Contents
- Attendance
- Decision on Taking Business in Private
- Digital Device Triage Systems
Digital Device Triage Systems
We move to agenda item 2. Our main business today is an evidence-taking session on the Scottish Government’s response to the sub-committee’s recent report on Police Scotland’s proposed use of digital device triage systems, otherwise known as cyberkiosks. Members will recall that we published our report on 8 April. Our views were based on the written and oral evidence that we received in our inquiry. I refer members to paper 1, which is a note by the clerk, and paper 2, which is a private briefing.
I welcome to the meeting Humza Yousaf, Cabinet Secretary for Justice, and, from the Scottish Government, Euan Dick, interim deputy director, police division, and Juliet Harkins, directorate for legal services. Before we move to questions, I invite the cabinet secretary to make some brief opening remarks.
Thank you, convener—I will be very brief.
To begin with, I thank the sub-committee for the time that it has taken to consider this important issue. As I noted in my letter dated yesterday, this is a complex and rapidly evolving area, and although it is for Police Scotland to ensure that it exercises its powers in accordance with the law as it moves towards implementation of the new devices, it and the Scottish Police Authority have agreed with the sub-committee that the future legal framework might require additional clarity to ensure that Scottish criminal justice can keep pace with technological change.
Because of my commitment to the legal, ethical and proportionate use of new technologies, which I believe is shared by the sub-committee, I plan to form an independently chaired reference group to scope the possible legal and ethical issues arising from emerging technological developments. The overall aim is to ensure that Police Scotland can continue to have not only the power to keep our communities safe but, crucially, the right safeguards to protect the rights of the individual.
I believe that the use of independent expertise has delivered a real improvement in Scottish policing in areas such as stop and search and biometrics. Because this is, at present, simply a policy intention, I am unable to go into much detail about the group’s full remit and membership, but I am, of course, keen to hear the sub-committee’s thoughts on the matter.
I am keen to see Scotland’s criminal justice system at the forefront of the use of new and developing technologies to fight crime, but I am also clear that that will absolutely require to be balanced with human rights and ethical considerations. I am therefore very interested in hearing the sub-committee’s views on how the reference group can move forward, but I am also looking forward to members’ questions about digital device triage systems.
Thank you very much for that opening statement. Do you believe that the overarching legal framework requires to be updated? As people will be aware, the sub-committee has put on record its view that Police Scotland should have the best possible equipment. Obviously, legality and proportionality, which you mentioned, must apply, but does the overarching framework need to be updated in light of this issue and, indeed, other matters, such as facial recognition systems?
Thank you for the question, convener. I reiterate my thanks to the sub-committee, too, for its scrutiny of the matter, which has been welcome. We should never shy away from scrutiny, and this particular scrutiny has shone a light on a number of important issues, such as the legal framework.
You asked whether I thought that the overarching legal framework was adequate, but you also mentioned facial recognition, which brings us into the sphere of biometrics. I suppose that it all depends on our definition of “overarching legal framework”. As I have said, the independently chaired group is just a policy intention at this stage, and I will seek sub-committee members’ views on how we develop it further. However, the intention is that it will bring together the likes of human rights advocates, academics and those with particular expertise almost to horizon scan what technologies will emerge over the coming years, which can be difficult to predict, of course. Whether there are issues that we have to consider from an ethical point of view, a human rights point of view and—this is important and relates to your question—a legislative and legal framework point of view could be looked at.
On the overarching legal framework and the particular issue of digital device triage systems, or cyberkiosks, Police Scotland and the Scottish Police Authority have to satisfy themselves about the legal advice that they have received before proceeding and, obviously, from the evidence, they believe that they have the legal basis to proceed.
You mentioned facial recognition, and the Scottish Biometrics Commissioner Bill, which we have introduced, will be hugely important in creating and developing the Scottish biometrics commissioner role and a code of practice.
It is always important that we as a Parliament legislate, where we can and where appropriate, to give as much reassurance as possible to the public on ethical considerations. I have heard the chief constable say on many occasions that, in Scotland, policing is by consent of the people, and he has been right to say that. The safeguards are therefore hugely important.
