Justice Committee

Meeting date: Tuesday, February 4, 2020

Official Report 647KB pdf

---

Scottish Biometrics Commissioner Bill: Stage 2

Item 2 is consideration of the Scottish Biometrics Commissioner Bill at stage 2. I ask members to refer to their copy of the bill, the marshalled list of amendments and the groupings of amendments, and I welcome Humza Yousaf, Cabinet Secretary for Justice, and his officials. We will be joined by Gordon Lindhurst later, for consideration of amendments that he has lodged.

Section 1 agreed to.

Schedule 1—The office of Scottish Biometrics Commissioner

Amendment 14, in the name of the cabinet secretary, is grouped with amendments 15 and 17.

Good morning. Amendments 14, 15 and 17 will make minor and technical changes to the bill. Schedule 1 makes detailed provision on matters such as the appointment, status, terms of office and remuneration of the commissioner. Paragraphs 7(1) and 7(3) provide for the parliamentary corporation to pay or make arrangements to pay the commissioner such remuneration, allowances, pensions and gratuities

“as the Parliamentary corporation determines.”

The parliamentary corporation will have discretion over the amounts that are to be set. Amendments 14 and 15 simply clarify that it will also have discretion as to whether anything is paid at all, in case there is any question about whether it can determine to set an amount at zero.

It will therefore be for the parliamentary corporation to decide whether payments are made and, if payments are made, at what level. That will provide maximum flexibility for the parliamentary corporation to determine matters as it sees fit.

Amendment 17 will simply fix a typographical error in section 2(4)(a).

I move amendment 14.

As members do not have any questions or comments for the cabinet secretary, he does not need to wind up.

Amendment 14 agreed to.

Amendment 15 moved—[Humza Yousaf]—and agreed to.

Schedule 1, as amended, agreed to.

Section 2—Functions

Amendment 16, in the name of the cabinet secretary, is grouped with amendments 3, 18, 24 and 7.

Amendment 16 adds the Police Investigations and Review Commissioner to the list of persons who are subject to the oversight of a Scottish biometrics commissioner. In line with that, amendment 24 makes a change to section 7(1) to include the PIRC as a person who is subject to the code of practice.

Amendment 18 adds the Commissioner for the Retention and Use of Biometric Material to the list of bodies that the Scottish biometrics commissioner can work with jointly, assist or consult. The committee asked me to do that in its stage 1 report, and I am happy to oblige. The Commissioner for the Retention and Use of Biometric Material has the functions of keeping under review national security determinations that are made by the chief constable of Police Scotland and the retention and use of biometric material by the police for terrorism investigations and national security purposes.

Amendment 18 reflects the importance of the Scottish and United Kingdom biometrics commissioners co-ordinating their activities when carrying out their roles in Scotland by explicitly mentioning the Commissioner for the Retention and Use of Biometric Material in section 3.

Amendments 3 and 7, in the name of James Kelly, seek to include local authorities, health boards, the Scottish Prison Service and external contractors that provide biometric services as bodies that fall within the oversight of the commissioner and which are subject to the commissioner’s code of practice.

I recognise that members are keen to provide the public with the fullest protection against the mishandling of biometric data in a criminal justice and policing context. We all want that. However, as I have said previously, the existing provisions in the bill already go some way towards covering the activity of other bodies. The commissioner’s oversight function would allow the commissioner to review and report on the activities of public and private sector bodies that provide biometric data services to the police, the Scottish Police Authority or the PIRC. Furthermore, the code of practice could require any contracts that those bodies enter into with third parties to be compliant with the terms of the code.

I will consider consulting on including further persons or bodies in respect of their criminal justice or policing functions in due course. However, I will do that only once sufficient time has passed to allow the current oversight provisions to bed in. That would be in line with what the committee recommended. It would be premature to add all those other bodies now, when the commissioner’s office is just getting up and running.

For the avoidance of doubt, if James Kelly’s amendments were agreed to, the expansion in scope that they propose would be no small undertaking, and would have a substantial associated cost. There are 14 regional health boards; the Scottish Prison Service has 15 prisons that, together, hold more than 8,000 prisoners; and there are—as we all know—a total of 32 local authorities. There has been no consultation—none whatsoever—with the Convention of Scottish Local Authorities, the health boards or the Prison Service on the proposal.

In addition, as things stand, the commissioner’s role is due to be 0.6 full-time equivalent. The expansion would require the role to be full time, as well as—undoubtedly—requiring the employment of additional staff. Again, that would all come at huge cost, and without any consultation.

I urge members not to be rushed into expanding the scope of the commissioner’s oversight at this time; instead, they should allow time for proper reflection, discussion, consultation and analysis of the cost with the bodies that would be affected.

I move amendment 16.

Amendment 3 seeks to extend the remit of the commissioner to public bodies, including local authorities, health boards, ministers—in respect of the Scottish Prison Service—and contractors that provide services to those groups. Amendment 7 is a logical follow-on, in that it seeks to extend the remit of the code to cover the bodies that are listed in amendment 3.

I will move my amendments for three reasons: the extension is logical; it is important for public confidence; and it is also important for futureproofing. I welcome the extension that the cabinet secretary has made beyond the original drafting in the bill, but it does not go far enough; it leaves a gap in the provision in relation to health boards, local authorities, the Scottish Prison Service and contractors working with those bodies. There are huge issues around the collection and use of biometric data, and if we are setting up a biometrics commissioner, it is important that they have appropriate scope to cover all those bodies. My approach is supported by the Open Rights Group and Amnesty.

My second reason for moving my amendments is that I believe that the approach is important for public confidence. If we are going to establish a biometrics commissioner, their work should have proper reach. If there are gaps, the public will question why those gaps are not being covered.

Finally, on futureproofing, the committee heard that technology is moving very quickly in this area. It is therefore important that we cover all those bodies because developments in technology and other such issues will come up in future. It is important to get the scope and reach of the commissioner right at this stage.

I support the cabinet secretary’s move to include the PIRC in the provisions of the bill. I have spoken previously about the policing function and how it is not exercised exclusively by Police Scotland, so the move is appropriate.

I also support James Kelly’s amendments 3 and 7, for the reasons that he articulated. His amendments are supported by the Open Rights Group and Amnesty. I refer members to my entry in the register of members’ interests, as I am a member of Amnesty.

Public confidence is important, but the committee repeatedly heard calls for a public debate on the issue. I hear what the cabinet secretary says about consultation, but the independent advisory group has referred to that issue.

We have the opportunity to ensure that we futureproof the bill, so I will support the cabinet secretary’s amendments and those in the name of James Kelly.

There is merit in the cabinet secretary’s amendment 16, but I remain somewhat concerned about Mr Kelly’s amendments 3 and 7. Mr Kelly talked about the extension being logical and about public confidence, but I am not sure that that makes it practical. The cabinet secretary was right to highlight the possible costs, and I would like to understand a bit more about that.

Throughout its evidence taking, the committee was also concerned about whether the new commissioner would have sufficient capacity, given the part-time nature of the post and the amount of funding available. If, through amendments, we add in significant extra responsibilities, is there not a risk that we inadvertently overburden the commissioner before we have even discovered whether they have capacity for what was originally included, plus the PIRC?

I do not necessarily disagree with the premise in amendments 3 and 7, but I feel that they have come out of the blue, unlike the cabinet secretary’s amendment 18, as what it proposes was referred to in the stage 1 report. Amendments 3 and 7 were lodged without any consultation, as has already been said, and I do not feel that we took enough evidence—or any, in some respects—during stage 1 about the issues. We really need to hear the views of the national health service, COSLA and the SPS, among others, on amendments 3 and 7. At this point in time, I cannot support them. They have come a wee bit out of the blue.

11:15  

I will oppose amendments 3 and 7 on fairly clear grounds, the main one being cost. On the capacity issue that Liam Kerr mentioned, the scope of the role will become far too wide for a part-time commissioner at the start of his post. Our stage 1 report did not recommend adding the extra bodies right now, and the Government has indicated that it may be appropriate to extend the remit in future. Adding them at this stage would be the wrong thing to do, and I will oppose it.

I thank James Kelly for lodging the amendments.

It is right to say that, at stage 1, the committee did not take a firm view on such an extension. However, the purpose of stage 2 is to probe. James Kelly’s points about public expectation, public confidence and futureproofing are right.

If the extension is a bridge too far at this time—and I rather suspect that it is, for reasons that others have articulated—we should at least paint a pathway to the point at which the use of biometrics technology in the areas in question, and potentially others, is achieved. The public would expect us to do that.

Although I am not minded to support amendments 3 and 7 in their current form, they serve a useful purpose in aiding us to move towards where we need to be.

