Justice Sub-Committee on Policing

Meeting date: Thursday, January 16, 2020

Official Report 494KB pdf

---

Facial Recognition Technology

Agenda item 2 is our third and final evidence session on our inquiry into how the police service in Scotland makes use of facial recognition technology. I refer members to paper 1, which is a note by the clerk, and paper 2, which is a private paper.

I welcome the witnesses to today’s meeting. Duncan Sloan is temporary assistant chief constable at Police Scotland; Lynn Brown is the Scottish Police Authority’s interim chief executive; and Tom Nelson is the SPA’s director of forensic services.

I thank the witnesses for their written submissions, which, as ever, are very helpful to members. We will move straight to questions.

Good afternoon. It would be helpful for the record if the witnesses would set out the process by which custody and criminal history photographs are uploaded to the police national database, and how and when those photographs are subsequently deleted.

In Scotland, we have our own system for recording the criminal history, including images, of a person who has been convicted in court. When a person is brought into custody and is arrested and charged by Police Scotland, their image, or photograph, is uploaded to our national custody system. Thereafter, the photograph is transferred to our criminal history system, and is ultimately uploaded to the police national database, which is United Kingdom-wide. That is an automatic upload. If the person is unconvicted at that time and their case for a crime or an offence is pending, the image is uploaded as “pending”, but is there for use.

When an individual has been through the criminal justice process—they have appeared at court and the outcome of their case has been determined—and has been found not guilty, notification is passed through by one of a number of partners, although it will generally be done by the Crown Office and Procurator Fiscal Service, in the first instance. The notification is passed to the police records bureau, and images are thereafter deleted from the criminal history system. The technical fix is that it is also deleted from the police national database.

Is deletion automatic, at that point?

Yes. There can be a manual aspect at the point when the records office receives the notification, because there can be complexities if there are numerous charges or offences. However, at the point at which the criminal history system is updated, images are deleted from the police national database.

What is the timeframe for that? Is it a matter of days?

My understanding—I have asked questions about it—is that it happens as near to simultaneously as possible, when results come in. There can be complexities when there are a number of charges and so on, but it happens in as near to real time as possible.

Are other types of images uploaded to that database, such as ones that have been captured by closed-circuit television or body-worn cameras? What are the sources of the images that appear on that database?

None of those sorts of images is stored on the criminal history system. What is stored there is absolutely in relation to criminal history. That can occur with the PND, which is a UK national policing system. That system was set up as a response to the Soham case, back in the day, so it is about information and intelligence sharing across the UK. It can contain intelligence images and CCTV images from a number of sources.

How does access to that database operate in police forces across the UK?

National training is available and people are trained in use of and access to the police national database, which is the criminal history system, and the police national computer—the PNC.

Is it envisaged that there will be cross-referencing between that database and use of live facial recognition technology? Is that happening at the moment?

That is not happening in Scotland. It is important to state that Police Scotland is not at the moment using, trialling or testing any live facial recognition technology.

In areas where that technology has been used, is the database being cross-referenced with the PNC?

Absolutely—I understand that that is being done in trials in England and Wales by the Metropolitan Police Service and South Wales Police.

I will follow up on Liam MacArthur’s question. You said that data is deleted when a person is found not guilty. What happens to the data if a person is found guilty, and the matter is effectively dealt with, and a disposal—a community payback order or another sentence—is given?

There are weeding and retention policies in place for the criminal history system. Those policies have been published and are publicly available.

In broad terms, the weeding and retention policies follow categories of crime. To generalise, I will say that one rule is applied to lower types of offences and a more serious rule is applied to group 2 offences. For murder—group 3—we hold the data indefinitely in the case of a guilty verdict. The weeding and retention policies are time-bound for criminal history and, by virtue of the fact that there is an automatic process, that rolls on to the police national database.

Thank you. If a person is found not guilty and the reason why the data was being kept has been dealt with, but there are outstanding matters that need to be dealt with by the court, what happens to the data? Are such circumstances treated uniquely or are there strict rules?