I have a couple of questions about legality, which you have touched on, before other members come in.
Do you believe that there is a legal basis for introducing the use of cyberkiosks? The sub-committee has had evidence from the Scottish Human Rights Commission in person and in writing—those communications are available on the committee’s web pages—the Faculty of Advocates and the Scottish Criminal Bar Association that there is no legal basis for introducing their use. Will you comment on that? Do you believe that there is a legal basis?
I will resist the temptation to comment on that for a couple of reasons.
First, I am not a lawyer or a Queen’s counsel, so I rely—as all other Government ministers do—on legal advice from the Lord Advocate or the Scottish Government’s legal directorate. You are aware that we do not disclose whether such legal advice has been taken or, indeed, the nature of any legal advice. That is an important principle and convention, although I understand that it sometimes causes frustration for our Opposition colleagues and no doubt even our own back benchers. However, it is important that that principle remains.
My job with the newly formed independent group will be to look at the future landscape and see whether there are any legal, ethical or human rights considerations that have to be taken into account. Some of those considerations will involve legislation and some will not.
I reiterate that it is absolutely for Police Scotland and the SPA to satisfy themselves that they have a legal basis for proceeding in relation to any issue, including the issue in question. They have reflected and come back to the sub-committee in a very reflective and considered manner. They have reflected on what the sub-committee has had to say, and they are satisfied that they are operating within the legal framework.
The convener asked me what I think personally. I am afraid that, as the Cabinet Secretary for Justice, I do not comment on what my personal opinions are. I am a member of the Government, and I do not have legal expertise. I am not an advocate, a QC, a lawyer or a solicitor and, as I have said, we do not divulge whether we have taken legal advice or the nature of any legal advice. It is for Police Scotland and the SPA to satisfy themselves in that regard.
I absolutely understand that long-standing convention, but our job, of course, is to scrutinise and understand concerns. There may be occasions when the Government quite legitimately has concerns about a matter and no one asks whether it has taken a legal opinion on it; those concerns are often openly expressed.
I will try a different line of attack. Police Scotland and the SPA rely on Murdo MacLeod QC’s legal opinion to provide reassurance. Concerns have been expressed to us about Mr MacLeod’s restricted remit and information. I readily accept that a legal opinion cannot cover every conceivable scenario, but the legal opinion in question excluded concerns that were raised with the sub-committee—again, they are on the public record. Can you give any view on the reliance that the SPA and Police Scotland are placing on Mr MacLeod’s legal opinion?
Convener, I salute your indefatigability, to coin a phrase—I draw no parallels in relation to either you or me when I do so.
I can attempt to give further reassurance. I noted the legal advice that was given by Murdo MacLeod QC. Of course, it was taken on the back of concerns that were raised by the sub-committee and by people from whom you took evidence. It was a safeguard that Police Scotland wanted in order to further strengthen the legal case around digital device triage systems.
I do not doubt that there are some concerns about the legal advice—indeed, I have seen the concerns that were expressed by the Scottish Human Rights Commission and the Information Commissioner’s Office. However, I draw your attention to the fact that Mr MacLeod said:
“My principal conclusion is that there is a lawful basis for the use of cyber kiosks.”
You ask a legitimate question on behalf of the organisations that have expressed concern with regard to the remit for that legal advice and the questions that it was exploring. Ultimately, if there is a difference in opinion in relation to the law, it would be up to the courts to make a determination—I am not advocating that approach, but that is the case. We saw that recently in relation to the decisions that Glasgow City Council took about rerouting marches and parades. There was a difference of opinion between the organisers of the events and the council about whether those decisions were legal and, ultimately, the court made its determination. I thought that that was helpful—it can be helpful way to proceed, even if it is costly at times.
The only reflection that I can offer on the point is that, if the police and the SPA are on one side, and a number of organisations believe that the legal basis is not there, it would be possible to test that in the courts.
You have an oversight of the situation. Are you satisfied that the Scottish Police Authority has taken appropriate legal advice on the matter?