I welcome the cabinet secretary’s extension to the bill to cover the PIRC, as he committed to doing during the stage 1 debate.

I oppose James Kelly’s amendments on the very straightforward basis that the evidence that the committee took at stage 1 is not sufficient to support the proposed extension at this stage. There was a lot of discussion of the evidence, and we landed on a phased approach as the best way forward. That has been acknowledged by the cabinet secretary; it might be helpful for him in his summing-up to say a little more about that phased approach.

I welcome the inclusion of the PIRC in the commissioner’s oversight.

There has been a good discussion of the issue. The committee should look at futureproofing and whether there are any gaps, but, equally, there are huge implications about how the extension would work in practice, so I tend to agree with Liam McArthur: it is absolutely right to discuss the issue and put it firmly within the cabinet secretary’s sights at this stage. If the proposal is not agreed to, perhaps we should consider how we could look at it at stage 3.

I will address a couple of points.

I do not agree with Fulton MacGregor’s comment that the amendments have come out of the blue. The point was made clearly by the Open Rights group and by Amnesty in their submissions to the committee and ahead of the stage 1 debate. It was also covered in the stage 1 debate; I specifically mentioned it, as did John Finnie.

I acknowledge that there would be additional costs. However, as was said throughout stage 1, we are asking the commissioner to undertake a serious role. We are at stage 2. If the amendments are agreed to, there will be an opportunity at stage 3 to take account of them and to upgrade the commissioner’s role.

Ultimately, capturing data, getting the approach right and ensuring that human rights are observed are serious issues. Therefore, it is right that the scope of the commissioner’s role should be widened and that any consequential costs should be met.

I very much associate myself with the remarks made by Liam McArthur, Liam Kerr, Fulton MacGregor and the convener. It was helpful for James Kelly to lodge the amendments, so that the point could be debated and discussed. I know that his doing so was well intentioned and that the amendments reflect concerns that have been raised by important external stakeholder groups.

However, I will go back to my central point, and will try to give some reassurances. The need to futureproof the bill has been mentioned. It is because of the need to do so that the bill contains a power to amend the legislation to include other bodies. If it was thought that more bodies should be added to the list, that could be done in a phased way. The power to extend the list of bodies already exists.

I want to reassure James Kelly on one particular point that he raised. Section 2(3)(a) instructs the commissioner to

“keep under review ... the acquisition, retention, use and destruction of biometric data by”—

this is the important part—

“or on behalf of the persons”

named in the bill. That means that, if the police are using medical professionals to collect biometric data, the commissioner will examine what those medical professionals do.

The commissioner has a defined and set role, and there is a phasing-in period. If Parliament and others think that the list should be amended to include other bodies, that can be done under the legislation. However, it would be wrong to do that in relation to substantial bodies without any consultation or costings.

Again, I thank James Kelly for lodging his amendments, which have allowed for a good debate.

Amendment 16 agreed to.

Amendment 3 moved—[James Kelly].

The question is, that amendment 3 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kerr, Liam (North East Scotland) (Con)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)
Robison, Shona (Dundee City East) (SNP)

The result of the division is For 2, Against 7, Abstentions 0.

Amendment 3 disagreed to.

Amendment 4, in the name of John Finnie, is grouped with amendments 13 and 30.

Amendment 4 is about the role that the commissioner could play in keeping technologies under review. We heard a lot of evidence about the efficiency of the equipment that has been used and the atrocious success rates—2 per cent, which is ridiculously low when we are talking about people’s human rights and the importance of community safety. If we want to have effective equipment, if it is ever deployed, it is important that the commissioner should have some oversight role in relation to the technology that is used in the acquisition, retention, use and destruction of biometric data. I hope that members will support my modest proposal.

I move amendment 4.

I support John Finnie’s amendments, for the reasons that he has set out.

Under section 2, the commissioner will monitor the extent to which the relevant bodies comply with the code of practice. Amendment 30 provides that if, in the course of monitoring the code, the commissioner finds that it is being disregarded, that information must be made public.

Colleagues will recall lengthy discussions during stage 1 about whether the enforcement powers in the bill go far enough. Many, including the Scottish Human Rights Commission and the Open Rights Group Scotland, concluded that they did not. The Government has always maintained that the bill’s strength is to be found in the persuasive powers of naming and shaming or, at least, the threat of that. In that regard, the cabinet secretary said that the power of reputational damage should not be underestimated. Of course, that view is shared by the current UK commissioner. However, I am concerned that, if the commissioner is not required to make breaches of the code public, the risk of reputational damage is one that many people might be prepared to take.

I appreciate that there might need to be a degree of latitude around minor breaches that are quickly rectified once they are identified. However, if the public are to have confidence in the new powers, transparency is key. In that context, amendment 30 is a sensible step in the right direction, and I hope that the committee and, indeed, the Government, will support it.

I do not consider amendment 4 to be necessary. The commissioner’s review duty under section 2(3)(a) already implicitly includes the function of keeping under review the methods or technologies used to

“acquire, retain, use and destroy”

biometric data. That is because the phrasing is such that what must be reviewed is

“the law, policy and practice relating to the acquisition, retention, use and destruction of biometric data”.

The technologies that are used would relate—very much—to that data.

Furthermore, if amendment 4 is agreed to, it could cast doubt on whether the commissioner’s function as set out in section 2(3)(b) includes the function to promote public awareness and understanding of the power and duties of the police and the SPA in relation to the use of biometric technologies, given that no similar reference to biometric technologies would be added to the provision. I ask John Finnie not to press amendment 4. If the committee wishes to see an express reference to technologies, I would be happy to work with the member on a suitable amendment ahead of stage 3.

Amendment 13 would require persons mentioned in section 2(1) to comply with the commissioner’s recommendations regarding biometric technologies. It would be entirely acceptable to require a person to indicate what steps they were taking in respect of a recommendation by the commissioner and to make those steps known to the Scottish ministers and Parliament. However, I have concerns about the way in which proposed section 15(3C) would require those specified in section 2(1) not to use a technology if the commissioner recommended that it should not be used.

There are several difficulties. First, it would not be acceptable that a recommendation by the commissioner on the use of a certain kind of technology should be binding to the extent that it impinged on the operational independence of the police, given that the SPA and Her Majesty’s Inspectorate of Constabulary in Scotland do not have similar powers. Secondly, such things would not be recommendations at all: proposed section 15(3C) would, in effect, allow the commissioner to make the law on the use of biometric technologies without there being any consultation or approval mechanism in place. I consider that that would subvert the role of Parliament.

Thirdly, the law must be accessible. If the commissioner’s recommendations were in effect to be law, a person would have to trawl through the commissioner’s reports and code of practice as well as the substantive law to find out what technologies they were allowed to use. That would mean that the rules on technologies would not be as accessible as they should be.

Finally, there would be no mechanism in the bill for the recommendations—in effect, prohibitions—to be amended or revoked by the commissioner at a later date.

For those reasons, I ask John Finnie not to move amendment 13.

Amendment 30, in the name of Liam McArthur, to some extent duplicates section 15(1)(a), which provides that the commissioner may prepare and publish reports about whether persons who are required

“to have regard to the code of practice have done or are doing so”.

Amendment 30 makes it compulsory to publish reports about failures to have regard to the code.

As is clear from the bill’s accompanying documents and stage 1, it is anticipated that reporting will be a key aspect of the commissioner’s role. Therefore, I do not consider amendment 30 to be necessary. In addition, the way in which it inserts that duty is slightly confusing, because it does not alter the commission’s discretion to issue reports under section 15. That would mean that, in one sentence, we are saying that the commissioner “must” issue reports on failings but, in the next, that the commissioner “may” issue reports. Therefore, I ask Liam McArthur not to move amendment 30. However, if he is not reassured by my comments and still wishes to make that element of reporting mandatory, I would be happy to work with him to agree a suitable amendment ahead of stage 3.

It was remiss of me not to refer earlier to amendment 30 in the name of my colleague Liam McArthur. I lend support to amendment 30 for the reasons that he outlined.

I do not recognise the cabinet secretary’s characterisation of the intention behind amendment 4. When it comes to something that could impact on citizens’ human rights and have such a level of collateral intrusion, I have no concern about someone having to “trawl through” various information to come up with the appropriate answer. We know from the various information technology projects that it is hugely important to get things right. We do not want to find ourselves in the situation that we were in with the cyberkiosks, where the equipment has already been bought so we have to go along with it because of the expenditure that has already been made. There are several issues around that.

I am happy to engage with the Scottish Government on that point to come up with an amendment that would meet the intention and what we all want to see, which is that quality equipment is correctly deployed. I will not press amendment 4.

