October 2019; c 13.]

Research by the Scottish Liberal Democrats revealed at the weekend that more than 375,000 images have been supplied to the police national database from Police Scotland’s criminal history system since 2014, all with no clear legal requirement for their deletion should the individuals concerned be found to be innocent.

Facial recognition may be invaluable for modernising the way in which the police investigate crime but, unregulated, the system poses a potential threat to human rights and civil liberties and, as we have repeatedly heard from Police Scotland, to the reputation of our police.

Liam Kerr

Amendment 21 refers to a period of three years. Where does that figure come from?

Liam McArthur

The three years are required to bring governance arrangements on images in line with those for DNA and fingerprints and to deliver a degree of consistency across the retention periods for biometrics.

Shona Robison

Given that you referred in your opening remarks to an existing disparity, surely consultation on the issue would be required to get the retention periods right? Would it not be better for the commissioner to undertake such a consultation, rather than us deciding now that three years is the right answer? Such a decision would be based on current practice rather than on a consultation on what would be ideal, which would be based on evidence from the stakeholders who deal with the issues at the coalface.

Liam McArthur

I take the point about consistency. However, I do not think that we have heard any concerns about the current retention periods, so having consistency with them would not seem to be an unreasonable proposition. If, in due course, there is a belief that the retention periods are out of alignment with public expectations on the use of the technology, it will certainly be open to the commissioner to look at that. However, with the bill that we are considering, there is an opportunity to bring a degree of consistency to retention policy. As we have heard, not least from Police Scotland, that is desirable and it would be welcome as it would provide clarity.

The Convener

I am happy to support the cabinet secretary’s amendment 20.

The intent of Liam Kerr’s amendment 36 is quite clear. The wording could be improved—that could be looked at at stage 3—but if the committee is minded to agree to the amendment, there is no reason for it not to do so. Agreement to the amendment would send a clear message about the importance of human rights and so on being in the bill.

I turn to Liam McArthur’s amendment 21. If I understand him correctly, the retention period for DNA and fingerprint information is three years, but it might differ for other things. The important point is that there would be a presumption that the information would be destroyed after three years. If there is a good reason for information to be retained after that, that will be clear and the reason will be set out transparently. In relation to human rights and making sure that there are no abuses, that seems to be a sensible way to go.

I ask the cabinet secretary to wind up.

Humza Yousaf

I reiterate my offer to Liam Kerr in relation to amendments 35 and 36. My preference is for him not to move the amendments and to work with the Government on the matter before stage 3. However, if he moves them and the committee agrees to them, the offer will remain.

When Liam McArthur responded to Liam Kerr’s intervention, he said that what he proposes would create an alignment with DNA. However, in some cases—for example, in relation to road traffic offences—the retention period for DNA is two years and not three years, so there would not be an exact alignment under Liam McArthur’s amendment. Also, I do not think that he addressed the fact that in certain cases—this is particularly pertinent to sexual offences—a sheriff may choose to extend the retention period for the purpose of advancing justice.

Liam McArthur

Will the cabinet secretary take an intervention?

Humza Yousaf

Of course.

Liam McArthur

I think that the convener picked up on the point that we are talking about a presumption in relation to the retention periods. I do not think that there would be any expectation that that would override legitimate concerns where there was a sound case for retaining images, as happens with DNA and fingerprints.

Humza Yousaf

I take your point about it being a presumption and not a flat-out, explicit, fixed retention period. I suppose my concern about the proposal is that there is no doubt that the code of practice, without impinging on the independence of the commissioner, will look at things such as retention periods. That is why I believe that it is preferable to have the flexibility that will be afforded by a code of practice being introduced through regulations, as opposed to having something included in the bill.

Liam McArthur mentioned in his remarks on a previous amendment the fast-paced, quickly evolving nature of the technologies that we are discussing. None of us, probably, could predict what the data will look like in five, 10 or 15 years’ time, let alone what it will look like in 20 years’ time. The approach of having retention periods in the bill would create an inflexibility and rigidity that will not be created if they are in the code of practice. I reiterate my concerns about including retention periods in the bill, and I ask Liam McArthur not to move amendment 21.

Amendment 20 agreed to.

Amendment 35 moved—[Liam Kerr].

The Convener

The question is, that amendment 35 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 35 agreed to.

12:15  

Amendment 21 moved—[Liam McArthur].

The Convener

The question is, that amendment 21 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 21 agreed to.

The Convener

Amendment 22, in the name of the cabinet secretary, is grouped with amendments 23 and 25 to 29.

Humza Yousaf

Taken together, the amendments in this group seek to provide enhanced arrangements for Parliament to scrutinise the first code of practice that the commissioner produces. To accommodate the new step in the process, it has been necessary to restructure section 6 and to amend sections 8 and 9 but, ultimately, this set of amendments responds positively to a recommendation that the committee made in its stage 1 report, which sought more time for Parliament to scrutinise the content of the first code of practice and a process that would allow it to do so separately from its scrutiny of the regulations to bring the code into effect.

Amendment 26, which is the principal amendment in the group, seeks to insert a new section that provides for a further process on the first code of practice. Having gained ministers’ approval for a draft of the code, the commissioner must lay it before Parliament for its consideration, and they must have regard to any representations that are made to them within 60 days of the draft being laid. Representations can be made to the commissioner by anyone, including members of the Scottish Parliament and members of the public. In calculating the 60-day period, no account will be taken of instances when Parliament is in recess for more than four days or when it has been dissolved.

The proposed procedural step, which will apply in relation to the first code, is in addition to the existing requirement that any code can be brought into effect only by the Parliament approving affirmative regulations under section 9. That is always the final step in the process.

The other amendments in the group are consequential. Amendments 22 and 27 simply adjust the location of some provisions to allow sections 6 to 9 to set out the enhanced process in chronological order. Amendments 23, 25 and 28 adjust cross-references and text in the light of the restructuring, and amendment 29 simply ensures that reporting on the code of practice will start running from the date of the first code.

I hope that the committee will recognise that this group of amendments fulfils its wish for additional time and procedure to consider the first code of practice carefully. I make it clear that later iterations of the code would not be sent to Parliament for 60 days; rather, they would follow only the second part of the parliamentary approval process. However, that is in line with the committee’s recommendation, and it would still ensure that later iterations of the code would be approved by regulations under the affirmative procedure.

The important point here is that the commissioner will draft the code in consultation with stakeholders. After the code has been approved by the Scottish ministers, the final step is that it will be considered by Parliament, which will decide whether and when to bring it into effect. That way, we will have a code that has achieved broad consensus. In the case of the first code, there will now be the added guarantee of an additional period for parliamentary scrutiny, which will be separate from the scrutiny of the regulations to bring the code into effect.

I move amendment 22.

Amendment 22 agreed to.

Amendment 23 moved—[Humza Yousaf]—and agreed to.

Section 6, as amended, agreed to.

After section 6

Amendment 36 moved—[Liam Kerr].

The Convener

The question is, that amendment 36 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 36 agreed to.

Section 7—Effect of the code

The Convener

Amendment 6, in the name of John Finnie, is grouped with amendments 8, 37, 9, 12 and 38 to 42.

John Finnie

Amendment 6 deals with a subject that exercised the committee during the scrutiny that led to our stage 1 report. It seeks to replace the term “have regard to” with a requirement to “comply with” the code of practice.

People might find it a little strange that we have such a proposed law in front of us. In section 7(3), which is covered by my amendment 8, the bill says:

“Failure to have regard to the code of practice does not of itself give rise to grounds for any legal action.”

The legislation that we put in place needs to be robust, and those at whom it is targeted need to have due regard to it. I do not doubt the willingness of Police Scotland, as it is currently configured, to follow it, but I cannot see a difficulty with what I propose. We put in place professional oversight of important pieces of legislation that have significant impact on citizens’ human rights, and it is only right for those who make judgments to “comply with” what is in the code of practice, rather than just to “have regard to” it. That sums up amendments 6 and 8.

On the cabinet secretary’s amendment 41, I note that allowing revocation of compliance at any time would seem to fly in the face of what we should be doing, so I will not support it. I hope that members will support my amendment 6.

I move amendment 6.

Humza Yousaf

I support John Finnie’s amendments 6, 9 and 12, which seek to replace the words “have regard to” with the words “comply with” in connection with how the code of practice is to be observed. Those amendments complement my amendments in the group, and I ask members to support them as well as mine.

My amendments 38 to 42, taken together, will enhance the commissioner’s power to deal with failures to comply with the code of practice. In lodging the amendments, I have been mindful of the committee’s desire to see stronger enforcement in the bill. That was a common theme—it was almost a constant theme—in the stage 1 debate, and I said at that time that I would reflect carefully on what had been said on the issue by John Finnie and almost every other member who spoke. I believe that the new provisions that I propose represent the best means of ensuring compliance with the code.

Amendment 38, which strengthens the commissioner’s powers, operates in conjunction with John Finnie’s amendment 6. Amendment 38 will enable the commissioner to issue a compliance notice to a person whom they consider has failed or is failing to comply with the code of practice. That could be done instead of or as well as reporting on such a failure under the existing powers in the bill for the commissioner to name and shame.

Amendment 39 specifies the content of a compliance notice, stating that it must include matters such as the steps that must be taken to address the breach of the code and the timescales for doing so.

Amendment 40 will allow the commissioner to vary a compliance notice in order to allow more time for compliance or, with the consent of the person to whom the notice was issued, to change the steps that are required to be taken.

Amendment 41 will allow the commissioner to revoke a compliance notice. To respond to the concern that John Finnie expressed, I note that it is about the commissioner having flexibility. It could not be done unilaterally by anyone else.

Amendment 42 will allow the commissioner to report to the Court of Session a refusal or a failure without reasonable excuse to comply with a compliance notice. It will allow the court, after hearing evidence or representations on the matter, to make an order to enforce a compliance notice, or to deal with the refusal or failure to comply with the notice as if it was contempt of court—an issue that I note the committee will come to later. As the committee may recall, the court may also do both of those things in relation to a failure or refusal to comply with an information notice under section 12.

On compliance with the code of practice, my view is that the commissioner’s existing powers to make recommendations and to follow up by reporting to Parliament on those matters are sufficient for all but the most extreme cases. I therefore hope that the additional powers that are set out in my amendments will be used rarely, if ever. However, I recognise the committee’s concerns and I wanted to provide reassurance that further enforcement action can be taken.

Amendment 37 changes section 7(3) as a consequence of amendment 6, such that all references are to complying with the code of practice. If amendment 37 is agreed to, section 7(3) will state:

“Failure to comply with the code of practice does not of itself give rise to grounds for any legal action.”

John Finnie’s amendment 8 seeks to remove section 7(3). I wish it to remain because, when read with section 7(2), it will make it clear that, although a court or tribunal

“must take the code of practice into account when determining any question to which the code is relevant”,

a failure to comply with the code will not in itself give rise to grounds for legal action. Section 7(3) is there as part of a package with section 7(2).

It is common for acts to expressly provide, for the avoidance of any doubt, that breach of a code does not in itself give rise to criminal or civil liability. Indeed, the committee approved that in relation to the stop and search code under the Criminal Justice (Scotland) Act 2016.

John Finnie

With regard to my amendment 8, is it your view that, on a stark reading of subsection 7(3),

“Failure to have regard to the code of practice”

could give rise to legal proceedings?

Humza Yousaf

I refer to the points that I have made. Amendment 8 would remove the certainty without providing for an accessible remedy to apply. As I said, it is not uncommon for the approach to be stated expressly in acts, so there is precedent for it. To be clear, I note that, under the new compliance notice that I propose, a failure to comply with the code will not in itself give rise to civil or criminal proceedings. Instead, as I think John Finnie is aware, it will give rise to a compliance notice. If that is not complied with, it will potentially give rise to legal action in the form that I set out in amendment 42. I hope that that gives John Finnie some reassurance that there is explicit provision for an accessible civil remedy.

I appreciate that John Finnie wants the code to be complied with and to ensure that there can be a consequence for non-compliance. I agree with him on that, but I suggest that my amendments on compliance notices provide for it more effectively. I therefore ask him not to move amendment 8 and to support my amendment 37 instead.

The Convener

There was considerable debate at stage 1 about the “have regard to” provision, and I note that John Finnie has come up with the new wording “comply with”. On the basis that both the cabinet secretary’s amendment 37 and John Finnie’s amendment 6 will strengthen adherence to the code, I think that they are both worth supporting.