Under legislation, in broad terms, we can hold on to only DNA samples, in certain circumstances, when it comes to biometric data. Regulation, through the Criminal Procedure (Scotland) Act 1995, is specific about that. The legislative framework in relation to images is not so clear—as, I am sure, the committee is aware.

You have touched on the subject of a question that I was about to ask—the distinction between how DNA and fingerprints are stored and subsequently deleted, and what happens with images. Are the processes broadly the same? You seem to be suggesting that there are different rules around what happens for DNA at the point of deletion.

Images, DNA samples and fingerprints that are categorised specifically in legislation are all dealt with in the same way by Police Scotland. Although there is no statutory legislation and guidance framework on images, we use images in the same way as we use DNA and fingerprints. Similarly, Police Scotland voluntarily deletes images at the same point as it deletes DNA and fingerprints.

That is custom and practice, rather than a requirement in relation to images.

Yes.

Would it be helpful if the Criminal Procedure (Scotland) Act 1995 were to be updated to cover photographs and images?

Absolutely. My colleagues here have been more involved in the history of this through the independent advisory group on biometrics and the bill that is in train. A framework and guidance that would allow us to operate within it would be valued and welcomed.

I am conscious that Mr Sloan has had all the questions. He or other panel members could answer the next question.

You mentioned a framework. We have heard that Police Scotland risks legal challenges if it uses images that are held on the UK national database of people who have not been convicted of any crime. We are also aware that there was a High Court ruling in 2012 that has not been adhered to. Can you comment on that? Does the potential for legal challenge on that issue concern the SPA?

As I said earlier, under our system we remove images from the database of criminal history and the PND. There is not a concern for policing in Scotland in that regard. As the sub-committee is aware, by virtue of its being a national system, Police Scotland can access images on the PND that have been uploaded by forces in England and Wales. While utilising the PND in our investigations, Police Scotland could come across an image of a person who was not convicted—who was innocent, if you like. That creates a concern nationally. The 2012 ruling said that it was illegal to hold such images, and the Home Office and forces in England and Wales are working on a solution to weed those images out.

There was a report by Her Majesty’s Inspectorate of Constabulary in Scotland about images that the legacy forces held. Would it be right to say that the situation is not being compounded? Is it correct to say that you have the situation sorted, but it was not sorted in respect of the legacy forces?

That is correct. I am not technical, but I know that there are technical issues in respect of those forces having uploaded images. The legacy forces had different systems to record images when people were brought into custody. Police Scotland has a technical solution. When a person is brought into custody and is arrested and charged, our national custody system takes an image that is transferred to the criminal history system. It then falls off our custody system—it no longer sits in that system.

However, we still have legacy forces’ systems in place, so we are working through information technology solutions to delete images that we still hold. Last year, we deleted more than 400,000 images—hard copies and images that were held on hard drives. The process is acknowledged. I assure the sub-committee that Police Scotland is working towards a situation in which no images will be held anywhere other than the criminal history system.

The sub-committee will feel reassured that the issue is not being compounded and that images that should not have been kept are being deleted. However, is it fair to say that, as long as a substantial number of images that should not be retained are being retained, they could feature on the UK national database?

No, they could not feature on the national database, because the only way that they are uploaded to the police national database is through the criminal history system.

Forgive me. I am not technical, either, and I appreciate that a number of systems are in play. Are you saying that the images that Police Scotland has—and wishes to delete—do not feature on the UK database?

That is my understanding; the images that are contained on the police national database are held only at the point of charge, pending a case, and are thereafter deleted on non-conviction of an innocent person. That part is taken care of.

13:15  

The aspect that we are having to work through is that we still hold previously taken images from legacy forces that are not connected to the criminal history system. They sit in a separate system. We are working through those systems with technical people and IT to fix that. That process is taking its course.

Was there a change in processing that meant that when Police Scotland came into being, images were uploaded to UK databases that had not previously been uploaded?

No. An image’s going on the Scottish criminal history system has always been the point at which the image has been uploaded to the police national database. There is no custody database.