11:30  

Amendment 4, by agreement, withdrawn.

Amendment 17 moved—[Humza Yousaf]—and agreed to.

Section 2, as amended, agreed to.

Section 3—Power to work with others

Amendment 18 moved—[Humza Yousaf]—and agreed to.

Section 3, as amended, agreed to.

Sections 4 and 5 agreed to.

After section 5

Amendment 5, in my name, is in a group on its own.

In its stage 1 report, the Justice Committee recommended

“that the Scottish Government includes a complaint mechanism within the Bill, to enable the public to refer issues to the Scottish Biometrics Commissioner on the use of biometrics by Police Scotland and the SPA, or on their lack of compliance with the Code of Practice.”

That follows many witnesses, including Matthew Rice from the Open Rights Group, expressing concern that, despite it being one of the key functions of the commissioner to promote public awareness and understanding of the duties and responsibilities of those who acquire, retain, use and delete biometric data, there is no corresponding complaints mechanism whereby a member of the public could raise such concerns with the commissioner.

In his evidence, Detective Chief Superintendent Scott from Police Scotland acknowledged the importance of the public having the right to complain, and Tom Nelson from the SPA said that he thought that the commissioner would want to hear from the public and understand where their concerns were coming from; he also believed that the ability to engage with and speak to the public would allow the commissioner to provide assurance to the public and would ensure that the public and the commissioner could identify any challenges.

Amendment 5 seeks to ensure that the bill provides a complaints mechanism that affords individuals, or someone who acts on their behalf, the right to complain directly to the biometrics commissioner about the acquisition, retention, use or destruction of their data by or on behalf of Police Scotland or the Scottish Police Authority.

Furthermore, amendment 5 also takes cognisance of the concerns that were expressed by the cabinet secretary about the risk of duplicating the role of the UK Information Commissioner if the Scottish biometrics commissioner had a similar function of looking at complaints about the use of biometric data, which can be personal data, which is a reserved matter. The cabinet secretary considered that the relationship between the UK Information Commissioner and the biometrics commissioner should be addressed and said that he was supportive of the Justice Committee’s recommendation that there be a memorandum of understanding between the two commissioners to avoid potential confusion about the two roles and to protect the independence of both offices.

Amendment 5 addresses both those concerns by providing that the biometrics commissioner must consult the Scottish Public Services Ombudsman, Police Scotland and the SPA, as well as any persons or groups that the commissioner considers appropriate, on the commissioner’s proposals for a complaints procedure. The commissioner must keep that procedure under review and must vary it

“whenever, after such consultation, the Commissioner considers it appropriate to do so.”

Late last night, I received a letter on amendment 5 from the UK Information Commissioner’s Office; it was distributed to the committee first thing this morning, and the cabinet secretary’s officials have a copy. It helpfully points out that amendment 5 contains an error—the “Information Commissioner Act 2000”, to which it refers, does not exist. That can easily be rectified at stage 3. In the meantime, the error should not prohibit the passing of amendment 5 today, if the committee is so minded.

Helpfully, the UK ICO confirms that complaints about the way in which the personal data relating to an identified or identifiable person is handled should be referred to the UK ICO. However, biometric data relating to an identified or identifiable person is deemed to be special category data and subject to additional safeguards. If, therefore, the complaints process is confined to compliance with the code of practice, the UK Information Commissioner says that that should be clearly stated in the bill to avoid any ambiguity. The complaints process as laid out in amendment 5 is confined to compliance with the code of practice.

Finally, the cabinet secretary stresses that, in his view, the biometrics commissioner

“should concentrate on ... systemic issues in the criminal justice and policing context”,

with its

“oversight driven by a systematic review of Police Scotland and the SPA’s activities as these relate specifically to biometric data”,

rather than the resolution of individual complaints. However, that fails to recognise that it is only by being aware of and involved in resolving instances in which things have gone wrong that systemic improvements can be made and robust systemic oversight achieved. More than that, quite simply, as the Justice Committee and many others have pointed out, there is a risk to public confidence and transparency if a complaints mechanism is not included in the bill.

I move amendment 5.

Convener, you are aware that, had you not lodged amendment 5, I would have done so. I am therefore happy to lend it my support.

The public would imagine it to be passing strange if there was a public body that did not have a complaints mechanism attached to it. That is a fundamental principle for how the public should engage with public officials. I am very supportive of the proposal.

I am not going to support amendment 5. It is unnecessary. The public are already free to make complaints to the commissioner, so I do not think that we need another piece of law to give them permission to complain.

Amendment 5 technically only requires the commissioner to establish a procedure for people to make complaints but it does not require the commissioner to do anything with them. Such a requirement should not be in the bill, and the legislation should not oblige the commissioner to deal with complaints; the mechanism for people going to the commissioner with complaints already exists.

I agree with my colleague Rona Mackay. Also, I know, convener, that you have taken head-on the fact that the amendment is technically wrong, but it is significant that the UK ICO has taken the time to write to us. I do not think that we fully understand what the consequences of amendment 5 might be. I therefore agree with Rona Mackay and will not support the amendment today, but I politely suggest that speaking to the Government ahead of stage 3 and getting a factually correct amendment on the table might be the best way forward.

I welcome amendment 5. It deals with the issues that were raised in the committee’s stage 1 report. John Finnie made the point about public confidence and how the public might think that it is strange if there were no complaints mechanism in place for the work that the biometrics commissioner is undertaking. I support amendment 5.

I have serious reservations about amendment 5. Let me make a couple of points about it.

Convener, you referred to the letter that came in late last night from the Information Commissioner’s Office—I thank the parliamentary clerks for giving us sight of the letter as we were on our way in. As you said, it refers to the inaccurate reference to the 2000 act. However, the Information Commissioner’s Office’s more substantial point is this:

“I would bring the Committee’s attention to the evidence which I gave during its Stage 1 deliberations where I made reference to the role of the UK Information Commissioner’s Office regarding complaints about the way in which individuals’ personal information is handled. Any complaints about the way in which such data are handled should be referred to the ICO. This separation of locus has worked well south of the border where a Biometrics Commissioner has been in post since 2016.”

In addition, convener, you said that the scope of amendment 5 is confined to the code of practice, as the ICO would wish it to be, but I do not think that that is the case; nowhere in amendment 5 do the words “code of practice” appear.

Moreover, amendment 5 is not necessary. Individuals will be free to make complaints to the commissioner at any time. They do not need the law to give them permission to complain.

The bill does not oblige the commissioner to investigate complaints or set up a process to deal with them. However, if someone were to draw the commissioner’s attention to a relevant and important issue, by way of a complaint, the commissioner could use their powers to look into the matter, for example by requiring a body to produce information. That could lead to the publication of reports and recommendations or to the issuing of a compliance notice.

The commissioner’s function of dealing with complaints about the processing of biometric data, which can include personal data, closely parallels the functions of the Information Commissioner’s Office. Amendment 5, as drafted, does not delimit the role of the biometrics commissioner and would allow the commissioner to deal with complaints about breaches of data protection law that should properly be dealt with by the ICO.

Do you accept that all members in their constituency business and lots of organisations have the facility to signpost individuals if it would not be appropriate to deal with a complaint themselves? I am trying to imagine a website for the commissioner that did not provide for a complaints mechanism. Every other public body has such a mechanism. You must acknowledge that not to have one is passing strange.

People will be able to make a complaint about the commissioner himself or herself in the context of the role that they will fulfil. We should make that obvious.

On your point about signposting, I think that the recommendation of a memorandum of understanding between the ICO and the commissioner is the right way to go. I think that I made that point in the debate. In my capacity as a constituency MSP, I often signpost people. I share an office with the local MP and, if a matter comes to me that I cannot deal with—for example, if the Home Office will not engage with me on an immigration matter—I can signpost the constituent to the local MP. The system works perfectly well. There is, in effect, a verbal MOU between me and the local MP.

I do not want to sound facetious, but you will understand that the public do not go about wondering whether there are memoranda of understanding between different public bodies. The word “complaint” is readily understood, and a complaint should be responded to.

I was trying to make the point that, just as a constituent should be free to come to any elected member on any issue, and that member might choose to refer the case to another body—I used the analogy of an immigration case that is referred to an MP, because the Home Office does not deal with MSPs regularly—nothing will stop a member of the public going to the biometrics commissioner to make a complaint and, perhaps through the proposed MOU, being signposted to the Information Commissioner’s Office.

Setting up a separate complaints mechanism for the biometrics commissioner would create confusion for the public. It would also cut across the clear remedy that already exists, which is that members of the public may make a complaint to the Information Commissioner’s Office in respect of the processing of personal data. I have concerns about our straying into reserved matters in that regard. In any event, it is better to maintain the delineation between the roles, whereby the ICO fully investigates complaints from the public and the new biometrics commissioner will undertake a monitoring role and make thematic reports.