I ask John Finnie to wind up and press or withdraw amendment 6.

John Finnie

It is important that due regard is given to the legislation, given the energy that has gone in to compiling it. I hope that members will support my amendment 6, and I press it.

Amendment 6 agreed to.

Amendment 24 moved—[Humza Yousaf]—and agreed to.

Amendment 7 not moved.

Amendment 8 moved—[John Finnie].

The Convener

The question is, that amendment 8 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kerr, Liam (North East Scotland) (Con)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 2, Against 7, Abstentions 0.

Amendment 8 disagreed to.

Amendment 37 moved—[Humza Yousaf]—and agreed to.

Section 7, as amended, agreed to.

Section 8—Consultation on the code

Amendment 25 moved—[Humza Yousaf].

12:30  

The Convener

The question is, that amendment 25 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 25 agreed to.

Section 8, as amended, agreed to.

After section 8

Amendment 26 moved—[Humza Yousaf].

The Convener

The question is, that amendment 26 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 26 agreed to.

Amendment 27 moved—[Humza Yousaf].

The Convener

The question is, that amendment 27 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 27 agreed to.

Section 9—Bringing the code into effect

Amendment 28 moved—[Humza Yousaf].

The Convener

The question is, that amendment 28 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The Convener

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 28 agreed to.

Section 9, as amended, agreed to.

Section 10—Report on the code of practice

Amendment 29 moved—[Humza Yousaf]—and agreed to.

Section 10, as amended, agreed to.

Section 11—Power to gather information

Amendment 9 moved—[John Finnie]—and agreed to.

Section 11, as amended, agreed to.

Section 12—Failure to comply with an information notice

The Convener

Amendment 10, in the name of John Finnie, is grouped with amendments 11, 1 and 2.

John Finnie

Legislation can sometimes be a mystery. I have found section 12(2) confusing. It says:

“The Commissioner may also report the matter to the Court of Session where the Commissioner considers that a person who is mentioned ... is likely to do any of the things”.

That seems to me to be a peculiar way of dealing with matters. For that reason, I seek to remove the provision.

I move amendment 10.

Gordon Lindhurst (Lothian) (Con)

My amendments 1 and 2 relate to section 12. In the stage 1 debate, I raised with the cabinet secretary the possibility of someone being held in contempt of court for failing to comply with an information notice issued by the commissioner. The cabinet secretary kindly wrote to me following the debate in response to the issues that I raised, for which I thank him, so I will not go into my amendments in much detail.

The cabinet secretary has said that there have been a number of similar, if not identical, provisions in acts in the past 20 years. However, the provision in the bill seems to be somewhat draconian, because it relates to a failure to follow through not on a court order, but on an information notice from the commissioner. Even if there are similar provisions in other acts, that is not necessarily the appropriate way to deal with it, because contempt of court is a serious matter. If someone is in breach of an order of a court, one knows what one is dealing with, but if they are just in breach of an information notice from the commissioner, I am not sure that that falls into the same category.

I am interested to know why the cabinet secretary feels that that is the appropriate way to deal with the enforcement of those provisions of the bill and to ensure that they are complied with. I still do not see that it is appropriate to have contempt of court provisions in the bill, and that is why I lodged amendments 1 and 2.

Humza Yousaf

I will address John Finnie’s amendments 10 and 11 before turning to Gordon Lindhurst’s amendments 1 and 2. I recognise that amendments 10 and 11 arise from concerns that were raised in the stage 1 debate regarding how the commissioner could use the power in section 12 to refer matters to the court based simply on their consideration of what a person was likely to do, as John Finnie mentioned in his remarks.

However, the power in section 12(2) is important, particularly in relation to section 12(1)(c). For example, if the commissioner had reason to believe that a person was going to destroy important information, they could use the power in section 12(2) to apply to the Court of Session for an order to prevent that. If the commissioner had to wait until it had happened before they could go to the court, it would be too late. If an application is made to the court, it will hear evidence on the matter and it will need to be convinced that it is appropriate to take action, so it will not be just about what the commissioner believes.

It should also be noted that the power has precedent. Schedule 2 of the Scottish Commission for Human Rights Act 2006 provides the Scottish Human Rights Commission with the same ability to refer a matter to the court for consideration where it considers that it is likely that its equivalent information notices will be breached. I hope that members are reassured by my explanation of why the provision is included in the bill, and I ask John Finnie not to—

John Finnie

Will the cabinet secretary take an intervention before he concludes?

Humza Yousaf

I will.

John Finnie

The cabinet secretary rightly mentioned section 12(1)(c), which includes the wording

“alters, suppresses, conceals or destroys, without reasonable excuse”.

Those are clearly serious matters, and that shows the importance of the legislation, so I welcome the cabinet secretary’s explanation. It is important to get on the record the seriousness of the issues that could give rise to use of the power. That is why I am pleased that we have agreed that people will have to “comply with” the code, rather than just “have regard to” it.

Humza Yousaf

I thank John Finnie for his remarks and the work that he has done in relation to strengthening the provision so that the code of practice must be complied with, as opposed to people having regard to it. Given everything that I have said, I hope that he will not press amendment 10 and not move amendment 11.

I turn to Gordon Lindhurst’s amendments 1 and 2. I acknowledge the concerns that he has raised. I reflected carefully on and discussed with my officials the issue of holding someone in contempt of court. As Gordon Lindhurst mentioned, I wrote to him—as well as to Liam Kerr, who also raised concerns about the matter—on 21 January to offer further clarification. I recognise that the amendments have been lodged despite my reassurances, and I know that Gordon Lindhurst is still seeking some reassurance about what he considers to be a heavy-handed approach, so I will try to provide that.

The first thing to say is that it will be for the court alone, after hearing any evidence or representations on the matter, to find someone to be in contempt for failing or refusing to provide information. There is no suggestion that it would be for the commissioner to find someone to be in contempt of court. It is envisaged that a person would be found to be in contempt of court only where there had been an egregious failure to provide information to the commissioner—it would happen only in cases of really serious breaches.

Contempt of court is an important sanction in relation to situations where someone has already destroyed information that they were required to produce. Perhaps this point will answer Gordon Lindhurst’s question directly. In cases in which someone has destroyed such information, it is extremely unlikely that the court would grant an order for the production of that information, because it would know that the information had already been destroyed. How could the person produce it? The court therefore needs to have some form of sanction available to it, or people would potentially be able to destroy information with impunity.

Gordon Lindhurst

Is the cabinet secretary saying that it would only be in cases where the court had issued an order in relation to an information notice that the sanction of contempt of court could be used, or could it be used where the commissioner had issued a notice but the court had not issued an order in relation to that?

Humza Yousaf

It would happen on the back of the issuing of a compliance notice by the commissioner, rather than by the court. It would then be for the court to determine, after hearing representations and evidence, whether the person was in contempt of court.

As I said in my letter to Gordon Lindhurst, the proposed sanction is not unusual. It is a power that the court would be trusted to use responsibly, and it is one for which there is precedent. Such powers exist under the Scottish Commission for Human Rights Act 2006 and the Freedom of Information (Scotland) Act 2002. In those cases, the court has the power to deal with the matter as contempt. The court is in a similar position in relation to obstruction of the Scottish Public Services Ombudsman under section 14 of the Scottish Public Services Ombudsman Act 2002.

I hope that Gordon Lindhurst is reassured by my explanation of why such a provision is included in the bill, and I ask him not to move amendments 1 and 2.

John Finnie

The discussions that we have had this morning have been helpful. We have strengthened the bill, particularly with regard to the requirement to comply and the status that has been afforded to that. I thank the cabinet secretary for his helpful comments on my amendment 10, in the light of which I do not wish to press it.

Amendment 10, by agreement, withdrawn.

Amendment 11 not moved.

Amendments 1 and 2 not moved.

Section 12 agreed to.

Sections 13 and 14 agreed to.

Section 15—Reports and recommendations

Amendment 30 not moved.

Amendment 12 moved—[John Finnie]—and agreed to.

Amendment 13 not moved.

Section 15, as amended, agreed to.

Sections 16 and 17 agreed to.

After section 17

Amendments 38 to 42 moved—[Humza Yousaf]—and agreed to.

Sections 18 to 22 agreed to.

After section 22

The Convener

Amendment 31, in the name of Liam McArthur, is in a group on its own.

Liam McArthur

I am conscious of time, so I will try to be as brief as possible.

The independent advisory group recommended that an ethics advisory group be established as part of the oversight arrangements. The remit of the group would be to work with the commissioner and others to promote ethical considerations in acquisition, retention, use and disposal of biometric technologies and biometric data.

The Scottish Government accepted that recommendation and committed to developing proposals for its remit and membership in discussions with stakeholders, drawing on the connections and relationships that have been developed through the work of the IAG.

However, the bill does not provide for that. The Scottish Human Rights Commission said that that is “regrettable” and that

“the IAG report rationalised the need for such a group quite clearly. They drew on evidence of the success of the Biometrics and Forensic Group in England and Wales”.

The cabinet secretary has said that he will form an independently chaired reference group to deal with ethical issues, which

“will be established at around the same time that the new biometrics commissioner”—[Official Report, Justice Committee, 16 November 2019; c 16.]

takes office. That is welcome, as far as it goes, but the centrality of questions about ethics to ensuring public confidence in the framework and the oversight arrangements that we are putting in place demands the establishment of an ethics advisory group on a statutory footing—as is proposed in my amendment 31, the debate on which I look forward to.

I move amendment 31.

12:45  

John Finnie

I warmly welcome amendment 31. As Liam McArthur said, an ethics advisory group was the independent advisory group’s recommendation. I agree with the Scottish Human Rights Commission that it is, for a number of reasons, “regrettable” that that recommendation has not been taken up. This is an opportunity to understand the role that bodies such as the commissioner play in how the police might go about deployment of, for example, digital triage devices—so-called cyberkiosks. Such a group would be a good and inclusive way of ensuring that a broad range of views would be taken on board. I strongly support amendment 31.

Fulton MacGregor

I have some sympathy with amendment 31. It is probably fair to say that everybody on the committee would want the same outcome. However, I will not support the amendment because I am not sure, at this stage, that having such a group in legislation is required, although I hear what Liam McArthur and John Finnie have said. Would we be legislating on something about which we have already had assurances from the cabinet secretary? Perhaps bringing such a group into legislation would blur boundaries and roles. In a bill to establish the commissioner, we should give that person the full role of picking the remit for an ethics advisory group.

I will not support amendment 31, based on my not being sure whether its proposed provisions should be in legislation at this stage, but I am not opposed to the premise of the amendment.

The Convener

I believe that the committee unanimously supported the recommendation at stage 1. I am interested to hear the cabinet secretary’s views.

Humza Yousaf

Although I understand the good intentions of amendment 31, I cannot support it in its current form.

The way that amendment 31 provides for the ethics advisory group to function is somewhat convoluted, with decision making on issues relating to membership being split between the commissioner, Scottish ministers and Parliament. For example, the regulations that would be made by ministers—and, therefore, scrutinised by Parliament—would specify the number of members. However, the commissioner would then appoint the members. Given that the commissioner is to be an independent office holder who will be accountable to the Scottish Parliamentary Corporate Body, I am not convinced that it is appropriate for ministers to be involved at all. The amendment would leave a host of matters to be decided in regulations by ministers.

In addition, the amendment specifies the matters that the group is to provide advice on. In principle, I agree that that is reasonable. However, in terms of future proofing, that could be restrictive or confusing. For example, amendment 31 calls the group the “Ethics Advisory Group” and tasks it with oversight on ethics. However, in proposed subsection (3)(b), it then requires the group also to advise on legal issues that might arise.

As it stands, amendment 31 gives a mixed message about the remit of the proposed group. There is also no ability for the remit to be adjusted in the future, because the regulation-making powers that are set out in proposed subsection (6) are not wide enough to cover the remit.

In my response to the stage 1 report, I explained to the committee that I fully support the formation of an advisory group and will honour the public commitment that was made to establish such a group. I was, however, not convinced by calls that were made during stage 1 that the group should be placed on a statutory footing, and the independent advisory group on biometric data previously made no such recommendation. I would prefer that the commissioner, once in post, consults and secures a broad range of views on such matters in order to allow proper discussion. The commissioner could then decide which matters he or she needs advice on, given that any such group should report directly to the commissioner. That would allow the necessary flexibility in how the group should operate.