I clarify that there is no central system for England and Wales. Custody images that are taken at a police office are uploaded to the PND. We have a central approach, which is the criminal history service. Custody images go there in the first instance, and are then uploaded to the PND.

Forgive me, but I need to flog this matter. What was the purpose of the retained images that were not on a criminal history system and that you want to get rid of? How did they come to be there in the first place?

In 2015 or 2016, Her Majesty’s Inspectorate of Constabulary in Scotland looked at the images that were stored by Police Scotland. There are still some in existence in legacy systems. Those images had been stored by the legacy forces when there was no policy on weeding and retention. A person who was brought into custody who gave a false identity could be examined against the images that were held in the custody system, which had that purpose. In addition, they could be referred to in complaints or investigations into that person’s episode in custody. However, those images were held completely separately from the criminal history system and the police national database.

Do the photographs of people other than those who have been taken into custody feature in the legacy systems?

They do not, as far as I am aware, although I do not have information to hand. I can look into that. I think that the images include only people who were brought into custody and arrested.

Could you get back to the committee on that? You will appreciate that a figure like 400,000 represents a significant percentage of the Scottish population. I imagine that such a number would not necessarily be reflected in the number of people who are processed through the criminal justice system. I appreciate that the images have been gathered over a long time.

Mr Sloan raised the position of other UK forces. What legal framework have the UK forces that have trialled live facial recognition relied on?

I am aware of trials by the Metropolitan Police and South Wales Police. There has been much examination of those trials at judicial review level and through oversight by the National Police Chiefs Council, as well as by the Home Office, which has funded South Wales Police, in particular, to take part in the trials—

I am sorry—I need to interrupt you on the matter of the South Wales Police. You will be aware that there is potential for legal action, so we should not comment in detail on that. I suspect that you were not going to, anyway.

Absolutely.

It is best that I emphasise that Police Scotland’s position is that we do not intend, at this point in time, to trial any live facial recognition technology. I cannot speak for England and Wales, but because testing and trialling is on-going, as has been previously discussed, we would welcome a legal framework in order to maintain legitimacy for Police Scotland and to have the consent of the people. We would welcome a wider public debate with interested parties, so that we would understand the nature of the technology and how it would be used, before embarking on a course of action to use such technology. Therefore, the introduction of a Scottish biometrics commissioner will be welcome.

That idea overlaps with quite a bit of work that has been done.

I have a final question for you, Mr Sloan. You are obviously aware of the trials that have taken place: I imagine that you have kept a watching brief on them. Can you comment on the principles of necessity and proportionality, and do you feel that those have been met by the forces that have deployed the trials? Has the balance that we all understand between community and public safety and individual liberties been properly tested?

Again, I would not like to comment specifically on that. The Information Commissioner’s Office has opined on use of the technology and on the trials down south and there has been a judicial review. However, it is fair to say that you are right: we are keeping a close eye on how that technology is being utilised, and on the trials.

For Police Scotland, the most important aspect of use of new technology, whether it be facial recognition or any other technology, is the need to strike a balance and to legitimately gain and maintain the trust of the public. We would absolutely have to address that—it is a strict necessity within the terms of the Data Protection Act 2018—in respect of how we would apply such technology, and in respect of proportionality.

Facial recognition technology has a long way to go before we would get to the stage of using it—if we ever would. As with other techniques and tactics that are used by Police Scotland, that would be strictly intelligence led and targeted. We are not about to embark on use, but if we were to do so, it would be along the lines of necessity and proportionality.

I understand Police Scotland’s position, which is that there are no plans to use the technology yet. In their 10-year strategy, the SPA and Police Scotland envisage the technology being used in the future. How crucial is it to ensure that there is a clear legal basis for its use?

A clear legal basis is essential. We welcome the decision to have a biometrics commissioner, and the fact that the commissioner will have further-reaching powers than are available in England and Wales.

We would welcome a code of practice. The SPA’s role would be to make sure that Police Scotland was abiding by that code of practice.

It is an area of intense public interest. We have an opportunity to give the public the confidence that we are approaching it in an appropriate manner.