To complement that, I reiterate that there is support for a memorandum of understanding to be drawn up between the biometrics commissioner and the ICO so that there would be a common understanding of their roles. That could be communicated to the public, but it would also be important for the internal purposes of the two commissioners. I understand that the ICO is very receptive to that idea.

11:45  

My final point is on a number of technical issues with amendment 5. We have already discussed its reference to a non-existent act. In addition, as it is drafted, the amendment requires the commissioner only to “establish a procedure” for people to make complaints but not to do anything with them. It also does not take account of the fact that the bodies that are listed in section 2 might change.

For all those reasons, I ask Margaret Mitchell not to press amendment 5.

The technical error is a minor defect. It is not unusual for the Parliament to agree to an amendment at stage 2 and to pick up on technical errors at stage 3. It is the thrust of what we want to achieve that is so fundamentally important.

As for the code of practice not being mentioned specifically, the effect of amendment 5 would be to ensure that compliance with the code of practice would be achieved. As the ICO said, that should be stated in the bill.

I am somewhat surprised by members’ comments—especially Rona Mackay’s—on amendment 5. It was the committee’s unanimous recommendation that the Scottish Government should include in the bill provision for a complaints mechanism to enable the public to refer to the Scottish biometrics commissioner issues with the use of biometrics by Police Scotland and the SPA, or about their lack of compliance with the code of practice. For members to say at this stage that they are totally opposed to that I find puzzling. Behind its recommendation lay the committee’s concern that there would be risks to public confidence and to transparency if provision for a complaints mechanism were not included in the bill. That view was shared by the Law Society of Scotland, which agreed that a complaints mechanism should be included to enable the public to refer issues to the Scottish commissioner on the use of biometrics where there is a lack of compliance with the code of practice.

The cabinet secretary is absolutely right to say that systemic oversight should be robust—that is essential. The power to look at people’s personal biometric data is a very important one, and they should have the right to complain if they believe that there has been a breach of the code. That is what amendment 5 seeks to establish.

On that basis, I press amendment 5.

The question is, that amendment 5 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 5 agreed to.

Amendment 19, in the name of Liam McArthur, is in a group on its own.

As we heard in relation to an earlier grouping, throughout stage 1 there was a lot of debate on whether the bill’s reach went far enough in setting out the commissioner’s remit. It was accepted that, although the use of biometrics in policing requires robust regulation, it is a technology whose reach already extends far more widely. We therefore need to ensure that the regulatory framework and oversight powers meet public expectations.

Given how long it has taken to bring the bill before the Parliament—my former colleague Alison McInnes raised concerns in this area in the previous parliamentary session—it is fair to say that we are still playing catch-up. I suppose that the question is whether we should opt for a phased approach, starting with Police Scotland and a limited range of other bodies that are involved in the delivery of policing in this country, or seek to empower the Scottish biometrics commissioner to take the broadest possible view of the use of such technology. We explored some of those issues in discussing that earlier grouping, and it is clear where the committee currently stands on them. However, given that both the pace of the technology and the ways in which it is being used are changing, it will always be a challenge to ensure that legislation on the subject remains fit for purpose.

Amendment 19 would establish a process for review, which would help to fine-tune the commissioner’s remit as it is currently proposed and leave open the door for expanding its scope in the future, as might be appropriate based on our experience of it in practice.

In their evidence, Amnesty International, the Open Rights Group and the Scottish Human Rights Commission raised their concerns about the proposed scope of the commissioner’s remit. As I said earlier, I have a great deal of sympathy with those concerns. At the same time, there are risks in overstretching the commissioner in the early stages. Establishing the commissioner’s role and function will take time, and it is crucial that the commissioner can demonstrate effectiveness in carrying out his or her duties.

I know from my correspondence with the cabinet secretary that he intends to keep the commissioner’s remit under review. Although I welcome that commitment, it is perhaps a little vague and vulnerable to not surviving his departure from his current role. In that sense, amendment 19 seeks to add a little bit more certainty around that intention.

I look forward to hearing comments from colleagues including the cabinet secretary.

I move amendment 19.

I support my colleague Liam McArthur’s amendment 19. An argument can be made that we can review anything at any time, but making that specific request of ministers will give the review an appropriate profile, given the speed with which technology changes and with which we might have to respond to some of the implications of the proliferation of public surveillance. I am very supportive of amendment 19.

I have concerns about laying down a timeframe. It is one thing to have a commitment to post-legislative review, which is always good, but requiring that the commissioner’s powers and functions be reviewed

“3 years after the day of Royal Assent”

and at five-yearly intervals thereafter might get in the way of a natural timeframe for review. Why should we set those timeframes, which might not make sense when things are up and running? Those timeframes seem very fixed and inflexible. Would it not be better that, instead of fixed timeframes being set out, review would be based on what made sense at the time and be led by the commissioner’s view of what progress had been made?

I agree with that point. Although I see where Liam McArthur is coming from, I will not support amendment 19. We have included in the bill provisions for post-legislative scrutiny. I think that we sometimes try to predict what a future Parliament with different members will think about legislation or to mandate what it should do. I hear what John Finnie says about the other side of the argument and about it being our job to look at what might be needed in the future, but I come down on the other side of the argument, so I will not support amendment 19.

It seems to me that amendment 19 would strengthen parliamentary scrutiny, which would be a very good thing. In my opinion, it does not seem unreasonable that, after 12 months, we should look at how this important but potentially intrusive legislation is working.

I will stick to remarks on amendment 19 rather than comment on Liam McArthur’s prediction of my political demise.

Although I understand and have a great deal of sympathy with the reasons for his lodging amendment 19, I have some concerns, as Liam McArthur might understand. Those concerns have been articulated well by Shona Robison and Fulton MacGregor. I reiterate that a means of review already exists. Provisions for post-legislative scrutiny do not need to be hardwired into an act. The Parliament or the Government can conduct a review whenever it wishes and at a time that is most appropriate. That is surely preferable to a requirement to conduct a review at a time that is selected in advance and that might not work well because of the load of other things that might be going on at that pre-selected time.

The committee will be aware that the bill already provides for a lot of on-going accountability and reporting to Parliament through strategic plans, budgets, annual reports, other reports and recommendations, and so on. There will also be parliamentary approval of the code of practice and any revisions to it. All of those processes can be triggers for ministers or Parliament carrying out post-legislative scrutiny at any time. That would allow a review to be conducted when we know that there is an issue to be examined, instead of our being required to do it at a particular time even if everybody is content.

On reviewing the scope of the commissioner’s oversight, ministers have already taken powers allowing the list of bodies over which the commissioner has oversight to be added to by means of regulations. Ministers will therefore keep under review whether it is appropriate to exercise those powers.

What the amendment proposes is somewhat unusual compared to other examples of compulsory post-legislative scrutiny in that it would set up a recurring rather than a one-off duty. I question whether it is appropriate to commit time and resource to almost never-ending reviews when everyone might be content that the commissioner’s functions are working perfectly well. Those compulsory recurring reviews might end up draining away resources from other issues that the Parliament and Government agree ought to be a higher priority at the time.

Although post-legislative scrutiny is important and I believe that Liam McArthur’s amendment is well intentioned, I suggest that hardwiring scrutiny arrangements into the bill is unnecessary and unhelpful, so I ask him not to press amendment 19. As always, if he does so, I offer to work with Liam McArthur in advance of stage 3, if necessary.

I thank all members who have contributed to the debate for the spirit in which they have offered their remarks. In particular, I thank John Finnie and the convener for their express support for amendment 19. John Finnie suggested that it would raise the profile of something that one might expect to happen, but it is no less important or relevant for that.

I listened carefully to what Shona Robison and Fulton MacGregor suggested, and I understand the anxieties about what appears to be a rigid timeframe. That, in a sense, sets the minimum requirements—it would be a process in which the triggers would be up front and obvious. However, if circumstances were such that an additional review was required because of revelations that gave rise to public concern, nothing in amendment 19 would prevent that from happening.

The cabinet secretary rightly pointed out that it is open to the Government and, indeed, Parliament to carry out post-legislative scrutiny. We have had that power from the get-go, but it has been used in exceptional circumstances rather than routinely.

On the recurring nature of the duty, I understand the anxiety that we might get locked into a process that, over time, becomes less relevant. However, given the nature of the technology involved—we have all talked about the speed at which it is changing—it is unlikely that the need to keep the issue constantly under review will diminish in any way in the foreseeable future. Therefore, notwithstanding that the Government might want to work with me ahead of stage 3 to make further refinements, I am minded to press my amendment.