Finally, there are a number of technical issues with the amendment—principally about the consistency of language and cross-references to the source of the regulation-making power, which is found in proposed subsection (6), not proposed subsection (7). I therefore ask Liam McArthur not to press amendment 31, but am happy to make him the offer—considering the technical challenges and the challenges that are presented by mixed messages about the responsibilities of Parliament, the commissioner, and ministers—to work with him to agree a suitable amendment ahead of stage 3.

Liam McArthur

I start again by thanking everybody who has contributed to the debate. Convener—you were right when you reminded the committee of the unanimous recommendation that it made at stage 1, and of the recommendation from the advisory group.

John Finnie was right to flag up cyberkiosks, which brought into stark relief issues of ethics and the legal framework. There is an overlap in that the language that the cabinet secretary suggested is slightly “confusing” captures very well some of the issues that have been thrown up by the proposed roll-out of cyberkiosks.

We have had assurances from the cabinet secretary about implementing measures to reflect what he understands to be the recommendation from the advisory group, but by putting the recommendation on a statutory footing by including it in the bill, we would set it firmly at the centre of how we believe governance and oversight need to function. Although I welcome the offer from the cabinet secretary to work with me during the next few weeks, ahead of stage 3, to tidy things up, it is important that the committee agrees to amendment 31 at stage 2. On that basis, I press amendment 31.

The Convener

The question is, that amendment 31 be agreed to. Are we agreed?

Members: No.

The Convener

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The Convener

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 31 agreed to.

Section 23—Meaning of “biometric data”

The Convener

Amendment 32, in the name of the cabinet secretary, is grouped with amendments 33 and 34.

Humza Yousaf

In its stage 1 report, the committee asked me to consider how the definition in section 23 could keep pace with future developments in biometrics. I believe that the definition is already broadly drawn. However, amendment 33 will insert a power for Scottish ministers to change or clarify the meaning of “biometric data” by regulations. Amendment 34 will make that power subject to affirmative procedure, which will allow Parliament to scrutinise fully any changes that the Scottish ministers propose to make to the definition.

Amendment 32 will make a minor amendment to the definition to clarify that it includes not only photographs or other recordings of an individual’s full body, but of any part of the body—for example, an arm that might have a distinguishing mark, such as a tattoo.

I move amendment 32.

Amendment 32 agreed to.

Section 23, as amended, agreed to.

After section 23

Amendment 33 moved—[Humza Yousaf]—and agreed to.

Section 24 agreed to.

Section 25—Regulations

Amendment 34 moved—[Humza Yousaf]—and agreed to.

Section 25, as amended, agreed to.

Sections 26 and 27 agreed to.

Schedule 2 agreed to.

Sections 28 and 29 agreed to.

Long title agreed to.

The Convener

That ends stage 2 consideration of the bill. I thank the cabinet secretary for attending.

We have gone on a little bit longer than expected in order to get through all the stage 2 amendments. On that basis, does the committee agree to take the outstanding agenda items at our next meeting, which will be advised by the clerks?

Members indicated agreement.

Meeting closed at 12:55.  

The Presiding Officer (Ken Macintosh)

We turn to stage 3 proceedings on the Scottish Biometrics Commissioner Bill. Members should have with them the bill as amended at stage 2, the marshalled list and the groupings of amendments.

As normal, the division bell will sound and proceedings will be suspended for five minutes for the first division of the afternoon. The period of voting for the first division will be 30 seconds. Thereafter, the period of voting for the first division after a debate will be one minute.

Members who wish to speak in the debate on any group of amendments should press their request-to-speak buttons as soon as I call the group.

I turn to the bill and the marshalled list.

Section 2—Functions

The Presiding Officer

Amendment 19, in the name of John Finnie, is grouped with amendments 23 to 26.

John Finnie (Highlands and Islands) (Green)

As we know, the pace of technological change in the field of biometric technologies is rapid. That is why it is vital that biometric technologies are expressly mentioned in the bill.

I thank the Cabinet Secretary for Justice for working with me to refine my stage 2 amendments. My amendments now make it clear that biometric technologies are as much a part of the commissioner’s scrutiny arrangements as biometric data, as I shall explain.

Amendment 19 requires that, when reviewing the law, policy and practice relating to biometric data, or promoting public awareness of powers and duties that relevant policing bodies have in relation to biometric data,

“the Commissioner is to have regard to the technology used or capable of being used for the purpose of acquiring, retaining, using or destroying biometric data.”

The phrase “capable of being used” is very important, as it includes technology that is available for use but not yet deployed, such as facial recognition technology. The legal and ethical use of technology by Police Scotland is, of course, a matter that I and other members view as being of great importance, given its impact on human rights, such as the right to privacy. It is therefore important that the new commissioner is able to provide views on such matters through reviews, the code of practice, reports and recommendations.

With that in mind, amendment 23 makes it explicit that, in a report that is issued under section 15, the commissioner may make a recommendation in relation to technologies that are used or are capable of being used to collect, retain, use or destroy biometric data.

Amendment 24 provides that, where such a recommendation is made, the commissioner “must” rather than “may” impose a requirement to respond on the relevant policing body. That is important for promoting transparency and accountability.

The amendments work with the existing provisions in section 16 so that the person on whom a requirement to respond is imposed must provide a written statement to the commissioner that sets out the action that they are taking or not taking in response to the recommendation. Thereafter, the commissioner is required to publish the written statement and lay it before Parliament, as is already provided for in section 17.

Amendment 25 clarifies that, where a recommendation that is issued under section 15 does not relate to biometric technologies, the commissioner can choose whether to impose a requirement to respond.

Amendment 26 is a minor consequential amendment associated with amendment 24.

Taken together, the package of amendments will make for stronger scrutiny arrangements and greater transparency around the use and potential use of biometric technologies.

I move amendment 19.

The Cabinet Secretary for Justice (Humza Yousaf)

At stage 2, John Finnie agreed to work with me to refine his intended amendments, which aimed to make explicit reference in the bill to biometric technologies. I am pleased that we have been able to build on Mr Finnie’s original amendment to make it even more effective in its coverage and relevance as far as the commissioner’s general functions are concerned. I particularly highlight the fact that, as Mr Finnie has just explained, amendment 19 now covers both technology that is in use and—this is important—technology that is capable of being used. Mr Finnie has already referred to facial recognition technology, which is not currently deployed by Police Scotland but certainly will be available for use and could be deployed by it in the future. The commissioner could include guidance on facial recognition technology in the code of practice or carry out a review of the law that relates to the use of that technology.

I very much support this group of amendments and I urge other members to support them, too.

The Presiding Officer

Does John Finnie wish to add anything further?

John Finnie

I have nothing to add.

Amendment 19 agreed to.

The Presiding Officer

Group 2 is on minor and technical amendments. Amendment 20, in the name of the cabinet secretary, is grouped with amendments 21, 9, 22, 12, 27 and 28.

Humza Yousaf

The amendments in the group in my name make minor and technical changes to the bill. Amendments 20 and 21 adjust section 2(7), to move the definition of “children and young persons” from after the definition of “vulnerable persons” to before it. That simply allows the list to be arranged alphabetically—we know that civil servants love ordering lists alphabetically. The definition itself remains unchanged, and the amendments are for tidying-up purposes.

In a similar vein, amendments 22 and 27 make minor adjustments to references to the code of practice at various points in the bill.

Amendment 28 adjusts paragraph 11 of schedule 1 so that the commissioner must obtain the consent of the Scottish Parliamentary Corporate Body in relation to the number of staff that the commissioner may appoint. The amendment provides a means for the SPCB to manage staff numbers to assure the efficiency of the commissioner’s office.

Amendments 9 and 12, in the name of Liam Kerr, are technical amendments that I am happy to support. Section 6A lists a number of issues that the commissioner is to have regard to in preparing the code of practice. Those matters are currently termed “principles”, but they are not framed as principles. Therefore, amendments 9 and 12 replace the reference to “principles” while ensuring that regard is to be had to the importance of those matters. The amendments also remove the reference to revised codes of practice so that revised codes are dealt with in a consistent way in the bill, as provided for by my amendments 22 and 27.

I thank Liam Kerr for agreeing at stage 2 to work with me and my officials on the amendments and for getting to a very constructive space in that regard.

I move amendment 20.

The Presiding Officer

I call Liam Kerr to speak to amendment 9 and the other amendments in the group.

16:30  

Liam Kerr (North East Scotland) (Con)

I thank the cabinet secretary for indicating his support for amendments 9 and 12 in my name. As the group title suggests, they are technical amendments that refine my stage 2 amendments to section 6A.

At stage 2, I inserted a requirement for the commissioner to “have regard to” certain important, high-level principles when preparing a code of practice. New section 6A was inserted into the bill as a result. Through amendment 12, I propose to change the opening words in section 6A so that it provides that, when preparing

“a draft code of practice, the Commissioner must have regard to the importance of”

the matters that are listed in that section—instead of referring to those matters as “principles”. That is because I recognise, as the cabinet secretary has said, that the matters that are listed in that section are not actually framed as principles.

Amendment 12 preserves the importance of the matters that are listed, including

“promoting and protecting human rights”

and

“ensuring the safety of individuals and communities”,

and it still requires the commissioner to “have regard to” them when preparing a code of practice.

John Finnie

The member will recall that at stage 2 we amended the bill to replace the phrase “have regard to” with the phrase “comply with”. He will remember all the arguments about strengthening the bill in that regard.

I am not persuaded that moving to a situation where we have

“regard to the importance of”

matters is anything other than a downgrading of a principle. It might just be about semantics, and I do not mean to be pedantic with the member on the issue. However, it seems to me that protecting human rights and the individual’s right to privacy are core principles, rather than matters that someone should simply have regard to. Will the member clarify that, please?

Liam Kerr

Yes, of course. Section 6A, as originally drafted, spoke to “principles”; it stated that the commissioner had to

“have regard to the following principles”.

However, the items on the list of matters that were designated as principles were not in fact framed as principles. Amendment 12, which redrafts the section, sets out that what follows are not to be considered to be principles—because they are not. It is a semantic point. They are, in fact, statements of what must be complied with. Does that make sense to Mr Finnie? Have I explained that reasonably well?

John Finnie

Yes—to a point. However, surely it is a sound principle that we should all be promoting and protecting human rights, rather than having

“regard to the importance of”

them. I am genuinely trying to understand this, because I want the process to be consensual.

Liam Kerr

I am grateful to Mr Finnie, because this is an important point. Section 6A originally referred to the commissioner having

“regard to the following principles”,

but the matters referred to in subsections 6A(a) to (d) are not in fact principles; they are not in the form of principles as such. It would, therefore, be semantically wrong to keep referring to them as “the following principles”, because they are not principles. It is entirely a semantic point. Amendment 12 tidies that up so that, in preparing

“a draft code of practice, the Commissioner must have regard to the importance of”

the following things, which are not principles, because they have not been drafted as principles. I guess that I am asking Mr Finnie to trust me on this one.

The reason for the change is a semantic one. As drafted at stage 2, the provision referred to “principles”, which are not principles. We will see whether Mr Finnie goes with me on this one.

Amendment 12 also deletes the specific mention of revised codes in order to allow them to be dealt with in a uniform way across the bill, as the cabinet secretary proposes. Crucially, however, it remains the case that regard must be had to the importance of matters that are set out in section 6A when a revised code of practice is being prepared.

Amendment 9, on the other hand, is a consequential change. Because the reference to “principles” would be removed from section 6A, the reference to “principles” in section 6(1) would also be removed.

I thank the cabinet secretary for working with me to refine the provisions. I ask members to support amendments 9 and 12.

The Presiding Officer

I call the cabinet secretary to wind up on this group.

Humza Yousaf

I have no further comments.

Amendment 20 agreed to.

Amendment 21 moved—[Humza Yousaf]—and agreed to.

Section 5—Duty to comply with directions

The Presiding Officer

Group 3 is on an advisory group. Amendment 6, in the name of Liam McArthur, is grouped with amendment 18.

Liam McArthur (Orkney Islands) (LD)

I hope to continue the generally consensual tone of previous contributions. Amendments 6 and 18 seek to put the advisory group on a statutory footing. The recommendation to do so was unanimously supported by the committee, as well as by many of the stakeholders and witnesses who gave evidence, yet it appeared nowhere in the bill as it was originally drafted—an omission that the Scottish Human Rights Commission described as “regrettable”. At stage 2, the cabinet secretary committed in principle to putting the advisory group on a statutory footing if work could be done to revise the relevant wording. I accepted that proposal, and amendments 6 and 18 reflect our collaborative work.