Yes. Obviously, the SPA has its own internal processes around legal advice, but it went a step further in this case in going to Murdo MacLeod QC.
You are right to say that I have an oversight role. Having been Cabinet Secretary for Justice for the past year, I have been interested to note that Police Scotland is the subject of much more scrutiny than many other public bodies—for good reason, as it has a lot of power and authority, which many other public bodies do not have. It answers to two committees in this Parliament, and it is also subject to scrutiny by the Police Investigations and Review Commissioner; Her Majesty’s chief inspector of constabulary; Audit Scotland; and the scrutiny body, the SPA. Further, as you rightly say, there is the oversight role that I play as the Cabinet Secretary for Justice. There is no shortage of lights being shone on Police Scotland, and I think that that is a good thing.
It is perhaps fortunate that this committee shone a particular light on the concerns around the introduction of cyberkiosks.
I would not disagree with that.
Good afternoon. The convener has covered a lot of the issues that I wanted to address, and you have already commented on the view that the current legal framework does not provide sufficiently robust legal safeguards for people’s privacy rights in this context. Could you comment on the view that is expressed in the submission from the Scottish Human Rights Commission that
“the law surrounding the use of cyber-kiosks lacks sufficient quality to be accessible and foreseeable”?
I am happy to give a caveated response to those concerns. My caveat is the one that I have already mentioned, which is that—despite my mum’s best intentions—I am not an advocate, a QC, a solicitor or a lawyer, so I can only give you an outline of the landscape as I see it.
I met the SHRC recently—I say recently, but it has probably been a couple of months since I met Judith Robertson. At that meeting, the issue that you mention was raised, along with a couple of other issues. As it reiterated in its letter to you, the SHRC’s concern involves the phrase, “in accordance with the law”. Essentially, it believes that the rules around the use of the devices must be accessible and foreseeable to an individual who might be subject to their use. If guidelines are made accessible to the public, that might well go some way towards addressing that concern. However, that is, no doubt, a matter of contention, in terms of law.
13:15Police Scotland has given reassurances that the devices will be used within strict parameters when an initial search is being conducted and that digital forensic examination principles will be put in place. It has also made a commitment to make accessible to the public information about how it will carry out examinations. That is the important point, because “in accordance with the law” is about accessibility and foreseeability.
In addition, 410 police officers have been trained on the proper use of the devices. Written guidance to the officers is in the process of being finalised, in co-operation with stakeholders who are part of Police Scotland’s stakeholder and external reference groups.
That is Police Scotland’s response to the SHRC’s criticism about whether things are “in accordance with the law”. The SHRC can speak for itself as to whether that response satisfies it, although I suspect that it probably does not. That goes back to my point to the convener that, ultimately, there are disagreements. Police Scotland is certain that it has a legal basis for using the devices. One option would be to settle the matter in the courts. There is obviously genuine disagreement on the matter—I am sure that views are sincerely held; it is a genuine disagreement.
The cabinet secretary’s comments lead us to the question whether a statutory code of practice is needed—that would be one way of creating a publicly visible framework for digital forensic principles and other aspects.
If we were to have a statutory code, might it include more general principles? It seems to me that two principles are involved here. The triaging that we are talking about has a benefit for suspects and third-party witnesses, in that their equipment would be returned to them sooner than current systems might provide for, so it might be useful to include that. More fundamentally, the overriding principle is that triaging enhances the investigatory powers of the police to gather proper evidence in a suspected or reported crime.
Does the cabinet secretary think we should have a statutory code of practice not simply for digital device triage systems, but for the seizure and examination of information and communication technology devices more generally? Indeed, to take that little bit further, should we have such a code for the examination of data that may be stored beyond a device that someone physically holds in what is now generically called “the cloud”?
I thank my very learned friend for that question. Knowledge-wise, he is often in advance of many other members of the Parliament, including me, when it comes to technology. I know that he has a great interest in and knowledge of these matters.
I will reassure the member as best I can. The new independently chaired group that I am advocating would look at horizon scanning for the technologies that may well be coming our way. It will look at whether there is a need for legislation, statutory guidance, codes of practice and so on. My intent is that it will explore those issues, but, of course, I will listen to feedback from others.