The question is, that amendment 19 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 19 agreed to.

Section 6—Code of practice

Amendment 20, in the name of the cabinet secretary, is grouped with amendments 35, 21 and 36.

My amendment 20 is intended to make a clear link between the principle that is set out in the commissioner’s general functions under section 2(1) and the content of the code of practice. The committee asked me to do that in its stage 1 report, and I am happy to oblige.

The commissioner’s general function is

“to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data for criminal justice and police purposes”.

Anything that the commissioner does, including preparing the code of practice, should be in furtherance of that general function. Amendment 20 therefore makes it clear that the commissioner must prepare a code that is designed

“to support and promote the adoption of lawful, effective and ethical practices in relation to the acquisition, retention, use and destruction of biometric data”.

Amendments 35 and 36 require the commissioner to have regard to specific principles when preparing or revising the code of practice, including the principles of promoting and protecting human rights, privacy and public confidence, as well as the principle of ensuring individual and community safety. I consider the amendments to provide a reasonable balance between specifying what the code should include and preserving the independence of the commissioner to decide what the code should cover.

12:00  

Although I do not think that amendments 35 and 36 are strictly necessary, I am happy to support their general principles if Liam Kerr wishes to proceed with them, despite the comfort that is already offered by amendment 20. I would, however, note some technical concerns, particularly about aspects of amendment 36. For example, the reference to revising a code in amendment 36 is confusing because there is already a default rule in section 6(5) that sets out which sections also apply to revised codes. It would therefore be clearer to apply the general rule to the new section that is proposed by Liam Kerr.

Some of the other language in the amendments will require further consideration. For example, the reference to the principle of ensuring the safety of individuals and communities could be considered to be problematic because that is not something that the commissioner can ensure, although they can recognise the importance of it.

I therefore ask Liam Kerr not to move amendments 35 and 36 at this time. If he wishes to proceed with them, I will be happy to work with him to agree suitable amendments to the technical aspects ahead of stage 3.

Amendment 21 requires the code of practice to include a presumption of destruction of biometric data three years after it was acquired. I fully recognise the member’s concerns that a clear direction should be given by the commissioner regarding retention periods. I do, however, have strong concerns about amendment 21.

If amendment 21 was supported, it would require a change in policy and procedure that is not entirely aligned with the law as set out under the Criminal Procedure (Scotland) Act 1995. A presumption of destruction of data after the expiry of three years, as is suggested in the amendment, does not fully take account of the provisions in the 1995 act, which, in some cases, allow biometric data to be retained for up to two years only. The 1995 act also allows retention periods to be extended by a sheriff in some cases, and it is not clear how the proposed presumption would fit with that power.

It should be noted that the police are already bound by the European Convention on Human Rights and data protection laws regarding retention periods for biometric data. I have previously committed to conducting a review of the retention periods that are set out in the 1995 act once the commissioner is in post. If retention periods are to be set, it would make more sense for the commissioner to consult on them and set them within the code of practice, given that the code will be subject to the consideration and approval of Parliament. That would mean that retention periods would benefit from the flexibility of being set out in the code, and Parliament would be able to approve retention periods when it approved the commencement of the code of practice. It would also mean that the period could be changed to reflect changing circumstances.

However, if amendment 21 was supported, the presumption could not be adjusted to opt for either a longer or a shorter period. Even if the code set rules about retention periods, it would have to be done in a way that was clear and did not appear to contradict existing law. I therefore ask Liam McArthur not to move amendment 21.

I move amendment 20.

Liam McArthur will speak to amendment 21 and other amendments in the group—[Interruption.]

I am sorry; I have taken the Liams out of order. Liam Kerr will speak to amendment 35 and other amendments in the group.

I am happy to support amendment 20. I am glad that you brought me in first, convener, because I will be interested to hear Mr McArthur’s response to the cabinet secretary’s points on amendment 21.

Amendment 35 simply inserts a reference to the relevant section; that will be required if the committee is with me on amendment 36.

Amendment 36, which is the substantive point, picks up the committee’s recommendation at paragraph 206 of the stage 1 report, which says that

“the principles underpinning the Commissioner’s role and the purpose of the Code of Practice in promoting and protecting”

various items, and the

“principle of delivering community safety”

should be included in the bill. Amendment 36 simply seeks to codify those principles, to which the commissioner must have regard when preparing or revising a code.

I am grateful to the cabinet secretary for his comments. He said that the reference to revision is confusing and that further technical amendments will require consideration at some point. My preference is to move amendment 36, after which I would be pleased to work with the cabinet secretary to amend it to the optimum level at stage 3.

I would be pleased to have the committee’s support for amendments 35 and 36.

Are there any questions? [Interruption.] Sorry—I seem to be determined to get Liam McArthur in first or to miss him out completely.

I invite Liam McArthur to speak to amendment 21 and other amendments in the group.

I did not realise that the earlier invitation was a once-only opportunity.

I welcome and am supportive in principle of the other amendments in the group, even though the cabinet secretary has expressed one or two misgivings with amendments 35 and 36 that will need to be addressed.

On amendment 21, I heard what the cabinet secretary said, which—to paraphrase—fell into the category of inconsistency and rigidity. Amendment 21 was lodged principally to align the rules around the retention of biometric data. At the moment there is a disparity between the regulation on DNA and fingerprints and that on photos that are held by the police: DNA and fingerprints are regulated under the 1995 act but, as the cabinet secretary acknowledged, photos are not.

The issue was recognised by my colleague Alison McInnes during the passage of the Criminal Justice (Scotland) Act 2016 five years ago. Since then, both HMICS and the independent advisory group have found governance gaps that are a concern. John Scott QC recommended in his review:

“There should be a presumption of deletion of biometric data after the expiry of prescribed minimum retention periods.”

Although Police Scotland has since updated its policy, there is still no legislative requirement for images to be deleted. In recent evidence to the Justice Sub-Committee on Policing, Temporary Assistant Chief Constable Duncan Sloan confirmed that the current rules around what the police can do with images of the public are “not so clear” as the rules around fingerprints and DNA and that new governance arrangements

“would be valued and welcomed.”—[Official Report, Justice Sub-Committee on Policing, 16 January 2020; c 5.]

Similarly, Detective Chief Superintendent Sean Scott of Police Scotland supported the IAG recommendation of

“a presumption of deletion of biometric data”

as the central part of the oversight system that was established by the 2016 act. He stated:

“one of the IAG’s nine recommendations was about the retention periods and a presumption of deletion, and that is absolutely right.”—[Official Report, Justice Committee, 29 October 2019; c 13.]

Research by the Scottish Liberal Democrats revealed at the weekend that more than 375,000 images have been supplied to the police national database from Police Scotland’s criminal history system since 2014, all with no clear legal requirement for their deletion should the individuals concerned be found to be innocent.

Facial recognition may be invaluable for modernising the way in which the police investigate crime but, unregulated, the system poses a potential threat to human rights and civil liberties and, as we have repeatedly heard from Police Scotland, to the reputation of our police.

Amendment 21 refers to a period of three years. Where does that figure come from?

The three years are required to bring governance arrangements on images in line with those for DNA and fingerprints and to deliver a degree of consistency across the retention periods for biometrics.

Given that you referred in your opening remarks to an existing disparity, surely consultation on the issue would be required to get the retention periods right? Would it not be better for the commissioner to undertake such a consultation, rather than us deciding now that three years is the right answer? Such a decision would be based on current practice rather than on a consultation on what would be ideal, which would be based on evidence from the stakeholders who deal with the issues at the coalface.

I take the point about consistency. However, I do not think that we have heard any concerns about the current retention periods, so having consistency with them would not seem to be an unreasonable proposition. If, in due course, there is a belief that the retention periods are out of alignment with public expectations on the use of the technology, it will certainly be open to the commissioner to look at that. However, with the bill that we are considering, there is an opportunity to bring a degree of consistency to retention policy. As we have heard, not least from Police Scotland, that is desirable and it would be welcome as it would provide clarity.

I am happy to support the cabinet secretary’s amendment 20.

The intent of Liam Kerr’s amendment 36 is quite clear. The wording could be improved—that could be looked at at stage 3—but if the committee is minded to agree to the amendment, there is no reason for it not to do so. Agreement to the amendment would send a clear message about the importance of human rights and so on being in the bill.

I turn to Liam McArthur’s amendment 21. If I understand him correctly, the retention period for DNA and fingerprint information is three years, but it might differ for other things. The important point is that there would be a presumption that the information would be destroyed after three years. If there is a good reason for information to be retained after that, that will be clear and the reason will be set out transparently. In relation to human rights and making sure that there are no abuses, that seems to be a sensible way to go.