New section 22A will allow the commissioner to make decisions on the governance, remuneration and membership of the group, with the consent of the SPCB where appropriate. It will also allow for the group to provide advice on all matters relating to the commissioner’s functions. I believe that that better reflects the bill’s approach in recognising the need to respond to the rapidly changing biometrics environment, which John Finnie mentioned.

I thank the cabinet secretary and his officials for their assistance in coming to this point. I look forward to any further debate, and I encourage members to support my amendment.

I move amendment 6.

The Presiding Officer

No other member has indicated that they wish to speak, so I invite the cabinet secretary to respond.

Humza Yousaf

At stage 2, Liam McArthur agreed to work with me and my officials to refine the proposal in his amendment 6, the aim of which is, as he said, to establish an advisory group to provide the commissioner with advice on legal and ethical issues relating to biometric data and technologies. I am pleased that we were able to make constructive adjustments to the stage 2 amendment to simplify how the membership of and remuneration and governance arrangements for the group will be determined. They also allow for greater flexibility in the group’s remit.

I have always supported the setting up of such a group and I recognise the importance of the commissioner being provided with advice that is not only independent, which is crucial, but also well informed. My concern was that, in committing that to legislation, we would risk losing flexibility, but Liam McArthur’s amendment 18 ensures that matters will be kept as open and flexible as they can be. It also removes the opportunity for Scottish ministers to steer the operation of the group and instead places the responsibility for decision making with the commissioner, which is exactly as it should be. It is vital to the credibility of the group that it should remain—and, of course, be seen to be—impartial.

I also agree that there should be a role for the Scottish Parliamentary Corporate Body in overseeing and approving the appointments process, the number of members and the remuneration and allowances of the group, in order to ensure transparency and value for money.

I thank Liam McArthur for the constructive way in which he has approached amendments 6 and 18. We were pleased to come to a resolution on them, and I hope that members will support them.

The Presiding Officer

Does Liam McArthur wish to make any concluding remarks?

Liam McArthur

No, thank you, Presiding Officer.

Amendment 6 agreed to.

Section 5A—Complaints procedure

The Presiding Officer

Group 4 is on a complaints procedure. Amendment 7, in the name of Margaret Mitchell, is grouped with amendment 5.

Margaret Mitchell (Central Scotland) (Con)

Amendment 7 replaces in full the amendment that I lodged at stage 2, which required the commissioner to put in place a procedure by which a person might make a complaint to the commissioner about the handling of their biometric data. My intention was to ensure that members of the public had the ability to complain directly to the commissioner if they believed that such data had not been dealt with properly by police bodies that fall within the oversight of the commissioner. That remains my intention. However, I have listened carefully to the concerns that were expressed by both the Cabinet Secretary for Justice and the Information Commissioner’s Office that it should be clear that complaints that are made via that procedure are to relate to breaches of the code of practice. I have worked with the cabinet secretary so that the provisions now make that clear.

The remainder of amendment 7 is very similar to my stage 2 amendment and it broadly achieves the same aim, as I shall explain. Amendment 7 requires the commissioner to “provide for” a procedure so that it is clear that they are not only to establish a procedure, but to retain it. The procedure is to allow an individual or their representative to make a complaint about a breach of the code of practice in relation to that individual’s biometric data. The procedure is to apply to complaints in respect of any body that is subject to the code of practice under section 7(1). That flexibility will allow the provision to cover any additional bodies that might be made subject to the code later by means of regulations under section 7(4). The procedure is to be available whether or not the individual has already instigated a complaint through the complaints mechanism of the body that they are complaining about.

In determining the procedure, the biometrics commissioner is to consult various persons, including the Information Commissioner. The provision recognises the importance of the Scottish biometrics commissioner and the Information Commissioner’s Office working together to ensure that complaints are directed to the appropriate commissioner. The procedure that is put in place by the biometrics commissioner will deal with complaints regarding failures to comply with the code, while the Information Commissioner’s Office will continue to deal with complaints about infringements of data protection legislation. Amendment 7 therefore sets out comprehensive arrangements to enable individuals to raise complaints relating to the code directly with the commissioner.

Amendment 5 moves section 5A so that it will appear after section 10, among the sections that deal with the code of practice. Given that the complaints procedure will now clearly be about complaints relating to a breach of the code of practice, that is a more suitable location.

I move amendment 7.

James Kelly (Glasgow) (Lab)

I support the amendments in the group. If the biometrics commissioner is to have the confidence of the public, it is important to have in place appropriate processes that will underpin the commissioner’s work. One of the gaps in the bill as introduced was the lack of a complaints procedure, but stage 2 amendments addressed that. I acknowledge the work that has been done with the cabinet secretary’s team, and the stage 3 amendments that Margaret Mitchell lodged refine and clarify the complaints procedure so that it will be clear which complaints will go to the Information Commissioner’s Office and which will go to the biometrics commissioner. The overall package of amendments at stages 2 and 3 makes the bill stronger in that area.

Humza Yousaf

As members might know, I did not support the amendment that Margaret Mitchell lodged at stage 2 that required the biometrics commissioner to set up a complaints procedure. At that time, I was concerned that it could lead to duplication or disagreement between the Information Commissioner’s Office and the Scottish biometrics commissioner in relation to complaints about biometric data, because the amendment did not delimit the role of the biometrics commissioner and it would have allowed them to deal with complaints about breaches of data protection law that should properly be dealt with by the Information Commissioner’s Office.

I am pleased that Margaret Mitchell not only took my concerns on board but worked constructively with me and my officials and took on board the concerns of the Information Commissioner’s Office as set out at stage 2. Her stage 3 amendments limit the complaints procedure, quite rightly, to breaches of the code of practice. The amendments in the group also fix a number of technical points. I thank Margaret Mitchell for working with me to refine the amendments at stage 3. I will support amendments 7 and 5 and I urge others to do so, too.

Margaret Mitchell

I welcome the cabinet secretary’s endorsement of the amendments, and I thank him and his officials for working collaboratively with me to improve them. I think that we all agree that there should be a clear process for individuals to complain about breaches of the code of practice that directly affect them. Happily, the amendments that I lodged do precisely that.

Amendment 7 agreed to.

Amendment 5 moved—[Margaret Mitchell]—and agreed to.

Section 5B—Review of the Commissioner’s functions and powers

16:45  

The Presiding Officer

Group 5 is on post-legislative scrutiny. Amendment 8, in the name of Liam McArthur, is the only amendment in the group.

Liam McArthur

Amendment 8 follows my stage 2 amendment allowing for a process of review. Amendment 8 fine tunes what was agreed to at stage 2 by making minor drafting changes and altering the timing requirements so that the reviews can be linked to the commissioner’s strategic plan. If a review is considered unnecessary, my amendment would also require a statement to be made to set out the rationale for that.

As I said at stage 2, new biometric technologies are being developed at a pace that primary legislation cannot match. It is therefore essential to put in place a framework and mechanisms for reviewing and updating. Amnesty Scotland, the Law Society of Scotland, the Open Rights Group and the Scottish Human Rights Commission all raised concerns about the commissioner’s scope in their evidence. That may need to be revisited in due course. For now, I am, again, grateful to the cabinet secretary and his officials for working with me to put in place measures that will at least allow reviews to happen.

As the Law Society said in its briefing, the reviews should be seen not as a drain on resources but as

“necessary checks to ensure the high degree of transparency of the role which is required.”

However, I accept that the most important thing is that the reviews are capable of responding to circumstances. In some cases, that may mean that a review is not required.

I move amendment 8.

Humza Yousaf

At stage 2, Liam McArthur agreed to work with me to refine his amendment to require the Scottish ministers to undertake a review of the commissioner’s remit and functions at recurring intervals.

As I said at stage 2, post-legislative scrutiny is, of course, extremely important. I also said that I do not think that the bill needs to provide for it and that that is a matter better left to ministers and Parliament to determine without being tied to predetermined periods. However, I recognise that the Parliament wants to legislate on that aspect. I respect that, and I was keen to revisit the amendment to ensure that it works sensibly and in a way that achieves the most effective scrutiny possible.

In adjusting the original amendment, I am pleased that Liam McArthur recognises the benefit of linking the timing of the first post-legislative review to the end of the first strategic planning period rather than two or three years after royal assent. That allows the examination of the commissioner’s functions to be more meaningful and to consider whether the commissioner has been able to achieve all that they set out to achieve.

Amendment 8 also recognises that there may be times when it is not necessary to conduct subsequent reviews, in which case the Scottish ministers will be able to publish a statement to that effect and to lay that before Parliament. The amendment allows for a commonsense approach while retaining the need for transparency, as Parliament would be able to question ministers about their decision not to conduct a review.

I support Liam McArthur’s amendment 8, and I urge all members to do likewise.

The Presiding Officer

Does Liam McArthur want to make any concluding remarks?

Liam McArthur

I thank the Government for its support. I press amendment 8.

Amendment 8 agreed to.

Section 6—Code of Practice

Amendment 9 moved—[Liam Kerr]—and agreed to.

The Presiding Officer

Group 6 is on the code of practice and retention periods. Amendment 10, in the name of Liam McArthur, is grouped with amendment 11.

Liam McArthur

Amendments 10 and 11 are, again, a revised version of amendments that I pressed at stage 2. They have been proposed in recognition of the fact that there is a gap in the regulation of retention periods of biometric data.

Although DNA and fingerprints are regulated under the Criminal Procedure (Scotland) Act 1995, photos and other forms of biometric data are not. During the passage of the bill, research by the Scottish Liberal Democrats found that, since 2014, more than 375,000 images had been supplied to the police national database from Police Scotland’s criminal history system. Those images were uploaded without a clear legislative requirement for their deletion in the event of the person pictured being found innocent.

I recognise that facial recognition could be valuable for modernising how the police investigate crime but, unregulated, it represents a potentially serious threat to human rights and civil liberties. I consider that my provisions will provide a safeguard for those liberties and the necessary framework to allow for proportionate and legitimate use of the technologies.

The Ada Lovelace Institute found that

“People fear the normalisation of surveillance but are prepared to accept facial recognition technology when there is a clear public benefit, provided safeguards are in place.”

In evidence to the Justice Sub-Committee on Policing, Duncan Sloan, the temporary assistant chief constable, said that the current rules on what the police can do with images of the public are “not so clear” as the rules on fingerprints and DNA. He added that new governance arrangements

“would be valued and welcomed.”—[Official Report, Justice Sub-Committee on Policing, 16 January 2020; c 4, 5.]

Mr Sloan’s colleague, Detective Chief Superintendent Sean Scott, also supported the independent advisory group’s recommendation on a presumption for deletion of biometric data as a central part of the oversight system that is established by the bill. He stated that

“one of the IAG’s nine recommendations was about the retention periods and a presumption of deletion, and that is absolutely right.”—[Official Report, Justice Committee, 29 October 2019; c 13.]

There needs to be enough flexibility to allow for specific circumstances to be taken into consideration. However, putting retention periods in black and white will strengthen not only privacy rights but public confidence in the use of such technologies. For public authorities, that provides a much better basis on which to deploy those technologies.

I move amendment 10.

Humza Yousaf

As members might be aware, I have committed to conducting a review of retention periods once the new commissioner is in place. Therefore, I was interested in the amendments that were lodged by Liam McArthur at stage 2 that require the code of practice to provide for a presumption of a fixed three-year retention period for all biometric data.

I had a number of concerns about that, as I set out in detail at stage 2. That is why I welcome Liam McArthur’s new and more flexible amendment on retention periods, which I believe allows more nuanced rules to be provided for. In particular, it will allow different periods to be specified in different cases and will avoid our having to settle now on the period that must be specified.

The new amendment will also ensure that the provision that the code of practice is required to make will be focused only on cases where there is an existing legislative gap. That will help to avoid the risk of contradictory legal provision being made, as it will avoid the code being required to set out rules on retention periods for types of biometric data that are already suitably covered by our legislation.

I support Liam McArthur’s amendments 10 and 11, and I urge members to vote in favour of them.

Amendment 10 agreed to.

Amendment 22 moved—[Humza Yousaf]—and agreed to.

Amendment 11 moved—[Liam McArthur]—and agreed to.