On where we are currently, the independent advisory group, having examined and explored the issues, suggested that the next steps would be to have a Scottish Biometrics Commissioner Bill and a code of practice. Because of its work on the issue, I want the group to be set up to look at other technologies.
The purpose of the Scottish Biometrics Commissioner Bill that we have introduced is to create the office of the Scottish biometrics commissioner and for that commissioner to develop a code of practice. What that code of practice would look like and involve would, of course, be up to the independent commissioner.
Although I have put a focus on future technologies, it will absolutely be open to the commissioner to look at current technologies, including digital device triage systems or anything else, and say that, in his or her opinion, there needs to be an additional safeguard of some sort, be that a code of practice, statutory guidance or even legislation. At present, however, Police Scotland is satisfied that the legal basis for digital device triage systems is sound.
I ask for a brief comment in response to my final question. The European convention on human rights is a detailed set of principles that has endured for decades. Are we anywhere near being able to lay down some principles on the topic that we are discussing that will endure beyond our ability to see to the current horizon? Can we set out some more general, high-level principles that are sufficiently simply expressed that they will be accessible at least to an engaged proportion of the lay public?
That is a great question, which I am afraid I am not going to be able to answer particularly well. The pace of technology—
Would Mr Dick care to answer?
Maybe, but if you let me, I will attempt at least to give you some thoughts and reflections, if not a particular answer.
The pace of technology is so fast. The previous model of mobile phone that I had—members will appreciate this, too—did not have fingerprint technology, iris recognition or facial recognition. That is not an advert for the mobile phone that I have now; it is true of whatever brand of mobile phone people have. What will the next models have, and the models after that? It is truly mind boggling when we start to look into the subject—and I say that as someone who takes an interest in technology and how it might advance.
Can we put in place any principles that will be able to capture the issues that technology may well bring? The independent group that I am hoping to form—as I said, I will take views from the sub-committee on it—will attempt as best it can to horizon scan and put together such principles, be they in the form of guidance, codes of practice or legislative vehicles.
That was an attempt to answer your question. I am, of course, happy for my officials to come in if they have anything particular to add. However, it seems that they agree. That is wonderful. [Laughter.]
I have some follow-up questions on the independently chaired reference group. When will it be established?
At present, the group is a policy intention, but I do not want to wait too long. Such things should move at a good pace. I appreciate that I have only just told the sub-committee about the group, but I am keen to hear the views of the sub-committee and the Justice Committee on the group’s potential membership and remit. There should not be a lengthy process to get the group up and running.
Do you envisage that the remit will include consideration of digital device triage systems before their introduction, or retrospective scrutiny of that?
The group is not being created specifically to look at digital device triage systems. As I said, Police Scotland and the SPA believe that they have a legal basis for using them. However, the group will not be precluded from looking at the subject. As an independent group, it should have wide scope to look at whatever technologies it wishes to look at, be they past, present or future. It will look at more than just digital device triage systems. Given the pace of technological change, it will consider what we might envisage will come our way in the next five-plus years, and whether we are doing enough to ensure that we have the ethical and human rights protections to go alongside such technology.
I note that the group will work with the proposed biometrics commissioner, as part of that. You might not be able to answer this question now, but do you envisage that the group will meet in public and that there will be public membership? What I am really trying to ask is whether it will be transparent?
Again, I will take views on that, but the group should be as open and transparent as possible—especially given the issues that it will consider. There may be issues that are of particular sensitivity—if it takes advice or intelligence from intelligence services and so on, for example. It should, for the most part, be the rule that such things are open, transparent and public.
I am keen to ensure that human rights organisations that have an interest in the subject are able, if they are not members—we will give that consideration, of course—to interact with the group in an open and public way.
I presume that Police Scotland will liaise with the group, even if it is not represented on it.
I suspect that it will. We will give some thought to whether it would be better for Police Scotland to be a member of the group or to liaise with it. It is important that ethical and human rights considerations are central to the work of the group. The independent chair of the group will be important, too. We are giving detailed thought to the matter.