I ask the cabinet secretary to wind up.

I reiterate my offer to Liam Kerr in relation to amendments 35 and 36. My preference is for him not to move the amendments and to work with the Government on the matter before stage 3. However, if he moves them and the committee agrees to them, the offer will remain.

When Liam McArthur responded to Liam Kerr’s intervention, he said that what he proposes would create an alignment with DNA. However, in some cases—for example, in relation to road traffic offences—the retention period for DNA is two years and not three years, so there would not be an exact alignment under Liam McArthur’s amendment. Also, I do not think that he addressed the fact that in certain cases—this is particularly pertinent to sexual offences—a sheriff may choose to extend the retention period for the purpose of advancing justice.

Will the cabinet secretary take an intervention?

Of course.

I think that the convener picked up on the point that we are talking about a presumption in relation to the retention periods. I do not think that there would be any expectation that that would override legitimate concerns where there was a sound case for retaining images, as happens with DNA and fingerprints.

I take your point about it being a presumption and not a flat-out, explicit, fixed retention period. I suppose my concern about the proposal is that there is no doubt that the code of practice, without impinging on the independence of the commissioner, will look at things such as retention periods. That is why I believe that it is preferable to have the flexibility that will be afforded by a code of practice being introduced through regulations, as opposed to having something included in the bill.

Liam McArthur mentioned in his remarks on a previous amendment the fast-paced, quickly evolving nature of the technologies that we are discussing. None of us, probably, could predict what the data will look like in five, 10 or 15 years’ time, let alone what it will look like in 20 years’ time. The approach of having retention periods in the bill would create an inflexibility and rigidity that will not be created if they are in the code of practice. I reiterate my concerns about including retention periods in the bill, and I ask Liam McArthur not to move amendment 21.

Amendment 20 agreed to.

Amendment 35 moved—[Liam Kerr].

The question is, that amendment 35 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 35 agreed to.

12:15  

Amendment 21 moved—[Liam McArthur].

The question is, that amendment 21 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 21 agreed to.

Amendment 22, in the name of the cabinet secretary, is grouped with amendments 23 and 25 to 29.

Taken together, the amendments in this group seek to provide enhanced arrangements for Parliament to scrutinise the first code of practice that the commissioner produces. To accommodate the new step in the process, it has been necessary to restructure section 6 and to amend sections 8 and 9 but, ultimately, this set of amendments responds positively to a recommendation that the committee made in its stage 1 report, which sought more time for Parliament to scrutinise the content of the first code of practice and a process that would allow it to do so separately from its scrutiny of the regulations to bring the code into effect.

Amendment 26, which is the principal amendment in the group, seeks to insert a new section that provides for a further process on the first code of practice. Having gained ministers’ approval for a draft of the code, the commissioner must lay it before Parliament for its consideration, and they must have regard to any representations that are made to them within 60 days of the draft being laid. Representations can be made to the commissioner by anyone, including members of the Scottish Parliament and members of the public. In calculating the 60-day period, no account will be taken of instances when Parliament is in recess for more than four days or when it has been dissolved.

The proposed procedural step, which will apply in relation to the first code, is in addition to the existing requirement that any code can be brought into effect only by the Parliament approving affirmative regulations under section 9. That is always the final step in the process.

The other amendments in the group are consequential. Amendments 22 and 27 simply adjust the location of some provisions to allow sections 6 to 9 to set out the enhanced process in chronological order. Amendments 23, 25 and 28 adjust cross-references and text in the light of the restructuring, and amendment 29 simply ensures that reporting on the code of practice will start running from the date of the first code.

I hope that the committee will recognise that this group of amendments fulfils its wish for additional time and procedure to consider the first code of practice carefully. I make it clear that later iterations of the code would not be sent to Parliament for 60 days; rather, they would follow only the second part of the parliamentary approval process. However, that is in line with the committee’s recommendation, and it would still ensure that later iterations of the code would be approved by regulations under the affirmative procedure.

The important point here is that the commissioner will draft the code in consultation with stakeholders. After the code has been approved by the Scottish ministers, the final step is that it will be considered by Parliament, which will decide whether and when to bring it into effect. That way, we will have a code that has achieved broad consensus. In the case of the first code, there will now be the added guarantee of an additional period for parliamentary scrutiny, which will be separate from the scrutiny of the regulations to bring the code into effect.

I move amendment 22.

Amendment 22 agreed to.

Amendment 23 moved—[Humza Yousaf]—and agreed to.

Section 6, as amended, agreed to.

After section 6

Amendment 36 moved—[Liam Kerr].

The question is, that amendment 36 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 36 agreed to.

Section 7—Effect of the code

Amendment 6, in the name of John Finnie, is grouped with amendments 8, 37, 9, 12 and 38 to 42.

Amendment 6 deals with a subject that exercised the committee during the scrutiny that led to our stage 1 report. It seeks to replace the term “have regard to” with a requirement to “comply with” the code of practice.

People might find it a little strange that we have such a proposed law in front of us. In section 7(3), which is covered by my amendment 8, the bill says:

“Failure to have regard to the code of practice does not of itself give rise to grounds for any legal action.”

The legislation that we put in place needs to be robust, and those at whom it is targeted need to have due regard to it. I do not doubt the willingness of Police Scotland, as it is currently configured, to follow it, but I cannot see a difficulty with what I propose. We put in place professional oversight of important pieces of legislation that have significant impact on citizens’ human rights, and it is only right for those who make judgments to “comply with” what is in the code of practice, rather than just to “have regard to” it. That sums up amendments 6 and 8.

On the cabinet secretary’s amendment 41, I note that allowing revocation of compliance at any time would seem to fly in the face of what we should be doing, so I will not support it. I hope that members will support my amendment 6.

I move amendment 6.

I support John Finnie’s amendments 6, 9 and 12, which seek to replace the words “have regard to” with the words “comply with” in connection with how the code of practice is to be observed. Those amendments complement my amendments in the group, and I ask members to support them as well as mine.

My amendments 38 to 42, taken together, will enhance the commissioner’s power to deal with failures to comply with the code of practice. In lodging the amendments, I have been mindful of the committee’s desire to see stronger enforcement in the bill. That was a common theme—it was almost a constant theme—in the stage 1 debate, and I said at that time that I would reflect carefully on what had been said on the issue by John Finnie and almost every other member who spoke. I believe that the new provisions that I propose represent the best means of ensuring compliance with the code.

Amendment 38, which strengthens the commissioner’s powers, operates in conjunction with John Finnie’s amendment 6. Amendment 38 will enable the commissioner to issue a compliance notice to a person whom they consider has failed or is failing to comply with the code of practice. That could be done instead of or as well as reporting on such a failure under the existing powers in the bill for the commissioner to name and shame.

Amendment 39 specifies the content of a compliance notice, stating that it must include matters such as the steps that must be taken to address the breach of the code and the timescales for doing so.

Amendment 40 will allow the commissioner to vary a compliance notice in order to allow more time for compliance or, with the consent of the person to whom the notice was issued, to change the steps that are required to be taken.

Amendment 41 will allow the commissioner to revoke a compliance notice. To respond to the concern that John Finnie expressed, I note that it is about the commissioner having flexibility. It could not be done unilaterally by anyone else.

Amendment 42 will allow the commissioner to report to the Court of Session a refusal or a failure without reasonable excuse to comply with a compliance notice. It will allow the court, after hearing evidence or representations on the matter, to make an order to enforce a compliance notice, or to deal with the refusal or failure to comply with the notice as if it was contempt of court—an issue that I note the committee will come to later. As the committee may recall, the court may also do both of those things in relation to a failure or refusal to comply with an information notice under section 12.

On compliance with the code of practice, my view is that the commissioner’s existing powers to make recommendations and to follow up by reporting to Parliament on those matters are sufficient for all but the most extreme cases. I therefore hope that the additional powers that are set out in my amendments will be used rarely, if ever. However, I recognise the committee’s concerns and I wanted to provide reassurance that further enforcement action can be taken.

Amendment 37 changes section 7(3) as a consequence of amendment 6, such that all references are to complying with the code of practice. If amendment 37 is agreed to, section 7(3) will state:

“Failure to comply with the code of practice does not of itself give rise to grounds for any legal action.”

John Finnie’s amendment 8 seeks to remove section 7(3). I wish it to remain because, when read with section 7(2), it will make it clear that, although a court or tribunal

“must take the code of practice into account when determining any question to which the code is relevant”,

a failure to comply with the code will not in itself give rise to grounds for legal action. Section 7(3) is there as part of a package with section 7(2).