Section 6A—Code of practice: principles

Amendment 12 moved—[Liam Kerr]—and agreed to.

Section 15—Reports and recommendations

The Presiding Officer

Group 7 concerns reporting on failures to comply with the code of practice. Amendment 13, in the name of Liam McArthur, is grouped with amendments 14 to 17.

Liam McArthur

Amendments 13 to 17 would mean that, under section 15, the commissioner would be required to “prepare and publish” reports about failures by relevant bodies to comply with the code of practice.

At stage 2, the cabinet secretary maintained that the bill’s strength can be found in the coercive powers of naming and shaming, and he observed that the power of reputational damage should not be underestimated. That always seemed to me to open up too much of a risk—one that some people might be willing to take. I am grateful that Humza Yousaf has come around to that view. In turn, I accept that the reports might be amalgamated, if appropriate, and should certainly recognise a de minimis threshold—not least in order to avoid an undue burden being placed on the commissioner.

I am pleased that the amendments strike a proportionate balance.

I move amendment 13.

Humza Yousaf

As Liam McArthur has already said, this group of amendments in his name will require the commissioner to prepare and publish a report about failures to comply with the code of practice, and will remove the discretionary power to prepare and publish such reports.

It has always been expected that monitoring and reporting compliance with the code of practice will be a key aspect of the commissioner’s role. Therefore, I have no issue with the amendments. I am pleased that, as Liam McArthur has noted, a practical approach is built into them, whereby the commissioner can choose not to report on a failure that involves a minor infraction, and can produce combined reports on failure to comply by more than one person, such as when there is a common theme. I support those provisions and thank Liam McArthur for working constructively with me and my officials to refine the amendments for stage 3. I hope that members will support them.

Liam McArthur

I thank the Government again for its co-operation. I suspect that the workings of the proposed provisions might be reviewed in the future, depending on the evidence that is forthcoming. I very much welcome the support that the Government has given in order to get us to this point.

Amendment 13 agreed to.

Amendments 14 to 16 moved—[Liam McArthur]—and agreed to.

Amendment 23 moved—[John Finnie]—and agreed to.

Section 16—Requirement to respond to reports

Amendment 24 moved—[John Finnie]—and agreed to.

Amendment 17 moved—[Liam McArthur]—and agreed to.

Amendments 25 and 26 moved—[John Finnie]—and agreed to.

Section 22A—Ethics Advisory Group

Amendment 18 moved—[Liam McArthur]—and agreed to.

Section 24—Interpretation

Amendment 27 moved—[Humza Yousaf]—and agreed to.

Schedule 1—The office of Scottish Biometrics Commissioner

Amendment 28 moved—[Humza Yousaf]—and agreed to.

The Presiding Officer

That ends consideration of amendments. As members will be aware, at this stage in proceedings I am required, under standing orders, to decide whether any provision in the bill relates to a protected subject matter; that is, whether it will amend the franchise or the electoral system for Scottish parliamentary elections. In my view, no provision in the bill will do any such thing, so the bill does not require a supermajority for it to be passed at stage 3.

The Deputy Presiding Officer (Christine Grahame)

The next item of business is a stage 3 debate on motion S5M-21174, in the name of Humza Yousaf, on the Scottish Biometrics Commissioner Bill. I call Humza Yousaf to speak to and move the motion.

16:58  

The Cabinet Secretary for Justice (Humza Yousaf)

I am delighted to open this stage 3 debate on the Scottish Biometrics Commissioner Bill. I thank my officials for drafting the bill and for working so constructively with members of the Opposition. I also thank members of the Opposition for taking a similarly constructive approach. I have been involved in introducing legislation in Parliament as a minister for just over seven and a half years, but I do not think that I have ever had a bill passed with so much consensus and with no member voting against a single amendment at stage 3. It has taken me only seven and a half years to get there, but I am delighted to have got there on an issue that has been, understandably, quite contentious and often quite controversial.

However, what we have now is an important piece of legislation that speaks to some of the key societal issues of our time, and touches on human rights and ethics as they relate to police use of very personal information. It is a hugely topical issue and one on which, I suspect, members from across the chamber have often been approached by members of the public in their constituencies

The origins of the bill go back a number of years. I take this opportunity to thank John Scott and his independent advisory group on the use of biometric data for shining a spotlight on biometric data in policing and criminal justice. The group’s report in 2018 was very much the inspiration for, and genesis of, the bill.

I also thank the various parliamentary committees that scrutinised the bill and its accompanying documents—in particular, the Justice Committee and its convener, Margaret Mitchell.

The bill has rightly attracted interest from a wide range of organisations and individuals. I am grateful to those stakeholders for the considered views that they offered to the Scottish Government during the preparatory phase of the bill, and to the Justice Committee once the bill had been introduced in Parliament.

I was pleased by the broad consensus in January to agree the general principles of the bill. However, the Justice Committee made a number of detailed recommendations in its stage 1 report; I am pleased to have been able to work with members to address those concerns during stages 2 and 3 in order to get to this important stage today. I welcome the cross-party support for the bill, and the very positive engagement that I have had with parliamentarians to ensure that the new legislation will do what we want it to do.

The bill will go a long way towards delivering greater transparency and accountability in how the police use biometric data, in recognition of how important that is to building and maintaining public trust.

I cannot stress enough how important it is that we equip our police officers with the necessary technology to ensure that they can keep us safe. However, I stress equally how important it is that the public have absolute confidence in those technological advances, and in how their data will be collected, retained and disposed of. The legislation, the new independent commissioner and the code of practice will, I hope, provide members of the public with the reassurances that they require.

I will focus on some key areas of the bill and what we want to achieve through it. First and foremost, the bill will make sure that our approach to biometric data, including from new technologies—such as facial recognition software, which was mentioned in the debate on amendments—is effective, proportionate and, crucially, ethical.

The bill creates an independent commissioner to advise on those issues, and to review the relevant law, policy and practice. The commissioner will oversee Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. The bill includes a power for ministers to add at a later date, should it be required, more bodies that operate in the context of policing and criminal justice. Policing—the police bodies in particular—is the right place to start, because we know that collection and retention of data for policing purposes can be different to collection and retention of personal data or biometric data by any other sector.

The commissioner will also prepare a statutory code of practice that will set out the mandatory standards that those bodies must meet, and the responsibilities that they must undertake, with the aims of ensuring good practice, driving continuous improvement, and enhancing accountability.

The content of the code has deliberately not been specified in the bill. That allows for flexibility and future proofing—we are all aware of how fast technology can move—and will preserve the impartiality of the commissioner, which is crucial to allowing the commissioner to use his or her own judgment in the future. The commissioner will also be able to draw on expertise from the statutory advisory group.

The draft code of practice will be the subject of consultation of specified bodies and will be subject to approval by Parliament before it can come into effect. The code will be published so that everyone can see the standards that are expected of the bodies that are mentioned in the bill.

The commissioner will have powers to obtain information and to make reports and recommendations. I expect that the relationship between the bodies that are subject to the code of practice and the commissioner will therefore be predicated on transparency and accountability. We heard from the biometrics commissioner for England and Wales at stage 1, during evidence gathering, how important that dynamic is.

There will be a complaints procedure, as we heard in the debate on amendments, so that members of the public can raise concerns with the commissioner about failures to comply with the code of practice.

The commissioner will also have substantial powers—they will have teeth—and can report to Parliament failures to comply, as well as issuing compliance notices to require that concerns be addressed. In the most extreme cases, the commissioner can, ultimately, report failures to comply to the Court of Session.

Finally, but importantly, the commissioner will play a major role in raising public awareness about rights, responsibilities, and standards that are used in relation to biometric data and technologies. Given the rapid increase, in recent years, in use of biometric data and technologies, it is absolutely vital that we promote clearer understanding of the issues in our communities, especially among young people and vulnerable people.

Biometrics is evolving rapidly and offers great potential in detection, prevention and prosecution of crime, which will keep our communities safe. However, use of biometric data and technologies also raises ethical and human rights considerations. Therefore, I want to ensure that use of biometric data, including from new technologies such as facial recognition software, is effective, lawful and ethical.

The bill creates a biometrics commissioner whose powers and duties are focused on rights, accountability and responsibilities. Since the bill was introduced, there has been a lot of discussion here in Parliament about biometric data. However, now is absolutely the time to have a national discussion about the ethics and human rights issues that are associated with police use of biometric data, and for the new commissioner to lead that discussion from the forefront.

If Parliament agrees to pass the bill today, that will place Scotland at the forefront of driving forward transparency, accountability and improvement in relation to biometric data for policing and criminal justice purposes.

I thank members once again for working extremely constructively to get us to this stage.

I move,

That the Parliament agrees that the Scottish Biometrics Commissioner Bill be passed.

17:06  

Liam Kerr (North East Scotland) (Con)

I am very pleased to open the stage 3 debate on the Scottish Biometrics Commissioner Bill on behalf of the Scottish Conservatives. I confirm that we will vote to pass it at decision time tonight.

The underlying principle of the bill is to address ethical and human rights considerations in Scotland in relation to the collection, use, retention and disposal of biometric data in the context of policing and criminal justice. It seeks to do that by establishing the post of a Scottish biometrics commissioner, who will draw up a code of practice governing how biometric material should be used, gathered and so on. That is a significant role.

The bill also seeks to underpin public trust in how the police use biometric data. That trust is recognised in the bill’s policy memorandum, in which being seen to promote the confidence of the public is essential in relation to the commissioner’s functions. It requires that

“governance arrangements for the Commissioner must be, and be seen to be, transparent, accountable and free of any undue influence.”

We all, no doubt, hope that that can be achieved. Ultimately, whether or not it is will, at least partly, be around the resourcing. As the Law Society of Scotland said:

“resources need to include funding for research, public consultations, marketing and legal advice ... Promoting and knowledge of the Commissioner’s role is going to be very important”.

The committee’s report was stark. It stated:

“Other SPCB supported officeholders have faced resourcing issues as a result of changes or expansion to their role and powers over time, or as a result of growing demand for activity.”

Given that, the committee’s conclusion that

“the Financial Memorandum may not sufficiently estimate the resources which may be needed to support the delivery of the Commissioner’s functions”

remains a concern—not least because, as I read with interest, the supplementary financial memorandum projects an extra couple of hundred thousand pounds due to the stage 2 amendments. Although I note what section 22 says about the preparation of an annual report, it does not mandate an explicit requirement to report on the adequacy of resources. That remains a concern, and I hope that we see the commissioner going wide in the interpretation of section 22 to include those issues of resources.

The code of practice, which is set out in section 6, is fundamental. It has been a major area for amendment—and rightly so. During the process, the cabinet secretary amended the bill to provide greater parliamentary scrutiny of the first code of practice by ensuring that the commissioner must lay a copy of the first—draft—code before Parliament for representations. That is a good development, which should help towards the desired public trust and accountability.

The committee agreed that the promotion and protection of human rights, privacy, public confidence and community safety are crucial within that code of practice. Noting that, I inserted at stage 2 a requirement for the commissioner to have regard to those factors when preparing a code of practice. I am very pleased that Parliament agreed to my further amendments earlier this afternoon and that John Finnie trusts me that the section is as tight as it can be. On that note, Liam McArthur’s points on his amendments around the code of practice retention periods were particularly well made, and the greater nuance that we built in this afternoon is welcome.

At stage 1, many committee members raised concerns about the need for a complaints mechanism and the possible impact on public confidence of not having one. Initially, the bill did not contain any provision whereby a member of the public could raise concerns about the use of their biometric data by the police or a breach of the code of practice with the commissioner. The committee therefore recommended that a complaint mechanism be included in the bill.

Margaret Mitchell amended the bill to include a complaints process, which we have further amended today. She will talk in greater detail about it later, but I believe that it is welcome that the commissioner is required to establish, and retain, a complaints procedure that allows people to make a complaint to the Scottish biometrics commissioner about a breach of the code of practice. The amendment also states that the commissioner is to publicise the procedure, which will help to raise public awareness of their rights relating to the use of biometric data by the police and the justice system.

It is trite to say that biometric data is developing all the time and changing. None of us can possibly know what the category “biometric data” will comprise in the future; therefore, building in future proofing with regard to the commissioner’s role and functions is essential. That is why Liam McArthur’s section 22A amendment at stage 2, regarding an ethics advisory group, was welcome. He has, of course, further amended that today to create an advisory group that will allow the commissioner more flexibility.