When we took evidence on the topic on 13 September 2018, we heard severe doubts about the legal basis on which cyberkiosks could be used, and about whether their introduction would be compatible with human rights. At that time, Police Scotland was actively planning to roll out the devices within weeks. When I put it to Detective Chief Superintendent Gerry McLean that Police Scotland was planning to do that despite the fact that training had still to be devised and there was lack of clarity—which he acknowledged—his response was that the organisation was being “extremely ambitious”.
What are your reflections on that? As well as the particular issue to do with whether the legal and human rights bases exist for proceeding with cyberkiosks, there is also the general question about the processes and procedures that the police have in place to check whether their technologies, operating procedures and equipment are legal or compliant with human rights. Are you satisfied that Police Scotland now has those checks and balances in place? What does the situation that we are discussing say about the checks and balances that Police Scotland had in place at the time?
That is an absolutely legitimate question to ask. When I listened to the evidence from Police Scotland and the SPA during their most recent appearance before the sub-committee, I thought that their tone was right—they were very reflective. The work that members of the sub-committee have done in shining a light on that process has played a big part in that. We must remember that Police Scotland is on a journey: of course, it is well into that journey.
If Daniel Johnson is asking whether there were lessons to learn from the roll-out of cyberkiosks, the answer is yes, for sure. Am I confident that those lessons have been learned for future technological advances? Yes, I am confident of that, particularly given the processes and the various panels that are in place. I hope and believe that the process of living through those experiences will have given Police Scotland a lot of food for thought with regard to how it deals with such issues in the future.
Parliament and, I hope, Government, have demonstrated that when issues are raised on which such considerations are relevant—they are not always about technological issues; stop and search is another example—people always benefit from the adoption of an investigative approach that involves experts, and an independently chaired process that is carried out in a very open manner. Rona Mackay asked about openness: people will never be worse off as a result of an open approach.
I cannot promise that there will not, in the future, be issues on which the committee will ask questions to do with the legal and human rights bases of the police’s approach. It will be for Police Scotland to provide confidence and reassurance on any such operational matters, but I believe that it has the processes in place to enable it to do that.
On that last point, only one thing would worry me more than the committee finding issues, and that would be us not finding issues. There will always be issues, and they must be found.
That said, on what basis does the cabinet secretary have confidence that the necessary checks and balances are now in place? When we took evidence from Will Kerr and another Police Scotland witness, they relied heavily on the introduction of an ethics panel, but my understanding is that that panel has not yet been instituted. What communication has the cabinet secretary had with Police Scotland, and what assurances has he had? What structures is the cabinet secretary relying on in Police Scotland that will ensure that checks and balances are now in place regarding legality, ethics and human rights in relation to equipment and operating procedures?
13:30
I have had conversations directly with the chief constable on digital triage. I am sure that he will not mind my saying that I found him to be very reflective on the process. He gave me assurances about the panel, the digital forensic examination principles that have been put in place, and the 410 officers who have now been trained in use of the devices. All that gives me confidence that Police Scotland has learned lessons and put in place processes.
However, that does not prevent me from offering the important caveat that there might well be issues that the sub-committee picks out through its exploration, investigation and examination on which it believes that Police Scotland needs to go further. I hope that the independent group that I advocate will assist Police Scotland in looking down the road to see what technological advances there will be—hard though that is to predict—and will ensure that Police Scotland is not caught out by potential issues around legality, human rights or ethics.
The first part of Daniel Johnson’s question—maybe it was a comment—was about his concern about whether we will find such issues. To go back to what I said to the convener, I do not think that any public body is under as much scrutiny as Police Scotland. That is rightly the case, and I think that it is a good thing. We have the SPA, Her Majesty’s inspectorate of constabulary in Scotland, the Justice Sub-Committee on Policing, the Justice Committee, Audit Scotland and, of course, the Government’s oversight role. There is a lot of scrutiny of Police Scotland, so I say respectfully to the member that I am not too concerned that issues will not be found, flushed out and discussed frankly.