I understand that the Scottish Police Authority is to consider Police Scotland’s latest report on digital triage devices. Do you feel that lessons can be learned for the potential use of live facial recognition technology? Police Scotland has had robust engagement and assessments.

There are lessons to be learned from the work on cyberkiosks—or digital triage devices, as they have been referred to—as will be seen at tomorrow’s meeting. I cannot pre-empt what the authority is going to do, but the sub-committee has been very helpful in setting out the areas that needed to be considered, such as the impact on the community and issues of privacy and information exchange. As I understand it, those areas are covered in the report.

Impact assessments around human rights and data should be common practice. We welcome the sub-committee’s interest in that, and we think that it is one of the areas in which a biometrics commissioner would be particularly helpful.

I have a couple of questions about the 10-year policing strategy up to 2026. Given that the strategy endorses the use of new technologies, how will the SPA carry out its oversight and governance functions to ensure that the necessary assessments, such as on human rights and data protection, have been undertaken prior to those technologies being used?

Today, as part of a development day, the board is looking at the issue as it relates to our oversight of change. The situation has been made more acute because of cyberkiosks and the sub-committee’s interest in facial recognition, for example. We are putting together a more structured approach to determining what will be decided within the strategy. We will work with outside agencies such as HM Inspector of Constabulary in Scotland to make sure that we address all the relevant issues of which we have oversight.

Will that include consideration of ethical concerns? If so, how do you propose to do that?

It will include such consideration. I know that our audit committee is particularly interested in that. Police Scotland is setting up a data ethics committee, and my colleague Mr Nelson has been involved in the digital working group that is looking at such issues. It is essential that we look at ethical considerations. Mr Halpin, the board member who chairs the forensics committee, is particularly interested in that area, and our vice-chair is on the Scotland committee of the Equality and Human Rights Commission. We are acutely conscious that ethics is an area in which we should make sure that the public interest is served.

I have one more question on the same topic. The SPA is the co-author of the 10-year strategy and has responsibility for independent oversight of it. Does that represent a conflict of interests?

We have a number of responsibilities as part of our role. We have to support, challenge and scrutinise Police Scotland, and we will try to do that in the most balanced way that we can. The SPA produces the strategy, but we must work with the police, because they know their service and what issues are faced. There has been close collaboration in putting together something meaningful but, in the end, it is the SPA’s strategy, and it will be considered by the board tomorrow.

You do not think that there is any conflict of interests.

Do you mean with regard to the relationship between the SPA and the police?

Yes.

I know that the Auditor General for Scotland has said that maybe we should look at that, and the board is of the view that there definitely needs to be more clarity on that relationship and the various roles and responsibilities. We welcome that debate.

I return to the use of live facial recognition technology, which the convener raised.

Mr Sloan, you said that Police Scotland does not currently have any plans to use such technology. However, it is mentioned in the 10-year strategy document. If there were any plans to progress with it in future, how would you proceed? Would a business case have to be prepared, for example?

Absolutely. Reflecting what the 10-year policing 2026 strategy says, I recognise that there is a public expectation that, in modernising and transforming itself, the police service should utilise technology. However, as I said, that must be balanced against the need to respect human rights and privacy.

Police Scotland has been on a journey, in the course of which we have worked on a number of other areas of technological development, and we have taken some learning from that. We need to have a wider debate on policy and what the public expects and would consent to, so that what we do is legitimate. Ms Brown mentioned the use of independent ethics panels, and we are setting up a framework for data ethics, which is a more nuanced aspect of the issue. Within that framework, we will consider what our approach should be to the use of data and taking a more holistic approach so that we can comply with any legislation.

I come back to the fact that the first step is to have the right approach. We will have a legislative framework in place, whereby the Scottish biometrics commissioner, whoever that might be, will lead the public debate, and Police Scotland will need to be fully involved in that.

You seem to accept that there are some reservations about the use of live facial recognition technology. Although you are not using it at the moment, you acknowledge that, if it were to be used in the future, a process of consulting the public would have to be gone through and, once the biometrics commissioner is in place, the ethics involved would have to be looked at. In other words, robust analysis would have to be carried out before it was implemented.