At stage 2, Mr McArthur inserted section 5B, which will allow the powers and functions of the commissioner to be reviewed three years after the bill receives royal assent and at the end of five years after a review under that section. His amendment today, which tightened that provision up and linked it to the publication of the commissioner’s strategic plan, makes sense and should be welcomed.

This is a good bill that has been subject to considered and sensible amendments throughout the legislative process, following extensive and exhaustive evidence taking at the committee stage. There followed reflective and collaborative working, which was mentioned by the cabinet secretary, and what has emerged is a strong piece of legislation that achieves its stated aims:

“to establish the office of Scottish Biometrics Commissioner and to provide for its functions in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes.”

For that reason, we shall support it at decision time this evening.

17:12  

James Kelly (Glasgow) (Lab)

I am pleased to open the stage 3 debate on behalf of Scottish Labour, and I confirm that we will support the bill at decision time. I have enjoyed this afternoon’s very consensual proceedings.

With regard to the advance of technology, John Finnie was right to separate out technology and data when he spoke earlier on one of his amendments. There have been dramatic advances in technology that have ensured that much more data can be collected and that data can be held more easily. That is of great advantage in the criminal justice system, and it helps the police and prosecutors to do their jobs in bringing people to justice and giving victims reassurance when they have suffered unjustly as a result of crime.

However, the other side of the advance is an ethics and human rights aspect, as the cabinet secretary said. A lot more data is being held, and we have to ensure that the ethics that underpin that situation are robust and that people’s human rights are not undermined. Against that backdrop, the objectives of the bill are absolutely correct in setting up a biometrics commissioner to oversee the collection and retention of biometrics data.

The process has been interesting. The Government has worked collaboratively with all parties and with the committee, and we have seen the bill strengthened as it has gone through stages 2 and 3. That is how the parliamentary process should work. With regard to compliance, in particular, the original draft of the bill stated that people need “to have regard to” the work of the biometrics commissioner. The committee members had a great debate about whether “have regard” was strong enough; I certainly argued that there should be stronger compliance than “have regard”. Amendments on that theme were agreed to at stage 2, which has made the compliance aspect much stronger.

There was a gap in the original drafting of the bill regarding the complaints process. It was well intentioned, as it was felt that the Information Commissioner could deal with any complaints. However, as a number of members have said, it is important to ensure public confidence. That could have been undermined by the lack of a process for complaining directly to the biometrics commissioner if people felt there were issues about how their data was being held. The amendments that were addressed at stage 2 and refined at stage 3 build in a proper complaints process and give clarity about which complaints would be relevant to the Information Commissioner and which would go to the biometrics commissioner.

The advisory group is also important. The Law Society said in its submission that

“future proofing in this area is very important to take account of new developments in technology, and it is important to be able to draw on relevant expertise.”

Setting up an advisory group will make that process much more robust. Being able to keep all of that under review, including the issue of resources, will also ensure that all those issues are taken into account.

The process has been a good and positive one for the Parliament and for the Government, which has taken the bill through Parliament and has built on the discussions and evidence. The end product is a robust one, which Parliament and the public will have confidence in.

17:17  

John Finnie (Highlands and Islands) (Green)

I am sure that there will be a lot of similarity in what we are all going to say. I agree with the cabinet secretary about the good work that has been done by John Scott QC and his committee to get us to this point. I hope that we are going to pass—the Scottish Green Party will certainly support it—a piece of legislation that will establish a new biometrics commissioner.

The explanatory note is very specific. It says that the commissioner will

“support and promote the adoption of lawful, effective and ethical practices in relation to biometric data in a policing and criminal justice context,”

by keeping

“under review the law, policy and practice relating to the acquisition, retention, use and destruction”

of data.

As others have said, public confidence in our criminal justice system is vital. The bill started as a sound enough piece of legislation and there has been extremely positive engagement, which—dare I say it?—was a fine example of how the committee system can work. The engagement with the cabinet secretary and his colleagues was appreciated, and the bill is stronger as a result.

The policy memorandum talks about a rapidly evolving area of work. It is right to strike a balance and to say that it offers

“great potential in the detection, prevention and prosecution of crime”.

We all see that. We know that, in the past 30 years, DNA testing has been central to solving serious crimes such as murder and sexual offences. In that period, we have seen laptops, phones, CCTV, security cameras, road cameras and automatic number plate recognition collecting, storing and using large volumes of biometric data. The Justice Committee was right to say in the stage 1 report that the legislation is “timely and necessary”.

There will be oversight of facial recognition, which has been referred to, but also of facial search technology; gait and movement recognition technology; eye, iris and retinal identification; voice recognition software; and data from social media. All of those things are capable of providing biometric sources to the police—I am advised that they are known as “second-generation biometrics”.

It is important that that commissioner functions independently, as was said in the report, with no perception of overt influence from policing-related bodies.

The amendment at stage 2 that brought in a requirement to comply is significant. I had a look at what the police told us, and they were relaxed about the phrase “have regard to”. They said that that was similar to recommendations from Her Majesty’s Inspectorate of Constabulary in Scotland, which they generally work to implement. There cannot be discussions about that. These are very important matters, and one of the bill’s objectives is to improve the accountability of the police.

I am pleased that the bill will cover the British Transport Police and that the Police Investigations and Review Commissioner is involved, given its pivotal role in policing in Scotland. The independent advisory group talked about having a complaints mechanism in the bill, and I support our convener in the important amendments that have been made in that regard.

Liam McArthur’s amendments on putting the advisory group on a statutory footing are important, as is the advice and information resource that the group can provide.

The Scottish public is under heavy surveillance and it is important that we get things right. I particularly thank the Scottish Government for working with me on the technology amendments. This is a good piece of legislation, and we will support it at decision time.

17:21  

Liam McArthur (Orkney Islands) (LD)

I echo the comments of others in confirming that the Scottish Liberal Democrats warmly welcome the bill and will support it at decision time. I thank all those who helped the committee during our scrutiny of the bill. Like the cabinet secretary and John Finnie, I pay particular tribute to John Scott QC and his colleagues in the advisory group for their work in laying the foundations.

I also thank the cabinet secretary for the constructive approach that he adopted in relation to the bill. Given how combative our exchanges on policing can get in the chamber, it is nice to have had that experience.

The case for establishing a biometrics commissioner to oversee the collection, use, retention and, importantly, deletion of biometrics is well made and widely accepted. Biometrics is an area of policy that is complex and highly technical, and one in which technology and its use are evolving at an astonishing pace. A robust regulatory framework and the specific expertise to oversee it are non-negotiables if we are to retain public confidence, while allowing our police and the justice system to have access to the tools that they will increasingly need.

Thanks to legislation that was passed in 2006 and 2010, we already have a legal framework governing the use of DNA and fingerprints. In 2015, however, it emerged that pictures of 330,000 Scots who had been taken into custody had been made available to users of the police national database. Many of the individuals concerned had done nothing wrong. That prompted my colleague Alison McInnes to spearhead a campaign for effective regulation of biometrics. She wrote to the First Minister at the time to demand a review of facial recognition technology, which led to HMICS undertaking an assessment.

During consideration of the Criminal Justice (Scotland) Act 2016, Alison McInnes lodged amendments to make biometric information subject to the same rules as DNA and fingerprints. She recognised the importance of consistency, including around the timely deletion of images. Although unsuccessful, her efforts paved the way for my own amendments, which Parliament agreed to this afternoon. Those amendments achieve a consistency that is in the interests of not only individuals and the wider public but the police, who have been clear about their belief in the need for both consistency and clarity, albeit with some flexibility to deal with specific circumstances, as the cabinet secretary mentioned earlier.

I acknowledge the support from the Scottish Government for those changes, as I do its support over moves to put the proposed advisory group on a statutory footing. As I said in moving my amendments, putting that on the face of the bill sends a strong signal about the importance of the group’s work in helping to underpin all that the commissioner does. That better reflects the recommendations of the independent advisory group, and I hope that it addresses what was described by the Scottish Human Rights Commission as a “regrettable” omission from the bill as introduced.

Likewise, we have made progress on the question of enforcement powers. I appreciate that some stakeholders may wish that we had gone further, while the Government argued that the threat of naming and shaming was sufficient by way of a deterrent. However, by agreeing to ensure that breaches are made public by the commissioner—save for in the most minor of circumstances—I believe that we increase the likelihood of encouraging good practice and reduce the risk of individuals or organisations seeking to chance their arm.

The final area in which I think that an important step in the right direction has been taken today relates to the way in which we ensure that the legislation keeps pace with the development of biometrics. Putting in place a robust regulatory framework is essential, as is ensuring that that framework is overseen by those with the necessary expertise. However, there is no getting away from the fact that biometrics are rapidly evolving. We need to make sure that reviews are built in so that the public can have confidence that the framework and safeguards remain fit for purpose. Again, I welcome the support of the Government and the Parliament for my amendments to allow for such a review mechanism.

The Metropolitan Police Commissioner, Dame Cressida Dick, observed that although the police should take advantage of new technology to improve policing, it is not for the police service to draw up the rules by which that technology is used. She is right, but so, too, is Amnesty International, when it warns that

“use of biometrics has the potential to breach human rights such as the right to privacy, freedom of association and the right to peaceful assembly”.

That is why we need a robust regulatory framework and a biometrics commissioner with the necessary powers. I believe that the bill gets us much of the way there. On that basis, the Scottish Liberal Democrats will support the bill at decision time.

17:25  

Rona Mackay (Strathkelvin and Bearsden) (SNP)

As deputy convener of the Justice Committee, I am glad that we have reached the final stage of this important bill in, as the cabinet secretary said, a largely consensual way.

I thank the clerks and the bill team for their hard work, and the many excellent witnesses for helping us with their expertise in this field. A lot of work and a lot of listening have gone into getting the bill to a stage where, thankfully, we have achieved cross-party support. I agree with Liam McArthur that it is now a much better, more balanced bill.

The bill will ensure that the use of biometric data in policing and criminal justice is effective, lawful and ethical. It is vital that the public have confidence in the bill and that the ethics—the human rights aspects—of the bill have been addressed. The scope of the bill covers the acquisition, use, retention and disposal of biometric data, including fingerprints, DNA and emerging techniques such as iris recognition.

The ultimate goal is to keep communities safe while respecting the rights of the individual and improving the accountability of the police. Those are important elements in maintaining public confidence in police use of biometric data. Biometrics are hugely important in the prevention and detection of crime, and in prosecuting crime.

Of course, the use of biometric identification by police is not a new phenomenon. In Scotland, police services have been using criminal history photographs and fingerprints for more than 100 years. Over the past 30 years, the use of human DNA testing has become a central tool in detecting and prosecuting crime, particularly in the case of serious crime such as murder and sexual offences.

The need for a commissioner who is independent of Government, the police and the criminal justice system was a key recommendation in both the 2016 HMICS review and the 2018 independent advisory group report. The proposal to create such a role was widely welcomed by all witnesses who gave evidence to the committee.

The Commissioner for the Retention and Use of Biometric Material, Professor Wiles, stated that the bill places Scotland at the forefront of legislating for the oversight of biometric data in the field of criminal justice. He said:

“Many other countries are quite interested in what Scotland is doing, because they are all aware that they have similar issues.”—[Official Report, Justice Committee, 24 September 2019; c 2.]

Important amendments were made at stage 2, and the Government has worked with members across the chamber to incorporate their requests to shape the bill in the best possible form. Much of what I will say has already been said, but here is a sample of some of the amendments that were agreed to at stage 2.

The bill was amended to enable the Scottish ministers to change or clarify the meaning of “biometric data” by regulations. That will allow Parliament to scrutinise any changes that Scottish ministers propose as technology advances at pace. The committee also agreed to an amendment to allow for further process in the approval of the first code of practice, with that being done by Parliament, as recommended by the committee.

Importantly, Parliament agreed at stage 2 to add the PIRC to the list of bodies that are subject to the commissioner’s oversight. The committee also agreed to amendments to require the commissioner to set up a complaints procedure and to operate an advisory group. As we have heard, the complaints procedure has featured strongly in discussions, and I am pleased that the convener’s amendment was agreed to.

The committee also accepted Scottish Government amendments to enhance the powers of the commissioner to deal with failures to comply with the code of practice.