The issues that have been identified relate not only to legalities and human rights. The evidence that we received from the police also raised substantial questions regarding how the money was spent. In particular, two issues have arisen. One is that the spend seemed to be just below the threshold that would require explicit approval from the SPA board.
The second, which is more critical, is that it seems from the evidence that we received most recently that when Police Scotland decided to spend the money, it did not take into account the on-going costs of the equipment, but looked simply at the up-front cost. It would be extraordinary for an organisation of any size—let alone an organisation of the importance and size of Police Scotland—in looking at a business case, not to look at the totality of the life-cycle costs of equipment that it wanted to purchase. Does not that raise serious questions regarding Police Scotland’s internal spending procedures? Has the cabinet secretary asked questions about that, given that he is ultimately responsible for how taxpayers’ money is spent on justice?
Yes. I have confidence in Police Scotland’s and the SPA’s financial scrutiny of such matters, and in its financial scrutiny more generally. I have met finance officers on many occasions to discuss many projects.
However, that does not mean that the Government will not question the rationale for particular spending. An example that we have aired publicly—if I remember correctly, it was a topic of discussion when I was at the sub-committee previously—is the investment that the Government is being asked for in the digital, data and information and communications technology—DDICT—strategy. We cannot ignore things such as the i6 project or issues such as Daniel Johnson has raised. I make no apologies for continuing to get as many assurances as possible on the spending and business cases for projects. The Government will always do that.
In the same breath, I have to say—Daniel Johnson will understand this—that I cannot, as Cabinet Secretary for Justice, spend my time micromanaging Police Scotland’s budget. Indeed, I do not think that that would be expected of me. It is important that I give the SPA its due place in scrutinising spend. Of course, as I have said, I have confidence in the ability of Police Scotland and SPA to manage that sort of thing appropriately.
I think that there is a bit of a difference between scrutinising individual items of spend and the overall process, but I will move on to my final question.
It is a mistake to think that the digital triage technology will be used to take evidence only from people who might be suspects in a crime; complainants or witnesses will also be asked to surrender their devices, and they might even have to do so under warrant. As the Open Rights Group has highlighted, the Crown counsel’s advice on this point is relatively brief.
Given the issues that have arisen in recent months south of the border, where the police have asked people—in particular, victims of sex crimes—to surrender their devices, is the cabinet secretary satisfied that there is a legal basis for using the equipment with witnesses and victims? If not, how can the matter be resolved?
From what I have heard from Police Scotland, particularly on the back of reports that we have heard involving the Crown Prosecution Service down south, I have confidence in the approach that will be taken. Over the past year, I have often found myself sharing a stage or platform with the chief constable, and on almost every single one of those occasions he has made the point that policing is done by the consent not of Parliament or any cabinet secretary, but of the people. I have been reassured a number of times that the police would, when it comes to witnesses and complainers, use cyberkiosks only with the individual’s consent. They are developing the appropriate form on which to capture that consent.
That said, however, there might well be times when the police will have to seize a device under warrant, as Daniel Johnson mentioned, or they might have to bypass the consent process if there are issues that relate, say, to the obligation to protect life, or to terrorism. However, such examples would be exceptions, and absolutely not the rule—which is that use of the devices will happen by consent.
I have tried to think about the matter from a personal point of view. I have been a victim of a number of online crimes—mainly racial and Islamophobic abuse that has come my way, which I have reported to the police. In fact, such a case is coming up very shortly. When I think about a case that I was involved in shortly after the Paris attacks, I recall how, even back then, when I was not the Cabinet Secretary for Justice, it was really important for me to get from the police reassurances about what they were going to do with my device and how it would be used, and reassurance that I was going to get it back as soon as possible. Luckily for me, I got it back the same day.
Things have moved on quite a lot since then, but throughout all this, the issue of consent will still be absolutely pivotal and vital not only for complainers about and victims of crime, but equally for those who are being complained about. The police will aim to take their devices with consent—it is important that that is on the record—but if they cannot do so, they have the options of judicial warrant and so on.