It is common for acts to expressly provide, for the avoidance of any doubt, that breach of a code does not in itself give rise to criminal or civil liability. Indeed, the committee approved that in relation to the stop and search code under the Criminal Justice (Scotland) Act 2016.

With regard to my amendment 8, is it your view that, on a stark reading of subsection 7(3),

“Failure to have regard to the code of practice”

could give rise to legal proceedings?

I refer to the points that I have made. Amendment 8 would remove the certainty without providing for an accessible remedy to apply. As I said, it is not uncommon for the approach to be stated expressly in acts, so there is precedent for it. To be clear, I note that, under the new compliance notice that I propose, a failure to comply with the code will not in itself give rise to civil or criminal proceedings. Instead, as I think John Finnie is aware, it will give rise to a compliance notice. If that is not complied with, it will potentially give rise to legal action in the form that I set out in amendment 42. I hope that that gives John Finnie some reassurance that there is explicit provision for an accessible civil remedy.

I appreciate that John Finnie wants the code to be complied with and to ensure that there can be a consequence for non-compliance. I agree with him on that, but I suggest that my amendments on compliance notices provide for it more effectively. I therefore ask him not to move amendment 8 and to support my amendment 37 instead.

There was considerable debate at stage 1 about the “have regard to” provision, and I note that John Finnie has come up with the new wording “comply with”. On the basis that both the cabinet secretary’s amendment 37 and John Finnie’s amendment 6 will strengthen adherence to the code, I think that they are both worth supporting.

I ask John Finnie to wind up and press or withdraw amendment 6.

It is important that due regard is given to the legislation, given the energy that has gone in to compiling it. I hope that members will support my amendment 6, and I press it.

Amendment 6 agreed to.

Amendment 24 moved—[Humza Yousaf]—and agreed to.

Amendment 7 not moved.

Amendment 8 moved—[John Finnie].

The question is, that amendment 8 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kerr, Liam (North East Scotland) (Con)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 2, Against 7, Abstentions 0.

Amendment 8 disagreed to.

Amendment 37 moved—[Humza Yousaf]—and agreed to.

Section 7, as amended, agreed to.

Section 8—Consultation on the code

Amendment 25 moved—[Humza Yousaf].

12:30  

The question is, that amendment 25 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 25 agreed to.

Section 8, as amended, agreed to.

After section 8

Amendment 26 moved—[Humza Yousaf].

The question is, that amendment 26 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 26 agreed to.

Amendment 27 moved—[Humza Yousaf].

The question is, that amendment 27 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 27 agreed to.

Section 9—Bringing the code into effect

Amendment 28 moved—[Humza Yousaf].

The question is, that amendment 28 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
Kelly, James (Glasgow) (Lab)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
McArthur, Liam (Orkney Islands) (LD)
Robison, Shona (Dundee City East) (SNP)

Against

Kerr, Liam (North East Scotland) (Con)
Mitchell, Margaret (Central Scotland) (Con)

The result of the division is: For 7, Against 2, Abstentions 0.

Amendment 28 agreed to.

Section 9, as amended, agreed to.

Section 10—Report on the code of practice

Amendment 29 moved—[Humza Yousaf]—and agreed to.

Section 10, as amended, agreed to.

Section 11—Power to gather information

Amendment 9 moved—[John Finnie]—and agreed to.

Section 11, as amended, agreed to.

Section 12—Failure to comply with an information notice

Amendment 10, in the name of John Finnie, is grouped with amendments 11, 1 and 2.

Legislation can sometimes be a mystery. I have found section 12(2) confusing. It says:

“The Commissioner may also report the matter to the Court of Session where the Commissioner considers that a person who is mentioned ... is likely to do any of the things”.

That seems to me to be a peculiar way of dealing with matters. For that reason, I seek to remove the provision.

I move amendment 10.

My amendments 1 and 2 relate to section 12. In the stage 1 debate, I raised with the cabinet secretary the possibility of someone being held in contempt of court for failing to comply with an information notice issued by the commissioner. The cabinet secretary kindly wrote to me following the debate in response to the issues that I raised, for which I thank him, so I will not go into my amendments in much detail.

The cabinet secretary has said that there have been a number of similar, if not identical, provisions in acts in the past 20 years. However, the provision in the bill seems to be somewhat draconian, because it relates to a failure to follow through not on a court order, but on an information notice from the commissioner. Even if there are similar provisions in other acts, that is not necessarily the appropriate way to deal with it, because contempt of court is a serious matter. If someone is in breach of an order of a court, one knows what one is dealing with, but if they are just in breach of an information notice from the commissioner, I am not sure that that falls into the same category.

I am interested to know why the cabinet secretary feels that that is the appropriate way to deal with the enforcement of those provisions of the bill and to ensure that they are complied with. I still do not see that it is appropriate to have contempt of court provisions in the bill, and that is why I lodged amendments 1 and 2.

I will address John Finnie’s amendments 10 and 11 before turning to Gordon Lindhurst’s amendments 1 and 2. I recognise that amendments 10 and 11 arise from concerns that were raised in the stage 1 debate regarding how the commissioner could use the power in section 12 to refer matters to the court based simply on their consideration of what a person was likely to do, as John Finnie mentioned in his remarks.

However, the power in section 12(2) is important, particularly in relation to section 12(1)(c). For example, if the commissioner had reason to believe that a person was going to destroy important information, they could use the power in section 12(2) to apply to the Court of Session for an order to prevent that. If the commissioner had to wait until it had happened before they could go to the court, it would be too late. If an application is made to the court, it will hear evidence on the matter and it will need to be convinced that it is appropriate to take action, so it will not be just about what the commissioner believes.

It should also be noted that the power has precedent. Schedule 2 of the Scottish Commission for Human Rights Act 2006 provides the Scottish Human Rights Commission with the same ability to refer a matter to the court for consideration where it considers that it is likely that its equivalent information notices will be breached. I hope that members are reassured by my explanation of why the provision is included in the bill, and I ask John Finnie not to—

Will the cabinet secretary take an intervention before he concludes?

I will.

The cabinet secretary rightly mentioned section 12(1)(c), which includes the wording

“alters, suppresses, conceals or destroys, without reasonable excuse”.

Those are clearly serious matters, and that shows the importance of the legislation, so I welcome the cabinet secretary’s explanation. It is important to get on the record the seriousness of the issues that could give rise to use of the power. That is why I am pleased that we have agreed that people will have to “comply with” the code, rather than just “have regard to” it.

I thank John Finnie for his remarks and the work that he has done in relation to strengthening the provision so that the code of practice must be complied with, as opposed to people having regard to it. Given everything that I have said, I hope that he will not press amendment 10 and not move amendment 11.

I turn to Gordon Lindhurst’s amendments 1 and 2. I acknowledge the concerns that he has raised. I reflected carefully on and discussed with my officials the issue of holding someone in contempt of court. As Gordon Lindhurst mentioned, I wrote to him—as well as to Liam Kerr, who also raised concerns about the matter—on 21 January to offer further clarification. I recognise that the amendments have been lodged despite my reassurances, and I know that Gordon Lindhurst is still seeking some reassurance about what he considers to be a heavy-handed approach, so I will try to provide that.

The first thing to say is that it will be for the court alone, after hearing any evidence or representations on the matter, to find someone to be in contempt for failing or refusing to provide information. There is no suggestion that it would be for the commissioner to find someone to be in contempt of court. It is envisaged that a person would be found to be in contempt of court only where there had been an egregious failure to provide information to the commissioner—it would happen only in cases of really serious breaches.

Contempt of court is an important sanction in relation to situations where someone has already destroyed information that they were required to produce. Perhaps this point will answer Gordon Lindhurst’s question directly. In cases in which someone has destroyed such information, it is extremely unlikely that the court would grant an order for the production of that information, because it would know that the information had already been destroyed. How could the person produce it? The court therefore needs to have some form of sanction available to it, or people would potentially be able to destroy information with impunity.

Is the cabinet secretary saying that it would only be in cases where the court had issued an order in relation to an information notice that the sanction of contempt of court could be used, or could it be used where the commissioner had issued a notice but the court had not issued an order in relation to that?

It would happen on the back of the issuing of a compliance notice by the commissioner, rather than by the court. It would then be for the court to determine, after hearing representations and evidence, whether the person was in contempt of court.

As I said in my letter to Gordon Lindhurst, the proposed sanction is not unusual. It is a power that the court would be trusted to use responsibly, and it is one for which there is precedent. Such powers exist under the Scottish Commission for Human Rights Act 2006 and the Freedom of Information (Scotland) Act 2002. In those cases, the court has the power to deal with the matter as contempt. The court is in a similar position in relation to obstruction of the Scottish Public Services Ombudsman under section 14 of the Scottish Public Services Ombudsman Act 2002.