The bill has now been amended to establish an advisory group, which was another issue that the committee felt strongly about. The Scottish ministers’ role has been removed and instead the commissioner will be allowed to make decisions about the group’s administration, procedures, membership and remuneration, with the consent of the Scottish Parliamentary Corporate Body. The intention is that that approach will make for a more impartial group, whose remit and membership are tailored to the commissioner’s requirements.

This important bill ensures that the Parliament has future proofed and locked in all the necessary safeguards to enable Scotland to deal with the evolving technology that is now necessary for the detection, prevention and prosecution of crime.

17:30  

James Kelly

I am pleased to close the debate on behalf of the Scottish Labour Party. We will support the passage of the bill at decision time, which comes up shortly. It has been a useful example of a good way for a bill to progress through Parliament and the discussion this afternoon has been consensual. There were differences of opinion at the earlier stages, but they were exchanged in a collegiate manner. I am glad to say that on a lot of the differences of opinion a consensual way forward has been worked out, which is to the credit of the cabinet secretary, the Opposition spokespeople and the Justice Committee for the way that the process has been conducted.

I was struck by John Finnie reeling off all the different technologies that are now available to police and prosecutors for collecting data. It took me back to the first job that I had, which was with Greater Glasgow Health Board in 1982. When I joined, there was only one computer in the whole office. John Finnie reeled off what is now available, with laptops, mobile technology, voice recognition and, of course, the advent of facial recognition technology. The police have a lot more at their disposal, which is good for investigating crime and bringing people who have committed crimes to justice. However, it means that the challenges in relation to ensuring that ethics and human rights are not compromised are greater. From that point of view, the bill has a very important role to play. As Liam Kerr stressed, getting that right is important for winning public trust, and if the public are going to have proper confidence in biometric data, the role of a biometrics commissioner can help. I cannot stress enough that the powers that the police and prosecutors have to collect and retain data is of great advantage to the victims of crime, but they must use them properly and responsibly to ensure that they have public trust.

The cabinet secretary emphasised the importance of expertise. Some of the changes that have been made as we moved through the process will allow us to draw on that expertise. The setting up of an advisory group and the passing of the amendments that Liam McArthur lodged at stages 2 and 3 will help. The bill, which we will shortly consider at decision time, has been enhanced by the introduction of greater compliance measures. The introduction of a proper complaints process that is streamlined along the proper routes for the biometrics commissioner and the Information Commissioner is helpful. As Liam Kerr pointed out, the issue of resources is important and should be kept under review. The review process that is built into the bill will help in that regard.

I am pleased to support the passage of the bill at decision time. The process has been good and we now have a more robust bill in place that the public will have confidence in.

17:34  

Margaret Mitchell (Central Scotland) (Con)

I welcome the Scottish Biometrics Commissioner Bill. Digital technology has advanced considerably over the past 25 years, and biometrics is one of the most rapidly developing technologies.

Biometric data is both highly sensitive and intrusive. It has evolved from first-generation biometrics, such as fingerprints and DNA, and second-generation technology such as facial recognition software, which presents opportunities and challenges. There is a need for balance between ensuring that the police have the tools that they need to keep the public safe and protecting individuals’ privacy. I thank the justice clerks for their sterling work in assisting the committee to achieve that balance.

The bill provides that the commissioner has several different functions. One is the general role to

“support and promote the adoption of lawful, effective and ethical practices”

in the use of biometric data by the police and criminal justice system. That includes how biometric data is acquired, used, retained and destroyed.

The bill also tasks the commissioner with keeping under review the laws, policies and practices relating to the use of biometric data by Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner. Furthermore, the commissioner must prepare, promote and monitor compliance with the code of practice, and promote public awareness and understanding of the biometric data powers and duties of Police Scotland, the SPA and the PIRC. The commissioner’s powers ensure that they are able to hold the police and criminal justice system to account for its use of biometrics.

The bill’s code of practice governs the collection, use and retention of the public’s biometric data by the police. After hearing the evidence presented at stage 1, the Justice Committee deemed that the inclusion of a complaints mechanism was essential to ensure that any member of the public could raise with the commissioner concerns about police compliance with, or possible breaches of, the code of practice.

I thank the cabinet secretary for his positive response to my amendment that put in place the complaints procedure and for the collaborative nature in which the Scottish Government and its officials have worked with me to amend and improve that provision. The commissioner will be required to publicise the complaints procedure, which should increase awareness among the public of their rights and bolster their confidence in the use of biometrics by the police.

In its stage 1 report, the committee stressed that the bill needed to be strengthened in order to ensure that the commissioner is able to provide robust oversight. Other improvements were made by John Finnie’s amendments, which future proofed the use of new technologies and provided that Police Scotland, the SPA and the PIRC have a duty to comply with the code of practice. Liam McArthur’s amendments introduced a presumption in favour of the deletion of biometric data after a prescribed minimum retention period and provided for the creation of an independent advisory group, which will have open and flexible oversight.

The Justice Committee’s scrutiny of the Scottish Biometrics Commissioner Bill has been an example of effective collaborative and co-operative working between the committee and the Scottish Government, which has ensured that the legislation is fit for purpose. It is one of the best examples of how this Parliament can work effectively to get the best legislation possible. The Scottish Conservatives will have much pleasure in supporting the bill this evening.

17:39  

Humza Yousaf

I am grateful to members for their contributions in what has been a very constructive and consensual debate.

As I said in my opening remarks, the bill has enjoyed strong cross-party support from the start. Members have alluded to the fact that that does not happen by accident; it happens because of the open-mindedness of Opposition members. I hope that they recognise the Scottish Government’s open-mindedness.

I thank those whom we do not often hear about or do not often see at the forefront: the Justice Committee clerks; the officials, who were ably led by Elaine Hamilton, David Scott, Laura Barrie from the parliamentary counsel office and David Murdoch from the Scottish Government legal directorate, and the whole team behind them. On getting cross-party support, I make a special mention of that much-maligned political creature, the special adviser, or SPAD. John McFarlane, who is very well known to each of the Opposition spokespeople, has done an excellent job in working with my officials and me and Opposition members to get the bill to a place at which every single amendment at stage 3 was agreed to by every member. That was a really positive place for the bill to be in.

I take Margaret Mitchell’s point that the bill is not just about consensus, although I am pleased that we have consensus; it is also about effective scrutiny. We saw effective scrutiny by the Justice Committee. There was a range of views from stakeholders, some of which continue to challenge us. The Scottish Human Rights Commission, for example, continues to challenge us, and it will no doubt continue its engagement once the independent biometrics commissioner is appointed.

I will focus on some remarks that members made. Liam Kerr focused his remarks on public trust, which is, of course, hugely important. We can all think of examples of data breaches and leaks and, as I said in my opening remarks, many of us have undoubtedly been approached by members of the public with concerns about data privacy. Public trust must, therefore, be at the forefront of what we do. Having an independent commissioner with oversight of biometric data will help to give reassurance and ultimately strengthen public trust in policing. Whenever I speak to anybody who is involved in policing, particularly the chief constable, they always refer to the fact that the police get their consent from the people. The police do not get consent from the Government or the Parliament; the consent for and legitimacy of policing come from the people. That can happen only when there is public trust. Liam Kerr made that important point.

Liam Kerr also asked about finances and resources, as did James Kelly in his closing remarks. I reiterate what I have said before. It is, of course, right that the Government keep under review any representations that are made by the SPCB, for example, with respect to the resourcing provision of the office of the commissioner as part of the annual budget-setting process. I am confident that the costings in the financial memorandum and the supplementary financial memorandum are comprehensive and represent the best estimates at present. Clearly, however, the commissioner—he or she—will produce the code of practice and we will therefore have to keep that under review. That is important.

James Kelly made some excellent remarks about our having a stronger bill because of collaboration and a stronger commissioner because of the changes to the bill. He referred to the important change that we have made from the policing bodies having regard to the code of practice to their having to comply with the code of practice. I agree that that has led to a stronger bill and I hope that the changes will lead to a stronger commissioner and a stronger regulatory framework around biometrics.

John Finnie was absolutely right to say that the legislation is timely and necessary. I know that, to his credit, he has often been at the forefront in relation to human rights. He pushed the Government very hard on those matters in the committee in particular. I hope that we have met not just his expectations but those of many of the human rights organisations throughout the country.

John Finnie was also right to mention the pace at which technology changes. Dare I say it, but when he first became a police officer in Lothian and Borders Police in 1976—at the age of only five, I should say—and then a dog handler in Northern Constabulary, he could not have envisaged the pace at which technology has advanced. Police officers are now faced with that. That is a really important point.

As the chair of the serious organised crime task force, I know that the police always want to ensure—and they invest to ensure—that they keep pace with criminals. Criminals in serious organised crime gangs do not have to worry about ethics. They do not have to worry about procurement rules. They do not have to worry about legislation. They procure the technology that they require to make criminal transactions through the black market. It is essential that we allow the police the ability to invest in technology in order to keep pace with, or be ahead of, criminals, and at the same time ensure that the public are reassured about their data, about privacy and about the ethical considerations. John Finnie made that important point.

Liam McArthur was also right to reference human rights considerations. It is important to be reminded that the bill did not materialise out of thin air but resulted from a lot of hard work. Much of that was done by John Scott, but Mr McArthur was also right to reference his colleague Alison McInnes. I sat beside her at the Justice Committee many moons ago, where she often kept me right. Like many other members, she was a champion of human rights. The conversations that Alison McInnes had in this Parliament when she was an MSP, right through to the good work that John Scott has done, have meant that the bill represents a cumulative effort by a lot of different actors from a lot of different political parties, including people who are external to the Parliament. We have got to a very strong place, indeed.

Rona Mackay made excellent remarks about the independence of the commissioner. Through the process of the legislation, we have strengthened that independence, for example, with regard to the appointment of the advisory group.

Margaret Mitchell made some excellent points about the complaints process, which she has championed and led on in relation to the bill. She was right to make the point that the Scottish public will look to the Scottish biometrics commissioner when it comes to potential breaches of any code of practice. Therefore, having it in the bill that the complaints process will be a function of the biometrics commissioner is an excellent place for us to be.

We have an excellent bill. I thank all the Opposition spokespeople and the officials who have been involved in getting us to this stage. There has been a very constructive and collaborative approach.

More important than that approach, though, is that we will have a biometrics commissioner with a code of practice that I hope will give members of the public an absolute assurance that, although we want the police and those who are involved in policing to invest in technology in order to keep our streets safe, people’s biometric data will have a regulatory framework around it that will protect their rights and that takes on board the ethical considerations.

I am delighted to commend the bill in my name, and I hope that it receives unanimous support in a few seconds’ time.

The Deputy Presiding Officer

That concludes the debate on the Scottish Biometrics Commissioner Bill.

The Presiding Officer (Ken Macintosh)

There are three questions to be put as a result of today’s business. The first question is, that motion S5M-21170, in the name of Ben Macpherson, on the Local Government Finance (Scotland) Order 2020, be agreed to. Are we agreed?

Members: No.

The Presiding Officer

There will be a division.