I apologise for being slightly late in arriving. Cabinet secretary, you talked about what you described as an honest difference of opinion, which still appears to exist. Are you concerned that there appears to be a lack of confidence in Police Scotland’s approach and the legal basis underpinning that approach among key stakeholders such as the Scottish Human Rights Commission, the Information Commissioner’s Office and the Faculty of Advocates, which has also expressed its concerns? I know that you see it as an honest disagreement, but it is fundamentally important, is it not?
It is fundamentally important, of course. That is why I am in front of the sub-committee, rightly being interrogated—that is a pretty harsh word; that is why I am being questioned about the issue. It is right that I am being questioned about it, because it is an issue of fundamental importance—I agree with you on that.
I have an immense amount of time for organisations such as the SHRC, the ICO and many of the others that have raised the concerns that Liam McArthur mentions. I would certainly never be dismissive of those concerns, and I hope that I never give that impression. However, I think that the current situation is that initial concerns have been raised, very legitimately, and Police Scotland has paused what it is doing to reflect on, take further legal advice on and satisfy itself in relation to those concerns. At the same time, we still have particular, quite niche but legitimate concerns coming from the likes of the SHRC.
I caveat all of that by saying, again, that I am not legally trained but I do not doubt the honest concerns that those organisations have. To be honest, potentially the only way that I can see the situation being resolved is by those organisations going to the courts. I am not advocating that, but it is an option.
If they went to the courts, that would give rise to serious concerns, as it would represent a fairly fundamental breakdown in that relationship. As the sub-committee has observed, the way in which Police Scotland has engaged with those stakeholders has improved markedly over the period and we are in a better place as a result. However, can we convince the SHRC, the ICO and even the Faculty of Advocates of the value of continuing to engage in that process if the concerns that they are raising at this stage are acknowledged but then set aside by Police Scotland as it proceeds with the roll-out? Is that realistic?
I am not sure that I would characterise the situation in that way. I do not think that it would be fair—by any stretch of the imagination—to say that, from the moment that Police Scotland paused the roll-out of the digital device triage systems, reflected further on the SHRC’s and many other stakeholders’ concerns, including those of the sub-committee, and took advice, it has swept aside those concerns. Judging by the correspondence that I have seen from the SHRC and the ICO, Police Scotland has perhaps not been able to fully satisfy those stakeholders in regard to their concerns. However, my genuine belief—and I hope that sub-committee members agree—is that the police have attempted to engage with the likes of the SHRC and others in an open manner.
I mentioned the independently chaired reference group, which I have also written to the committee about. The SHRC would be an important voice on that group if it was willing to join it. When it came to future advancements in technology, we could then hear its concerns right from the beginning and do our best to address them. There might well come a point when, despite that, it was still not satisfied and, again, there could be an honest difference of legal opinion. It is often mentioned jokingly in passing—maybe I should not say this as the Cabinet Secretary for Justice—that, if you get two lawyers in a room, you might well get five opinions. There can be many opinions on matters of law and legality, but there are options available to resolve that.
I do not think that I would characterise the situation as involving a total breakdown of trust. I agree that taking such matters to court would be quite a step to take, but, ultimately, that might be the place to resolve differences if that could not be done through dialogue, changing procedures, improving processes and so on. That option is open.
13:45
I am not entirely sure on what basis you can make this assessment, but, in your opinion, what is the public’s view on the roll-out of cyberkiosks? Do you think that there is public confidence? Have the concerns that have been raised in relation to data protection and human rights slightly undermined public confidence?
Mr McArthur is right in that it is sometimes difficult to assess where public opinion is. We will all claim to always represent public opinion, given the jobs that we do, but we will always have vastly different opinions on the matter.
On issues that potentially infringe on an individual’s human rights, and in relation to ethical considerations, it is incumbent on Police Scotland and the SPA to do their utmost to give as much confidence as possible to the public. That is why they have sought a further QC’s opinion, and the principles for examination will be accessible and open to give the public reassurance.