I hope that Gordon Lindhurst is reassured by my explanation of why such a provision is included in the bill, and I ask him not to move amendments 1 and 2.

The discussions that we have had this morning have been helpful. We have strengthened the bill, particularly with regard to the requirement to comply and the status that has been afforded to that. I thank the cabinet secretary for his helpful comments on my amendment 10, in the light of which I do not wish to press it.

Amendment 10, by agreement, withdrawn.

Amendment 11 not moved.

Amendments 1 and 2 not moved.

Section 12 agreed to.

Sections 13 and 14 agreed to.

Section 15—Reports and recommendations

Amendment 30 not moved.

Amendment 12 moved—[John Finnie]—and agreed to.

Amendment 13 not moved.

Section 15, as amended, agreed to.

Sections 16 and 17 agreed to.

After section 17

Amendments 38 to 42 moved—[Humza Yousaf]—and agreed to.

Sections 18 to 22 agreed to.

After section 22

Amendment 31, in the name of Liam McArthur, is in a group on its own.

I am conscious of time, so I will try to be as brief as possible.

The independent advisory group recommended that an ethics advisory group be established as part of the oversight arrangements. The remit of the group would be to work with the commissioner and others to promote ethical considerations in acquisition, retention, use and disposal of biometric technologies and biometric data.

The Scottish Government accepted that recommendation and committed to developing proposals for its remit and membership in discussions with stakeholders, drawing on the connections and relationships that have been developed through the work of the IAG.

However, the bill does not provide for that. The Scottish Human Rights Commission said that that is “regrettable” and that

“the IAG report rationalised the need for such a group quite clearly. They drew on evidence of the success of the Biometrics and Forensic Group in England and Wales”.

The cabinet secretary has said that he will form an independently chaired reference group to deal with ethical issues, which

“will be established at around the same time that the new biometrics commissioner”—[Official Report, Justice Committee, 16 November 2019; c 16.]

takes office. That is welcome, as far as it goes, but the centrality of questions about ethics to ensuring public confidence in the framework and the oversight arrangements that we are putting in place demands the establishment of an ethics advisory group on a statutory footing—as is proposed in my amendment 31, the debate on which I look forward to.

I move amendment 31.

12:45  

I warmly welcome amendment 31. As Liam McArthur said, an ethics advisory group was the independent advisory group’s recommendation. I agree with the Scottish Human Rights Commission that it is, for a number of reasons, “regrettable” that that recommendation has not been taken up. This is an opportunity to understand the role that bodies such as the commissioner play in how the police might go about deployment of, for example, digital triage devices—so-called cyberkiosks. Such a group would be a good and inclusive way of ensuring that a broad range of views would be taken on board. I strongly support amendment 31.

I have some sympathy with amendment 31. It is probably fair to say that everybody on the committee would want the same outcome. However, I will not support the amendment because I am not sure, at this stage, that having such a group in legislation is required, although I hear what Liam McArthur and John Finnie have said. Would we be legislating on something about which we have already had assurances from the cabinet secretary? Perhaps bringing such a group into legislation would blur boundaries and roles. In a bill to establish the commissioner, we should give that person the full role of picking the remit for an ethics advisory group.

I will not support amendment 31, based on my not being sure whether its proposed provisions should be in legislation at this stage, but I am not opposed to the premise of the amendment.

I believe that the committee unanimously supported the recommendation at stage 1. I am interested to hear the cabinet secretary’s views.

Although I understand the good intentions of amendment 31, I cannot support it in its current form.

The way that amendment 31 provides for the ethics advisory group to function is somewhat convoluted, with decision making on issues relating to membership being split between the commissioner, Scottish ministers and Parliament. For example, the regulations that would be made by ministers—and, therefore, scrutinised by Parliament—would specify the number of members. However, the commissioner would then appoint the members. Given that the commissioner is to be an independent office holder who will be accountable to the Scottish Parliamentary Corporate Body, I am not convinced that it is appropriate for ministers to be involved at all. The amendment would leave a host of matters to be decided in regulations by ministers.

In addition, the amendment specifies the matters that the group is to provide advice on. In principle, I agree that that is reasonable. However, in terms of future proofing, that could be restrictive or confusing. For example, amendment 31 calls the group the “Ethics Advisory Group” and tasks it with oversight on ethics. However, in proposed subsection (3)(b), it then requires the group also to advise on legal issues that might arise.

As it stands, amendment 31 gives a mixed message about the remit of the proposed group. There is also no ability for the remit to be adjusted in the future, because the regulation-making powers that are set out in proposed subsection (6) are not wide enough to cover the remit.

In my response to the stage 1 report, I explained to the committee that I fully support the formation of an advisory group and will honour the public commitment that was made to establish such a group. I was, however, not convinced by calls that were made during stage 1 that the group should be placed on a statutory footing, and the independent advisory group on biometric data previously made no such recommendation. I would prefer that the commissioner, once in post, consults and secures a broad range of views on such matters in order to allow proper discussion. The commissioner could then decide which matters he or she needs advice on, given that any such group should report directly to the commissioner. That would allow the necessary flexibility in how the group should operate.

Finally, there are a number of technical issues with the amendment—principally about the consistency of language and cross-references to the source of the regulation-making power, which is found in proposed subsection (6), not proposed subsection (7). I therefore ask Liam McArthur not to press amendment 31, but am happy to make him the offer—considering the technical challenges and the challenges that are presented by mixed messages about the responsibilities of Parliament, the commissioner, and ministers—to work with him to agree a suitable amendment ahead of stage 3.

I start again by thanking everybody who has contributed to the debate. Convener—you were right when you reminded the committee of the unanimous recommendation that it made at stage 1, and of the recommendation from the advisory group.

John Finnie was right to flag up cyberkiosks, which brought into stark relief issues of ethics and the legal framework. There is an overlap in that the language that the cabinet secretary suggested is slightly “confusing” captures very well some of the issues that have been thrown up by the proposed roll-out of cyberkiosks.

We have had assurances from the cabinet secretary about implementing measures to reflect what he understands to be the recommendation from the advisory group, but by putting the recommendation on a statutory footing by including it in the bill, we would set it firmly at the centre of how we believe governance and oversight need to function. Although I welcome the offer from the cabinet secretary to work with me during the next few weeks, ahead of stage 3, to tidy things up, it is important that the committee agrees to amendment 31 at stage 2. On that basis, I press amendment 31.

The question is, that amendment 31 be agreed to. Are we agreed?

Members: No.

There will be a division.

For

Finnie, John (Highlands and Islands) (Green)
Kelly, James (Glasgow) (Lab)
Kerr, Liam (North East Scotland) (Con)
McArthur, Liam (Orkney Islands) (LD)
Mitchell, Margaret (Central Scotland) (Con)

Against

Gilruth, Jenny (Mid Fife and Glenrothes) (SNP)
MacGregor, Fulton (Coatbridge and Chryston) (SNP)
Mackay, Rona (Strathkelvin and Bearsden) (SNP)
Robison, Shona (Dundee City East) (SNP)

The result of the division is: For 5, Against 4, Abstentions 0.

Amendment 31 agreed to.

Section 23—Meaning of “biometric data”

Amendment 32, in the name of the cabinet secretary, is grouped with amendments 33 and 34.

In its stage 1 report, the committee asked me to consider how the definition in section 23 could keep pace with future developments in biometrics. I believe that the definition is already broadly drawn. However, amendment 33 will insert a power for Scottish ministers to change or clarify the meaning of “biometric data” by regulations. Amendment 34 will make that power subject to affirmative procedure, which will allow Parliament to scrutinise fully any changes that the Scottish ministers propose to make to the definition.

Amendment 32 will make a minor amendment to the definition to clarify that it includes not only photographs or other recordings of an individual’s full body, but of any part of the body—for example, an arm that might have a distinguishing mark, such as a tattoo.

I move amendment 32.

Amendment 32 agreed to.

Section 23, as amended, agreed to.

After section 23

Amendment 33 moved—[Humza Yousaf]—and agreed to.

Section 24 agreed to.

Section 25—Regulations

Amendment 34 moved—[Humza Yousaf]—and agreed to.

Section 25, as amended, agreed to.

Sections 26 and 27 agreed to.

Schedule 2 agreed to.

Sections 28 and 29 agreed to.

Long title agreed to.

That ends stage 2 consideration of the bill. I thank the cabinet secretary for attending.

We have gone on a little bit longer than expected in order to get through all the stage 2 amendments. On that basis, does the committee agree to take the outstanding agenda items at our next meeting, which will be advised by the clerks?

Members indicated agreement.

Meeting closed at 12:55.