For

Adam, George (Paisley) (SNP)
Adamson, Clare (Motherwell and Wishaw) (SNP)
Allan, Alasdair (Na h-Eileanan an Iar) (SNP)
Arthur, Tom (Renfrewshire South) (SNP)
Balfour, Jeremy (Lothian) (Con)
Ballantyne, Michelle (South Scotland) (Con)
Beattie, Colin (Midlothian North and Musselburgh) (SNP)
Bowman, Bill (North East Scotland) (Con)
Briggs, Miles (Lothian) (Con)
Brown, Keith (Clackmannanshire and Dunblane) (SNP)
Burnett, Alexander (Aberdeenshire West) (Con)
Cameron, Donald (Highlands and Islands) (Con)
Campbell, Aileen (Clydesdale) (SNP)
Carlaw, Jackson (Eastwood) (Con)
Carson, Finlay (Galloway and West Dumfries) (Con)
Chapman, Peter (North East Scotland) (Con)
Coffey, Willie (Kilmarnock and Irvine Valley) (SNP)
Constance, Angela (Almond Valley) (SNP)
Corry, Maurice (West Scotland) (Con)
Crawford, Bruce (Stirling) (SNP)
Cunningham, Roseanna (Perthshire South and Kinross-shire) (SNP)
Davidson, Ruth (Edinburgh Central) (Con)
Denham, Ash (Edinburgh Eastern) (SNP)
Dey, Graeme (Angus South) (SNP)
Doris, Bob (Glasgow Maryhill and Springburn) (SNP)
Ewing, Annabelle (Cowdenbeath) (SNP)
Ewing, Fergus (Inverness and Nairn) (SNP)
Fabiani, Linda (East Kilbride) (SNP)
Finnie, John (Highlands and Islands) (Green)
FitzPatrick, Joe (Dundee City West) (SNP)
Fraser, Murdo (Mid Scotland and Fife) (Con)
Golden, Maurice (West Scotland) (Con)
Gougeon, Mairi (Angus North and Mearns) (SNP)
Grahame, Christine (Midlothian South, Tweeddale and Lauderdale) (SNP)
Greene, Jamie (West Scotland) (Con)
Greer, Ross (West Scotland) (Green)
Halcro Johnston, Jamie (Highlands and Islands) (Con)
Hamilton, Rachael (Ettrick, Roxburgh and Berwickshire) (Con)
Harper, Emma (South Scotland) (SNP)
Harris, Alison (Central Scotland) (Con)
Harvie, Patrick (Glasgow) (Green)
Haughey, Clare (Rutherglen) (SNP)
Hepburn, Jamie (Cumbernauld and Kilsyth) (SNP)
Hyslop, Fiona (Linlithgow) (SNP)
Johnstone, Alison (Lothian) (Green)
Kerr, Liam (North East Scotland) (Con)
Kidd, Bill (Glasgow Anniesland) (SNP)
Lindhurst, Gordon (Lothian) (Con)
Lochhead, Richard (Moray) (SNP)
Lockhart, Dean (Mid Scotland and Fife) (Con)
Lyle, Richard (Uddingston and Bellshill) (SNP)
MacDonald, Angus (Falkirk East) (SNP)
MacDonald, Gordon (Edinburgh Pentlands) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Macpherson, Ben (Edinburgh Northern and Leith) (SNP)
Maguire, Ruth (Cunninghame South) (SNP)
Martin, Gillian (Aberdeenshire East) (SNP)
Mason, John (Glasgow Shettleston) (SNP)
Mason, Tom (North East Scotland) (Con)
Matheson, Michael (Falkirk West) (SNP)
McAlpine, Joan (South Scotland) (SNP)
McKee, Ivan (Glasgow Provan) (SNP)
McKelvie, Christina (Hamilton, Larkhall and Stonehouse) (SNP)
McMillan, Stuart (Greenock and Inverclyde) (SNP)
Mitchell, Margaret (Central Scotland) (Con)
Mountain, Edward (Highlands and Islands) (Con)
Mundell, Oliver (Dumfriesshire) (Con)
Neil, Alex (Airdrie and Shotts) (SNP)
Paterson, Gil (Clydebank and Milngavie) (SNP)
Robison, Shona (Dundee City East) (SNP)
Ross, Gail (Caithness, Sutherland and Ross) (SNP)
Ruskell, Mark (Mid Scotland and Fife) (Green)
Simpson, Graham (Central Scotland) (Con)
Smith, Liz (Mid Scotland and Fife) (Con)
Stevenson, Stewart (Banffshire and Buchan Coast) (SNP)
Stewart, Alexander (Mid Scotland and Fife) (Con)
Stewart, Kevin (Aberdeen Central) (SNP)
Swinney, John (Perthshire North) (SNP)
Todd, Maree (Highlands and Islands) (SNP)
Tomkins, Adam (Glasgow) (Con)
Torrance, David (Kirkcaldy) (SNP)
Watt, Maureen (Aberdeen South and North Kincardine) (SNP)
Wells, Annie (Glasgow) (Con)
Wheelhouse, Paul (South Scotland) (SNP)
White, Sandra (Glasgow Kelvin) (SNP)
Whittle, Brian (South Scotland) (Con)
Yousaf, Humza (Glasgow Pollok) (SNP)

Against

Baker, Claire (Mid Scotland and Fife) (Lab)
Beamish, Claudia (South Scotland) (Lab)
Bibby, Neil (West Scotland) (Lab)
Boyack, Sarah (Lothian) (Lab)
Cole-Hamilton, Alex (Edinburgh Western) (LD)
Fee, Mary (West Scotland) (Lab)
Findlay, Neil (Lothian) (Lab)
Grant, Rhoda (Highlands and Islands) (Lab)
Gray, Iain (East Lothian) (Lab)
Johnson, Daniel (Edinburgh Southern) (Lab)
Kelly, James (Glasgow) (Lab)
Lamont, Johann (Glasgow) (Lab)
Lennon, Monica (Central Scotland) (Lab)
Macdonald, Lewis (North East Scotland) (Lab)
McArthur, Liam (Orkney Islands) (LD)
McNeill, Pauline (Glasgow) (Lab)
Rennie, Willie (North East Fife) (LD)
Rumbles, Mike (North East Scotland) (LD)
Sarwar, Anas (Glasgow) (Lab)
Smith, Elaine (Central Scotland) (Lab)
Smyth, Colin (South Scotland) (Lab)
Stewart, David (Highlands and Islands) (Lab)
Wishart, Beatrice (Shetland Islands) (LD)

The Presiding Officer

The result of the division is: For 88, Against 23, Abstentions 0.

Motion agreed to,

That the Parliament agrees that the Local Government Finance (Scotland) Order 2020 [draft] be approved.

The Presiding Officer

The next question is, that motion S5M-21174, in the name of Humza Yousaf, on the Scottish Biometrics Commissioner Bill at stage 3, be agreed to.

Because the question is on a bill at stage 3, we must have a division. Members should cast their votes now.

For

Adam, George (Paisley) (SNP)
Adamson, Clare (Motherwell and Wishaw) (SNP)
Allan, Alasdair (Na h-Eileanan an Iar) (SNP)
Arthur, Tom (Renfrewshire South) (SNP)
Baker, Claire (Mid Scotland and Fife) (Lab)
Balfour, Jeremy (Lothian) (Con)
Ballantyne, Michelle (South Scotland) (Con)
Beamish, Claudia (South Scotland) (Lab)
Beattie, Colin (Midlothian North and Musselburgh) (SNP)
Bibby, Neil (West Scotland) (Lab)
Bowman, Bill (North East Scotland) (Con)
Boyack, Sarah (Lothian) (Lab)
Briggs, Miles (Lothian) (Con)
Brown, Keith (Clackmannanshire and Dunblane) (SNP)
Burnett, Alexander (Aberdeenshire West) (Con)
Cameron, Donald (Highlands and Islands) (Con)
Campbell, Aileen (Clydesdale) (SNP)
Carlaw, Jackson (Eastwood) (Con)
Carson, Finlay (Galloway and West Dumfries) (Con)
Chapman, Peter (North East Scotland) (Con)
Coffey, Willie (Kilmarnock and Irvine Valley) (SNP)
Cole-Hamilton, Alex (Edinburgh Western) (LD)
Constance, Angela (Almond Valley) (SNP)
Corry, Maurice (West Scotland) (Con)
Crawford, Bruce (Stirling) (SNP)
Cunningham, Roseanna (Perthshire South and Kinross-shire) (SNP)
Davidson, Ruth (Edinburgh Central) (Con)
Denham, Ash (Edinburgh Eastern) (SNP)
Dey, Graeme (Angus South) (SNP)
Doris, Bob (Glasgow Maryhill and Springburn) (SNP)
Ewing, Annabelle (Cowdenbeath) (SNP)
Ewing, Fergus (Inverness and Nairn) (SNP)
Fabiani, Linda (East Kilbride) (SNP)
Fee, Mary (West Scotland) (Lab)
Findlay, Neil (Lothian) (Lab)
Finnie, John (Highlands and Islands) (Green)
FitzPatrick, Joe (Dundee City West) (SNP)
Fraser, Murdo (Mid Scotland and Fife) (Con)
Golden, Maurice (West Scotland) (Con)
Gougeon, Mairi (Angus North and Mearns) (SNP)
Grahame, Christine (Midlothian South, Tweeddale and Lauderdale) (SNP)
Gray, Iain (East Lothian) (Lab)
Greene, Jamie (West Scotland) (Con)
Greer, Ross (West Scotland) (Green)
Halcro Johnston, Jamie (Highlands and Islands) (Con)
Hamilton, Rachael (Ettrick, Roxburgh and Berwickshire) (Con)
Harper, Emma (South Scotland) (SNP)
Harris, Alison (Central Scotland) (Con)
Harvie, Patrick (Glasgow) (Green)
Haughey, Clare (Rutherglen) (SNP)
Hepburn, Jamie (Cumbernauld and Kilsyth) (SNP)
Hyslop, Fiona (Linlithgow) (SNP)
Johnson, Daniel (Edinburgh Southern) (Lab)
Johnstone, Alison (Lothian) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
Kidd, Bill (Glasgow Anniesland) (SNP)
Lamont, Johann (Glasgow) (Lab)
Lennon, Monica (Central Scotland) (Lab)
Lindhurst, Gordon (Lothian) (Con)
Lochhead, Richard (Moray) (SNP)
Lockhart, Dean (Mid Scotland and Fife) (Con)
Lyle, Richard (Uddingston and Bellshill) (SNP)
MacDonald, Angus (Falkirk East) (SNP)
MacDonald, Gordon (Edinburgh Pentlands) (SNP)
Macdonald, Lewis (North East Scotland) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Macpherson, Ben (Edinburgh Northern and Leith) (SNP)
Maguire, Ruth (Cunninghame South) (SNP)
Martin, Gillian (Aberdeenshire East) (SNP)
Mason, John (Glasgow Shettleston) (SNP)
Mason, Tom (North East Scotland) (Con)
Matheson, Michael (Falkirk West) (SNP)
McAlpine, Joan (South Scotland) (SNP)
McArthur, Liam (Orkney Islands) (LD)
McKee, Ivan (Glasgow Provan) (SNP)
McKelvie, Christina (Hamilton, Larkhall and Stonehouse) (SNP)
McMillan, Stuart (Greenock and Inverclyde) (SNP)
McNeill, Pauline (Glasgow) (Lab)
Mitchell, Margaret (Central Scotland) (Con)
Mountain, Edward (Highlands and Islands) (Con)
Mundell, Oliver (Dumfriesshire) (Con)
Neil, Alex (Airdrie and Shotts) (SNP)
Paterson, Gil (Clydebank and Milngavie) (SNP)
Rennie, Willie (North East Fife) (LD)
Robison, Shona (Dundee City East) (SNP)
Ross, Gail (Caithness, Sutherland and Ross) (SNP)
Rumbles, Mike (North East Scotland) (LD)
Ruskell, Mark (Mid Scotland and Fife) (Green)
Sarwar, Anas (Glasgow) (Lab)
Simpson, Graham (Central Scotland) (Con)
Smith, Elaine (Central Scotland) (Lab)
Smith, Liz (Mid Scotland and Fife) (Con)
Smyth, Colin (South Scotland) (Lab)
Stevenson, Stewart (Banffshire and Buchan Coast) (SNP)
Stewart, Alexander (Mid Scotland and Fife) (Con)
Stewart, David (Highlands and Islands) (Lab)
Stewart, Kevin (Aberdeen Central) (SNP)
Swinney, John (Perthshire North) (SNP)
Todd, Maree (Highlands and Islands) (SNP)
Tomkins, Adam (Glasgow) (Con)
Torrance, David (Kirkcaldy) (SNP)
Watt, Maureen (Aberdeen South and North Kincardine) (SNP)
Wells, Annie (Glasgow) (Con)
Wheelhouse, Paul (South Scotland) (SNP)
White, Sandra (Glasgow Kelvin) (SNP)
Whittle, Brian (South Scotland) (Con)
Wishart, Beatrice (Shetland Islands) (LD)
Yousaf, Humza (Glasgow Pollok) (SNP)

The Presiding Officer

The result of the division is: For 110, Against 0, Abstentions 0.

Motion agreed to,

That the Parliament agrees that the Scottish Biometrics Commissioner Bill be passed.

The Presiding Officer

The motion has been agreed to, therefore the Scottish Biometrics Commissioner Bill is passed. [Applause.]

The final question is, that motion S5M-21153, in the name of Bill Bowman, on the appointment of the Auditor General for Scotland, be agreed to.

Motion agreed to,

That the Parliament nominates Stephen Boyle to Her Majesty The Queen, for appointment as the Auditor General for Scotland.

The Presiding Officer

I offer my congratulations to Mr Boyle on his nomination. [Applause.]