We know from data that more and more crimes are committed in the digital space and that such crimes often involve very young adolescents and children. We can forecast that the issue will only become more important, not less important, in the investigation of crime. Yesterday, the Scottish centre for crime and justice research gave the victims task force a very interesting presentation about the views of rape victims and their journey through the justice process. One of the victims said that months had gone by but she still did not have her device back with her. I am paraphrasing, but she said something along the lines of, “I don’t know where my pictures have gone and who has viewed them.” That was quite a hard-hitting comment.
Therefore, on an issue that involves such important ethical considerations, Police Scotland and the SPA must give maximum public reassurance. If that means pausing things—as they have done in this case—reflecting further and improving processes, guidance or training, that is what should be done.
I will let in Daniel Johnson, then Stewart Stevenson. I am conscious of the time and that members need to be back in the chamber.
I am struck by the fact that neither Liam McArthur nor the cabinet secretary is able to point to evidence that demonstrates public support for the initiative. I am heartened by the fact that the cabinet secretary highlighted the importance of policing by consent—indeed, Susan Deacon did exactly the same thing when she was before the sub-committee. However, we have a structure in which the cabinet secretary appoints the chair of the SPA and the SPA appoints the chief constable. Is it not the case that nowhere in that loop of accountability is there the public voice? Is there a need to look at how consent is sought and established, not just on an individual basis but collectively? Is there a role for some form of deliberative democracy, so that we can understand whether the public consent to the use of such equipment and procedures by Police Scotland?
We should always give careful consideration to any proposals that would potentially enhance the public voice in appointments. You said that I appoint the chair of the SPA. Of course, that decision ultimately lies with the cabinet secretary. However, my understanding is that the former convener of the sub-committee—I think that it was Mary Fee—also played a role and was on the appointment panel.
Therefore, on the issue of capturing the public voice, we could potentially make the argument that the convener of the Justice Sub-Committee on Policing represents the public voice, because the sub-committee often airs public concerns. If there are further proposals that we should explore, they should be presented to us—we just have to be careful of potential unintended consequences.
That is my response to the first part of Daniel Johnson’s question. Although I have not been able to give you an exact assessment of what the public thinks on the digital devices, I can refer to the Scottish crime and justice survey, which I know that members will read when it comes out. It found:
“The majority of adults ... said that the police were doing a good or excellent job in their local area”.
Again, we would never be complacent about that finding—no doubt, we will always have to improve the percentage who consider that—but I think that there is a lot of confidence in the police and how they do their job.
Arguably, a bit of the future has just landed at Police Scotland and will shortly be taking to the air to gather data from which information will be extracted to provide evidence—I am, of course, speaking about the drones that were recently purchased by Police Scotland. We understand that the purchase was made prior to human rights or data protection assessments being carried out. Is the cabinet secretary satisfied with the process surrounding the introduction of that new piece of equipment? It sounds like a bit of a repeat of the issue with the digital devices, which has been the subject of our discussion up to now.
I think that there has been a fair bit of learning in relation to the roll-out of the drones. I would be more than happy to ask Police Scotland to write to the member, giving him those assurances.
Could Police Scotland write to the sub-committee rather than to me? Equally—I want to be robust about this—I asked you whether you are satisfied, cabinet secretary. I want to hear from Police Scotland on the subject—I am sure that sub-committee members also want to do so—but my question is really about the line of accountability to your office. That is what I am inquiring about.
Yes, forgive me—that is a fair question to ask. On the roll-out of the drone technology, I am aware that Police Scotland carried out full data protection assessments and equality and human rights impact assessments ahead of the launch. My understanding is that the sub-committee has asked for those documents.
On the privacy aspect of the drones, Police Scotland has informed the SPA that, given the mobility and potential deployment of the drones across many communities, community assessment will be done at a local level, which is absolutely right.
Yes, I am satisfied in relation to the issues that using the drone technology could raise, but I know that the sub-committee has requested additional information from Police Scotland. I await its receipt of and response to that information.
We have come to the end of our session. Thank you for your time, cabinet secretary. The sub-committee will maintain an interest in the external reference group. I hope that you will keep us updated on developments around it—indeed, we may provide feedback to you, as you have requested, on its membership. I thank you and your officials for your contribution.
13:53 Meeting continued in private until 13:55.