I absolutely accept that, and that is our intention. Whatever independent groups or ethics panels we use, there will be nuances, depending on the technology and what space we propose to use it in. We expect civil liberties groups and academics to be involved in the process, and proper, accurate testing and trialling would have to be carried out to understand whether use of the technology would be viable within the financial constraints that we face. We must also consider whether its use would be proportionate—not only in terms of the technology’s deployment in the public domain but in getting the bang for our buck and ensuring that it is a sound financial way forward.

13:30  

In your reply to James Kelly’s question, you mentioned getting the bang for our buck. Has any work been carried out to assess the effectiveness and reliability of the technology? I appreciate that you have not started trialling it, but are you concerned about the reports that we have heard—for instance, that the inaccuracy rates for the technology that has been trialled by the Metropolitan Police and South Wales Police were 98 per cent and 91 per cent respectively? Are you not concerned about the possibility of investing in technology that has such high inaccuracy rates?

I reiterate that we have not yet embarked on the trial process in Scotland, but we are aware of on-going trials elsewhere. A myriad of commercial companies provide such technology. Obviously, I cannot comment on the effectiveness of the different types of software that are available, the reliability of which would have to be considered seriously. A balance must be struck in relation to intrusion, privacy and human rights. From an equalities point of view, there has been discussion of the efficacy of the technology and the biases that have been seen to exist in the type that has been trialled.

There have been concerning reports about in-built gender and racial bias in the currently available technology. Perhaps Lynn Brown or Tom Nelson would like to comment on that.

We must ensure that we test and understand the limitations of any new technology that we roll out. I am aware of a number of reports about the technology that is already out there. I do not know anything about that version, but I am sure that, before Police Scotland or the SPA roll out any form of software, they will want to assure themselves that it does what it says on the tin. However, just because the software does that elsewhere does not always mean that it will do the same when it is brought into our environment. We must ensure that the whole system has been tested and validated before it is taken to the next stage, which would be to put together a business case.

I support what Tom Nelson has just said. Any major capital investment has to go through an appraisal of its financial benefits. That should include the other aspects that we have discussed today, such as the technology’s effects on the rights of individuals. We would certainly aim to look at the whole thing, but in particular we would need to be confident that the technology itself was sound and met all the public interest requirements.

Mr Sloan mentioned commercial companies. Obviously, the supply of such software would be put out to tender and companies would then make sales pitches to the effect that they offered the best equipment. Are you confident that the relevant departments in Police Scotland and the SPA have sufficient technical knowledge for proper evaluation?

The public procurement rules would apply to such a contract. If we needed expertise to help us make a decision on best value, we would bring that in. We would seek out support if we needed to do so to meet the public procurement requirements.

Might that be necessary?

It could be.

Our witnesses might know that the Parliament is considering a bill to establish a Scottish biometrics commissioner. Without pre-empting any decisions that the Parliament might take—we are at an early stage in that process—if the legislation were to be passed, do you see a role for that commissioner in determining the type of equipment that might be used? It has been suggested to us that the commissioner might have such a role. There are a lot of snake oil salespeople out there, in every field. My colleague Rona Mackay mentioned inaccuracy rates of 98 and 91 per cent. You might anticipate that those figures represent a success rate, rather than a failure rate. You can do the sums; they are not good.

Mr Nelson, if the bill goes through, would it be part of the biometrics commissioner’s role to look at the type of equipment that might be used?

The role would certainly have an oversight function. I would hope that we would bring in a code of practice, such as the one that we developed as part of the IAG’s work, which produced a process to validate the roll-out of new technology. We expect to follow that type of framework again. I am sure that the biometrics commissioner would be interested in ensuring that we followed such a code, and interested in the output from that. The SPA board would then need to give the final sign-off.

Irrespective of whether the commissioner has the role of saying yes or no, they would have an interest and a role in understanding that we had gone through a reliable process to get to that point.

For the avoidance of doubt, I am not suggesting that the commissioner would have a say in whether Police Scotland should have access to the technology—we all understand why people buy a certain type of car. However, this is a matter of understanding the complexity of algorithms that produce disproportionate results, not least in relation to race and gender, which is of concern to us all. Is that aspect sufficiently robust?

All those points—race, gender, lighting and angles—would be built into an assessment protocol, to ensure that they were covered before a recommendation was made.

I offer my apologies to the sub-committee and to the witnesses for my late arrival; I was sponsoring an event at lunch time and I have been trying to be in two places at once.

The sub-committee has heard in evidence that it is “totally impractical” to think that we can meet consent requirements for the use of live facial recognition technology in public places. If the technology is to be introduced, what will need to be done to get that public consent and confidence?

The consent issue is an important one for Police Scotland in particular, and we are learning from the on-going trials down south. It would depend on how facial recognition technology was applied and where it was used. If it was used in a wider context, there would be no option for people to opt out.

We would need to get our ducks in a row, have the wider public debate, get the message out about the technology’s purpose, and be very clear that we were using such technology for a strictly necessary and proportionate purpose.

In that future world where the technology was being used, there would need to be public engagement through information, advice and notification. Questions have been asked in the trials. For example, is it enough that the public know that cameras are taking photographs? Such issues would need to be foremost in the public’s mind, and a huge exercise in public communication would need to take place to get the message across.

That is where the biometrics commissioner and the code of practice will be invaluable. The expectation is that the code of practice would cover most of the concerns, and that it would be followed before we got into trials or used the technology more widely. The role of the biometrics commissioner will be absolutely essential to any introduction of the technology. It is reassuring and helpful that, in Scotland, the biometrics commissioner will be asked to look at that as part of their remit.

Duncan Sloan mentioned a public debate. We know that LFR has been used at political rallies and demonstrations and at campaign marches. Will that have an impact on people feeling that they are able to express their views democratically? Is there a tension between the legitimate right to freedom of expression—a fundamental human right—and the police’s responsibility to keep us all safe?

I absolutely agree that there is a tension. I hark back to my previous comments on the tension in relation to intrusion, the right to privacy and human rights. In order for the police to maintain public support, legitimacy and our relationship with the public, it is critical that there is significant consideration of how we would deploy the technology in public spaces. The biometrics commissioner and independent ethics groups should get round the table to explore and identify the issues and to find areas of commonality and consent.

You touched on the general debate. There was some debate about digital triage devices, which have been referred to, and we are now talking about live facial recognition technology. Mr Nelson will perhaps know about other emerging technologies. Can the debate await the appointment of a biometrics commissioner, should that legislation go through the Parliament? There seems to be cross-party support for that appointment.

The best way to describe it is to say that the debate is on-going. We welcome the cabinet secretary’s announcement last year on the formation of an independent reference group, which will look not only at facial recognition technology but at all use of such technology, including by the police. We welcome, support and want to be engaged in that work in order to further the debate.

The group’s terms of reference have just come out. The SPA, Police Scotland and other relevant parties will be represented on it, and I think that its work will reassure the public and the sub-committee about how the technology will be taken forward.

Does Mr Nelson wish to share with us any emerging technology that we need to know about?

I have none up my sleeve at the moment. [Laughter.]

Could a generic approach be applied to all technologies in relation to testing human rights issues and the community impact, or will we need to go through this exercise on each occasion?

All the technology should be taken through the same assessment, and it is important to have the framework and understanding of how it will work. Obviously, different things will need to be looked at, depending on the technology and how intrusive or otherwise it might be.

I apologise if I missed this when my colleague Liam McArthur asked his questions, but are any other types of images, such as those from CCTV or body-worn cameras, uploaded on to the database at present?

No. If the police were investigating a crime and a CCTV image was available, that image would be used for comparison for a specific purpose. It would be retrospective.

Such images are not on the database.

No.

Thank you.

Members have no more questions. I thank the witnesses for their succinct answers. We are finishing a wee bit sharper than usual, but that does not mean that we have not got through a considerable amount of information, so thank you very much indeed for that.

13:43 Meeting continued in private until 14:01.